@@ -12,16 +12,16 @@ module Exploit::Local::WindowsKernel
12
12
# @return [nil] If the address could not be found.
13
13
#
14
14
def find_haldispatchtable
15
- kernel_info = find_sys_base ( nil )
16
- if kernel_info . nil?
15
+ kernel_address , kernel_name = find_sys_base ( nil )
16
+ if kernel_address . nil? || kernel_name . nil?
17
17
print_error ( "Failed to find the address of the Windows kernel" )
18
18
return nil
19
19
end
20
- vprint_status ( "Kernel Base Address: 0x#{ kernel_info [ 0 ] . to_s ( 16 ) } " )
20
+ vprint_status ( "Kernel Base Address: 0x#{ kernel_address . to_s ( 16 ) } " )
21
21
22
- h_kernel = session . railgun . kernel32 . LoadLibraryExA ( kernel_info [ 1 ] , 0 , 1 )
22
+ h_kernel = session . railgun . kernel32 . LoadLibraryExA ( kernel_name , 0 , 1 )
23
23
if h_kernel [ 'return' ] == 0
24
- print_error ( "Failed to load #{ kernel_info [ 1 ] } (error: #{ h_kernel [ 'GetLastError' ] } #{ h_kernel [ 'ErrorMessage' ] } )" )
24
+ print_error ( "Failed to load #{ kernel_name } (error: #{ h_kernel [ 'GetLastError' ] } #{ h_kernel [ 'ErrorMessage' ] } )" )
25
25
return nil
26
26
end
27
27
h_kernel = h_kernel [ 'return' ]
@@ -34,7 +34,7 @@ def find_haldispatchtable
34
34
hal_dispatch_table = hal_dispatch_table [ 'return' ]
35
35
36
36
hal_dispatch_table -= h_kernel
37
- hal_dispatch_table += kernel_info [ 0 ]
37
+ hal_dispatch_table += kernel_address
38
38
vprint_status ( "HalDispatchTable Address: 0x#{ hal_dispatch_table . to_s ( 16 ) } " )
39
39
hal_dispatch_table
40
40
end
@@ -75,10 +75,10 @@ def find_sys_base(drvname)
75
75
current_drvname = results [ 'lpBaseName' ] [ 0 , results [ 'return' ] ]
76
76
if drvname . nil?
77
77
if current_drvname . downcase . include? ( 'krnl' )
78
- return [ address , current_drvname ]
78
+ return address , current_drvname
79
79
end
80
80
elsif drvname == current_drvname
81
- return [ address , current_drvname ]
81
+ return address , current_drvname
82
82
end
83
83
end
84
84
end
0 commit comments