Add MS15-100 Microsoft Windows Media Center MCL Vulnerability

[wchen-r7]

This is the shortest MSFT exploit I've ever written.

• Start a Win 7 SP1 (x86) test box
• rvmsudo msfconsole
• run windows/fileformat/ms15_100_mcl_exe, it will generate a mcl file
• drag and drop the mcl file to the windows box, double click on it, click yes for the prompt, and then the payload should be executed.

The patch is here:
https://technet.microsoft.com/en-us/library/security/ms15-100.aspx

• After you apply the patch, the payload will not execute, and eventually it will say "cannot run file://..." or something like that.

[firefart]

Why not run powershell with an encoded msf payload or smth similar?

[wchen-r7]

Did not figure out how to pass an argument. Wanna try? :-)

[firefart]

just tried it and it looks like it only works without parameters :(

[firefart]

@wchen-r7 should we unregister the FILE_CONTENTS option for this module?

[wchen-r7]

That's true, it shouldn't be there. Gone now!

[firefart]

Thanks @wchen-r7 :)

[firefart]

@wchen-r7 some new ideas for this exploit:
https://blog.coresecurity.com/2015/12/09/exploiting-windows-media-center/

[wchen-r7]

I saw. Thanks.