update description to remove blurb about ATSVC pipe, since it is no longer used
git-svn-id: file:///home/svn/framework3/trunk@12226 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
f9680c854b
commit
8a627758f3
|
@ -32,10 +32,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
By sending WritePrinter requests, an attacker can fully control the content of
|
||||
the created file.
|
||||
|
||||
In order to gain code execution, this module writes an EXE and then (ab)uses the
|
||||
impersonation vulnerability a second time to create a secondary RPC connection
|
||||
to the \\PIPE\\ATSVC named pipe. We then proceed to create a remote AT job using
|
||||
a blind NetrJobAdd RPC call.
|
||||
In order to gain code execution, this module writes to a directory used by Windows
|
||||
Manamgenet Instrumentation (WMI) to deploy applications. This directory (Wbem\\Mof)
|
||||
is periodically scanned and any new .mof files are processed automatically. This is
|
||||
the same technique employed by the Stuxnet code found in the wild.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
|
|
Loading…
Reference in New Issue