Metasploit mailing list archives

metaphish win32pe corrupt binary


From: hdm at metasploit.com (HD Moore)
Date: Tue, 08 Sep 2009 15:34:21 -0500

On Mon, 2009-08-17 at 11:24 -0400, reydecopas at gmail.com wrote:
svn  At revision 6954.

Metaphish works but win32exe generated is corrupted.

 modules/exploits/windows/browser/meta-phish.rb:
         @msf_payload = Msf::Util::EXE.to_win32pe(framework,payload.encoded)

The size is now limited to 2048, the payload space needs to be adjusted
to compensate. Since metaphish is not in the tree (adobe pdf embedded
exe is), we can't update the module. I will contact the metaphish folks
and ask them to update their code. In the meantime, I have updated the
SVN code to throw an error if more than 2048 bytes are passed to the EXE
generation function.

-HD



Current thread: