Skip to content

Commit 3a05993

Browse files
author
jvazquez-r7
committed
Make msftidy happy and warn user about long times
1 parent 0851974 commit 3a05993

File tree

1 file changed

+12
-12
lines changed

1 file changed

+12
-12
lines changed

modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -26,17 +26,17 @@ def initialize(info={})
2626
applications from medium or high integrity applications. This allows commands to be
2727
broadcasted to an open medium or high integrity command prompts allowing escalation
2828
of privileges. We can spawn a medium integrity command prompt, after spawning a low
29-
integrity command prompt, by using the Win+Shift+# combination to specify the position
30-
of the command prompt on the taskbar. We can then broadcast our command and hope that
31-
the user is away and doesn't corrupt it by interacting with the UI. Broadcast issue
32-
affects versions Windows Vista, 7, 8, Server 2008, Server 2008 R2, Server 2012, RT.
33-
But Spawning a command prompt with the shortcut key does not work in Vista so you will
34-
have to check if the user is already running a command prompt and set SPAWN_PROMPT
35-
false. The WEB technique will use powershell to download and execute a powershell
36-
encoded payload. The FILE technique will drop an executable to the file system, set it
37-
to medium integrity and execute it. The TYPE technique will attempt to execute a
38-
powershell encoded payload directly from the command line but it may take some time to
39-
complete.
29+
integrity command prompt, by using the Win+Shift+# combination to specify the
30+
position of the command prompt on the taskbar. We can then broadcast our command
31+
and hope that the user is away and doesn't corrupt it by interacting with the UI.
32+
Broadcast issue affects versions Windows Vista, 7, 8, Server 2008, Server 2008 R2,
33+
Server 2012, RT. But Spawning a command prompt with the shortcut key does not work
34+
in Vista so you will have to check if the user is already running a command prompt
35+
and set SPAWN_PROMPT false. The WEB technique will execute a powershell encoded
36+
payload from a Web location. The FILE technique will drop an executable to the
37+
file system, set it to medium integrity and execute it. The TYPE technique will
38+
attempt to execute a powershell encoded payload directly from the command line but
39+
it may take some time to complete.
4040
},
4141
'License' => MSF_LICENSE,
4242
'Author' =>
@@ -68,7 +68,6 @@ def initialize(info={})
6868
OptBool.new('SPAWN_PROMPT', [true, 'Attempts to spawn a medium integrity command prompt', true]),
6969
OptEnum.new('TECHNIQUE', [true, 'Delivery technique', 'WEB', ['WEB','FILE','TYPE']]),
7070
OptString.new('CUSTOM_COMMAND', [false, 'Custom command to type'])
71-
7271
], self.class
7372
)
7473

@@ -162,6 +161,7 @@ def exploit
162161
if datastore['CUSTOM_COMMAND']
163162
command = datastore['CUSTOM_COMMAND']
164163
else
164+
print_warning("WARNING: It can take a LONG TIME to broadcast the cmd script to execute the psh payload")
165165
command = cmd_psh_payload(payload.encoded)
166166
end
167167
make_it(command)

0 commit comments

Comments
 (0)