better style according to the review
parent
ce848712dd
commit
ff07289132
|
@ -589,20 +589,20 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
def hash(process)
|
||||
# x64_calc_hash from external/source/shellcode/windows/multi_arch_kernel_queue_apc.asm
|
||||
proc_hash = 0
|
||||
process += "\x00"
|
||||
process.each_byte { |c|
|
||||
process << "\x00"
|
||||
process.each_byte do |c|
|
||||
proc_hash = ror(proc_hash, 13)
|
||||
proc_hash += c
|
||||
}
|
||||
return [proc_hash].pack('l<')
|
||||
end
|
||||
[proc_hash].pack('l<')
|
||||
end
|
||||
|
||||
def ror(dword, bits)
|
||||
return ( dword >> bits | dword << ( 32 - bits ) ) & 0xFFFFFFFF
|
||||
( dword >> bits | dword << ( 32 - bits ) ) & 0xFFFFFFFF
|
||||
end
|
||||
|
||||
|
||||
def make_kernel_shellcode(proc_name="spoolsv.exe")
|
||||
def make_kernel_shellcode(proc_name)
|
||||
# see: external/source/shellcode/windows/multi_arch_kernel_queue_apc.asm
|
||||
# Length: 1019 bytes
|
||||
|
||||
|
|
Loading…
Reference in New Issue