infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updates js_property_spray documentation 

After many tests, it turns out address 0x0c0d2020 is the most
consistent location acorss various IE versions.  For dev purposes,
it's rather important to have this documented somewhere.

Thanks to corelanc0d3r for the data.
unstable
sinn3r 2013-06-07 00:28:22 -05:00
parent b34c3fbbc1
commit 8e2de6d14f
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/msf/core/exploit/http/server.rb
View File

@ -924,7 +924,9 @@ protected
# #
# This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty) # This heap spray technique takes advantage of MSHTML's SetStringProperty (or SetProperty)
# function to trigger allocations by ntdll!RtlAllocateHeap. It is based on Corelan's # function to trigger allocations by ntdll!RtlAllocateHeap. It is based on Corelan's
# publication on "DEPS – Precise Heap Spray on Firefox and IE10". # publication on "DEPS – Precise Heap Spray on Firefox and IE10". In IE, the shellcode
# should land at address 0x0c0d2020, as this is the most consistent location across
# various versions.
# #
# The "sprayHeap" JavaScript function supports the following arguments: # The "sprayHeap" JavaScript function supports the following arguments:
# shellcode => The shellcode to spray in JavaScript. Note: Avoid null bytes. # shellcode => The shellcode to spray in JavaScript. Note: Avoid null bytes.