Skip to content

Commit 0e7c3a8

Browse files
committed
Prepend unlink instead of appending
Makes it work when using meterpreter. Because "quit" or "exit" in the console ends up calling die() instead of falling through to whatever's left in the file, a meterpreter session would never reach the code to delete itself before this change.
1 parent af8ac2f commit 0e7c3a8

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

lib/msf/core/exploit/php_exe.rb

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ def get_write_exec_payload(opts={})
5050
end
5151
if target["Platform"] == 'win'
5252
bin_name << ".exe"
53-
print_debug("Unable to clean up #{bin_name}, delete it manually")
53+
print_warning("Unable to clean up #{bin_name}, delete it manually")
5454
end
5555
p = Rex::Text.encode_base64(generate_payload_exe)
5656
php = %Q{
@@ -74,7 +74,9 @@ def get_write_exec_payload(opts={})
7474
end
7575

7676
if opts[:unlink_self]
77-
php << "unlink(__FILE__);"
77+
# Prepend instead of appending to make sure it happens no matter
78+
# what the payload normally does.
79+
php = "@unlink(__FILE__);" + php
7880
end
7981

8082
php.gsub!(/#.*$/, '')

0 commit comments

Comments
 (0)