I'm an idiot, fix logon xpath

2013-02-14 09:16:47 -05:00 · 2013-02-14 09:16:47 -05:00 · 7b2c1afadb
parent e78cbdd14d
commit 7b2c1afadb
1 changed files with 2 additions and 2 deletions
--- a/modules/exploits/windows/local/s4u_persistence.rb
+++ b/modules/exploits/windows/local/s4u_persistence.rb
@ -193,7 +193,7 @@ class Metasploit3 < Msf::Exploit::Local
 			when 'logon'
 				# Trigger based on winlogon event, checks windows license key after logon
 				print_status("This trigger triggers on event 4101 which validates the Windows license")
-				line = "(EventID=4101) and *[System[Provider[@Name='Microsoft-Windows-Winlogon']]]"
+				line = "*[System[EventID='4101']] and *[System[Provider[@Name='Microsoft-Windows-Winlogon']]]"
 				xml = create_trigger_event_tags("Application", line, xml)

 			when 'lock'