Update #get_dotnet_path

modules/exploits/windows/local/applocker_bypass.rb

@@ -88,10 +88,17 @@ class Metasploit4 < Msf::Exploit::Local
   def get_dotnet_path(windir)
     base_path = "#{windir}\\Microsoft.NET\\Framework#{payload.arch.first == 'x86' ? '' : '64'}"
     paths = dir(base_path).select {|p| p[0] == 'v'}
-    version = paths.last
-    dotnet_path = "#{base_path}\\#{version}"
+    dotnet_path = nil
 
-    unless dotnet_path && directory?(dotnet_path)
+    paths.reverse.each do |p|
+      path = "#{base_path}\\#{p}"
+      if directory?(path) && file?("#{path}\\InstallUtil.exe")
+        dotnet_path = path
+        break
+      end
+    end
+
+    unless dotnet_path
       fail_with(Failure::NotVulnerable, '.NET is not present on the target.')
     end