Module: Msf::Exploit::RIFF

Defined in:
lib/msf/core/exploit/riff.rb

Overview

This module provides some functions for dealing with MCI RIFF data

Instance Method Summary collapse

Instance Method Details

#random_riff_chunk(len = rand(128) + 1) ⇒ Object

Generates a random RIFF chunk, up to 136 bytes



51
52
53
 
# File 'lib/msf/core/exploit/riff.rb', line 51

def random_riff_chunk(len = rand(128) + 1)
  riff_chunk(random_riff_tag, rand_text(len))
end

#random_riff_chunks(count = rand(16) + 17) ⇒ Object

Generates a random number of random RIFF chunks, up to 4352 bytes



38
39
40
41
42
43
44
45
46
 
# File 'lib/msf/core/exploit/riff.rb', line 38

def random_riff_chunks(count = rand(16) + 17)
  chunks = ''

  0.upto(count) do
  chunks << random_riff_chunk()
  end

  return chunks
end

#random_riff_tag ⇒ Object

Generates a random RIFF tag, making sure that it’s not one of the tags processed by LoadAniIcon or LoadCursorIconFromFileMap



60
61
62
63
64
65
66
67
68
69
 
# File 'lib/msf/core/exploit/riff.rb', line 60

def random_riff_tag
  valid = ['RIFF', 'ACON', 'anih', 'LIST', 'fram', 'icon', 'rate']

  tag = nil
  begin
  tag = rand_text_alpha(4)
  end while valid.include? tag

  return tag
end

#riff_chunk(tag, data) ⇒ Object

Builds a RIFF chunk with a specified tag and data



16
17
18
19
20
21
22
 
# File 'lib/msf/core/exploit/riff.rb', line 16

def riff_chunk(tag, data)

  len = data.length
  padding = len % 2   # RIFF chunks must be 2 byte aligned

  return tag + [len].pack('V') + data + ("\x00" * padding)
end

#riff_list_chunk(tag, type, data) ⇒ Object

Builds a RIFF list chunk (one containing other chunks)



27
28
29
30
31
32
33
 
# File 'lib/msf/core/exploit/riff.rb', line 27

def riff_list_chunk(tag, type, data)

  len = data.length + 4
  padding = len % 2

  return tag + [len].pack('V') + type + data
end