@@ -13,14 +13,14 @@ class MetasploitModule < Msf::Exploit::Remote
13
13
14
14
def initialize ( info = { } )
15
15
super ( update_info ( info ,
16
- 'Name' => 'MS17-010 EternalBlue SMBv1/SMBv2 Kernel Pool Corruption' ,
16
+ 'Name' => 'MS17-010 EternalBlue SMB Remote Kernel Pool Corruption' ,
17
17
'Description' => %q{
18
18
This module is a port of the Equation Group ETERNALBLUE exploit, part of
19
19
the FuzzBunch toolkit released by Shadow Brokers.
20
20
21
21
There is a buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size
22
- is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a
23
- DWORD is subtracted into a WORD. The kernel pool is groomed so that overflow
22
+ is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a
23
+ DWORD is subtracted into a WORD. The kernel pool is groomed so that overflow
24
24
is well laid-out to overwrite an SMBv1 buffer. Actual RIP hijack is later
25
25
completed in srvnet!SrvNetWskReceiveComplete.
26
26
@@ -73,7 +73,7 @@ def initialize(info = {})
73
73
] ,
74
74
] ,
75
75
'DefaultTarget' => 0 ,
76
- 'DisclosureDate' => 'March 14, 2017'
76
+ 'DisclosureDate' => 'Mar 14 2017'
77
77
) )
78
78
79
79
register_options (
@@ -123,9 +123,9 @@ def exploit
123
123
::Rex ::ConnectionRefused => e
124
124
print_bad ( "#{ e . class } : #{ e . message } " )
125
125
rescue => error
126
- puts error . class
127
- puts error . message
128
- puts error . backtrace
126
+ print_bad ( error . class )
127
+ print_bad ( error . message )
128
+ print_bad ( error . backtrace )
129
129
ensure
130
130
# pass
131
131
end
@@ -686,4 +686,3 @@ def make_kernel_shellcode
686
686
end
687
687
688
688
end
689
-
0 commit comments