infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Lands #4429 by fixing windows/messagebox with EXITFUNC=none

bug/bundler_fix
HD Moore 2014-12-19 14:51:57 -06:00
parent 85ec71bd1e 2c0c732967
commit 9ede2c2ca5
No known key found for this signature in database
GPG Key ID: 22015B93FA604913
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
modules/payloads/singles/windows/messagebox.rb
View File

@ -86,12 +86,17 @@ EOS
call [ebp+8] ;ExitProcess/Thread(0) call [ebp+8] ;ExitProcess/Thread(0)
EOS EOS
# if exit is set to seh, overrule # if exit is set to seh or none, overrule
if datastore['EXITFUNC'].upcase.strip == "SEH" if datastore['EXITFUNC'].upcase.strip == "SEH"
# routine to exit via exception # routine to exit via exception
doexit = <<EOS doexit = <<EOS
xor eax,eax xor eax,eax
call eax call eax
EOS
getexitfunc = ''
elsif datastore['EXITFUNC'].upcase.strip == "NONE"
doexit = <<-EOS
nop
EOS EOS
getexitfunc = '' getexitfunc = ''
end end
@ -232,6 +237,7 @@ start_main:
push 0x41206c6c push 0x41206c6c
push 0x642e3233 push 0x642e3233
push 0x72657375 ;user32.dll push 0x72657375 ;user32.dll
xor bl,bl ;make sure we have a null byte
mov [esp+0xA],bl ;null byte mov [esp+0xA],bl ;null byte
mov esi,esp ;put pointer to string on top of stack mov esi,esp ;put pointer to string on top of stack
push esi push esi