From 6db1df849687ce09206ab9f1a1ec37e95f9edb8a Mon Sep 17 00:00:00 2001 From: worawit Date: Tue, 20 Jun 2017 20:50:23 +0700 Subject: [PATCH] add comment on kshellcode about freeing corrupted buffer --- shellcode/eternalblue_kshellcode_x64.asm | 2 ++ shellcode/eternalblue_kshellcode_x86.asm | 2 ++ 2 files changed, 4 insertions(+) diff --git a/shellcode/eternalblue_kshellcode_x64.asm b/shellcode/eternalblue_kshellcode_x64.asm index 16e4a72..668779b 100644 --- a/shellcode/eternalblue_kshellcode_x64.asm +++ b/shellcode/eternalblue_kshellcode_x64.asm @@ -13,6 +13,8 @@ ; get call because system call is called on other processors. ; - The shellcode do not allocate shadow stack if possible for minimal shellcode size. ; It is ok because some Windows function does not require shadow stack. +; - Compiling shellcode with specific Windows version macro, corrupted buffer will be freed. +; This helps running exploit against same target repeatly more reliable. ; - The userland payload MUST be appened to this shellcode. ; ; Reference: diff --git a/shellcode/eternalblue_kshellcode_x86.asm b/shellcode/eternalblue_kshellcode_x86.asm index 5e6b266..2d64763 100644 --- a/shellcode/eternalblue_kshellcode_x86.asm +++ b/shellcode/eternalblue_kshellcode_x86.asm @@ -11,6 +11,8 @@ ; If userland shellcode causes any exception, the system process get killed. ; - On idle target with multiple core processors, the hijacked system call might take a while (> 5 minutes) to ; get call because system call is called on other processors. +; - Compiling shellcode with specific Windows version macro, corrupted buffer will be freed. +; This helps running exploit against same target repeatly more reliable. ; - The userland payload MUST be appened to this shellcode. ; ; Reference: