Skip to content

Commit 6773a10

Browse files
Royce DavisRoyce Davis
authored andcommitted
Made changes to cleanup to use file_dropper instead
1 parent 7361e10 commit 6773a10

File tree

1 file changed

+16
-29
lines changed

1 file changed

+16
-29
lines changed

lib/msf/core/exploit/psexec.rb

Lines changed: 16 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ module Exploit::Remote::Psexec
1212

1313
include Msf::Exploit::Remote::DCERPC
1414
include Msf::Exploit::Remote::SMB
15+
include Msf::Exploit::FileDropper
1516

1617
# Retrieves output from the executed command
1718
#
@@ -47,7 +48,7 @@ def get_output(smbshare, ip, file)
4748
# @param command [String] Should be a valid windows command
4849
# @return [Boolean] true if everything wen't well
4950
def psexec(command)
50-
51+
print_status("#{peer} - Executing: #{command}")
5152
simple.connect("IPC$")
5253

5354
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
@@ -157,34 +158,20 @@ def psexec(command)
157158
return true
158159
end
159160

160-
# This is the cleanup method, removes .txt and .bat file/s created
161-
# during execution
162-
#
163-
# @example
164-
# cleanup_after("C$", rhost, '\WINDOWS\Temp\output.txt', 'C:\WINDOWS\Temp\batchfile.bat')
165-
#
166-
# @param smbshare [String] The SMBshare to connect to. Usually C$
167-
# @param ip [String] IP address of remote host to connect to
168-
# @param text [String] Path to the text file relative to the smbshare
169-
# @param bat [String] Full path to the batch file created
170-
# @return [StandarError] only in the event of an error
171-
def cleanup_after(smbshare, ip, text, bat)
172-
begin
173-
# Try and do cleanup command/s
174-
cleanup = "%COMSPEC% /C del %SYSTEMDRIVE%#{text} & del #{bat}"
175-
print_status("#{peer} - Executing cleanup...")
176-
psexec(cleanup)
177-
if !check_cleanup(smbshare, ip, text)
178-
print_error("#{peer} - Unable to cleanup. Make sure to manually remove files from the target.")
179-
else
180-
print_status("#{peer} - Cleanup was successful")
181-
end
182-
rescue StandardError => cleanuperror
183-
print_error("#{peer} - Unable to processes cleanup commands. Error: #{cleanuperror}")
184-
print_error("#{peer} - Make sure to manually remove files from the target")
185-
return cleanuperror
186-
end
187-
end
161+
# This method is called by file_dropper to remove files droped
162+
# By your module
163+
#
164+
# @example
165+
# file_rm('C:\WINDOWS\Temp\output.txt')
166+
#
167+
# @param file [String] Full path to a file on the remote host
168+
# @return [StandardError] only in the event of an error
169+
def file_rm(file)
170+
delete = "%COMSPEC% /C del #{file}"
171+
print_status("#{peer} - Deleting #{file}")
172+
psexec(delete)
173+
print_status("#{peer} - Command Ran")
174+
end
188175

189176
# Make sure the cleanup command worked
190177
# This method should only be called from within cleanup_after

0 commit comments

Comments
 (0)