infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Railgun DWORD handling

bug/bundler_fix
Meatballs 2014-12-23 10:44:29 +00:00
parent d4707b8e07
commit 02864b4401
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb
View File

@ -318,7 +318,10 @@ class DLL
buffer = rec_out_only_buffers[buffer_item.addr, buffer_item.length_in_bytes] buffer = rec_out_only_buffers[buffer_item.addr, buffer_item.length_in_bytes]
case buffer_item.datatype case buffer_item.datatype
when "PDWORD" when "PDWORD"
return_hash[param_name] = buffer.unpack(native)[0] # PDWORD is treated as a POINTER
return_hash[param_name] = buffer.unpack(native).first
# If PDWORD is treated correctly as a DWORD
return_hash[param_name] = buffer.unpack('V').first if return_hash[param_name].nil?
when "PCHAR" when "PCHAR"
return_hash[param_name] = asciiz_to_str(buffer) return_hash[param_name] = asciiz_to_str(buffer)
when "PWCHAR" when "PWCHAR"
@ -338,7 +341,10 @@ class DLL
buffer = rec_inout_buffers[buffer_item.addr, buffer_item.length_in_bytes] buffer = rec_inout_buffers[buffer_item.addr, buffer_item.length_in_bytes]
case buffer_item.datatype case buffer_item.datatype
when "PDWORD" when "PDWORD"
return_hash[param_name] = buffer.unpack(native)[0] # PDWORD is treated as a POINTER
return_hash[param_name] = buffer.unpack(native).first
# If PDWORD is treated correctly as a DWORD
return_hash[param_name] = buffer.unpack('V').first if return_hash[param_name].nil?
when "PCHAR" when "PCHAR"
return_hash[param_name] = asciiz_to_str(buffer) return_hash[param_name] = asciiz_to_str(buffer)
when "PWCHAR" when "PWCHAR"