Skip to content

Commit 2ed02c3

Browse files
committed
Use better variable names instad of an array
1 parent b602e47 commit 2ed02c3

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

lib/msf/core/exploit/local/windows_kernel.rb

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,16 @@ module Exploit::Local::WindowsKernel
1212
# @return [nil] If the address could not be found.
1313
#
1414
def find_haldispatchtable
15-
kernel_info = find_sys_base(nil)
16-
if kernel_info.nil?
15+
kernel_address, kernel_name = find_sys_base(nil)
16+
if kernel_address.nil? || kernel_name.nil?
1717
print_error("Failed to find the address of the Windows kernel")
1818
return nil
1919
end
20-
vprint_status("Kernel Base Address: 0x#{kernel_info[0].to_s(16)}")
20+
vprint_status("Kernel Base Address: 0x#{kernel_address.to_s(16)}")
2121

22-
h_kernel = session.railgun.kernel32.LoadLibraryExA(kernel_info[1], 0, 1)
22+
h_kernel = session.railgun.kernel32.LoadLibraryExA(kernel_name, 0, 1)
2323
if h_kernel['return'] == 0
24-
print_error("Failed to load #{kernel_info[1]} (error: #{h_kernel['GetLastError']} #{h_kernel['ErrorMessage']})")
24+
print_error("Failed to load #{kernel_name} (error: #{h_kernel['GetLastError']} #{h_kernel['ErrorMessage']})")
2525
return nil
2626
end
2727
h_kernel = h_kernel['return']
@@ -34,7 +34,7 @@ def find_haldispatchtable
3434
hal_dispatch_table = hal_dispatch_table['return']
3535

3636
hal_dispatch_table -= h_kernel
37-
hal_dispatch_table += kernel_info[0]
37+
hal_dispatch_table += kernel_address
3838
vprint_status("HalDispatchTable Address: 0x#{hal_dispatch_table.to_s(16)}")
3939
hal_dispatch_table
4040
end
@@ -75,10 +75,10 @@ def find_sys_base(drvname)
7575
current_drvname = results['lpBaseName'][0,results['return']]
7676
if drvname.nil?
7777
if current_drvname.downcase.include?('krnl')
78-
return [address, current_drvname]
78+
return address, current_drvname
7979
end
8080
elsif drvname == current_drvname
81-
return [address, current_drvname]
81+
return address, current_drvname
8282
end
8383
end
8484
end

0 commit comments

Comments
 (0)