Skip to content

Commit 6127ff9

Browse files
committed
Fix race condition
Wait for Sysprep to ExitProcess before cleaning up the DLLs...
1 parent d396be9 commit 6127ff9

File tree

4 files changed

+2
-1
lines changed

4 files changed

+2
-1
lines changed

data/post/bypassuac-x64.dll

100755100644
0 Bytes
Binary file not shown.

data/post/bypassuac-x86.dll

100755100644
0 Bytes
Binary file not shown.

external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ void exploit()
8585
Wow64DisableWow64FsRedirection(&OldValue);
8686
if (ShellExecuteExW(&shinfo) && shinfo.hProcess != NULL)
8787
{
88+
WaitForSingleObject(shinfo.hProcess, 10000);
8889
CloseHandle(shinfo.hProcess);
8990
}
9091
Wow64RevertWow64FsRedirection(OldValue);

modules/exploits/windows/local/bypassuac_injection.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ def run_injection(pid, dll_path)
168168
vprint_status("Executing payload")
169169
thread = host_process.thread.create(exploit_mem + offset, 0)
170170
print_good("Successfully injected payload in to process: #{pid}")
171-
client.railgun.kernel32.WaitForSingleObject(thread.handle,3000)
171+
client.railgun.kernel32.WaitForSingleObject(thread.handle,14000)
172172
rescue Rex::Post::Meterpreter::RequestError => e
173173
print_error("Failed to Inject Payload to #{pid}!")
174174
vprint_error(e.to_s)

0 commit comments

Comments
 (0)