@@ -28,18 +28,18 @@ def initialize(info={})
28
28
leveraged for code execution. First of all, Packager does not load the INF file directly.
29
29
But as an attacker, you can trick it to load your INF anyway by embedding the file path as
30
30
a remote share in an OLE object. The packager will then treat it as a type of media file,
31
- and load it with the packager!CPackage::OLE2MPlayerReadFromStream, which will download it
32
- with a CopyFileW call, save it in a temp folder, and pass that information for later. The
33
- exploit will do this loading process twice: first for a fake gif file that's actually the
34
- payload, and the second for the INF file.
31
+ and load it with the packager!CPackage::OLE2MPlayerReadFromStream function , which will
32
+ download it with a CopyFileW call, save it in a temp folder, and pass that information for
33
+ later. The exploit will do this loading process twice: first for a fake gif file that's
34
+ actually the payload, and the second for the INF file.
35
35
36
36
The packager will also look at each OLE object's XML Presentation Command, specifically the
37
37
type and cmd property. In the exploit, "verb" media command type is used, and this triggers
38
38
the packager!CPackage::DoVerb function. Also, "-3" is used as the fake gif file's cmd
39
39
property, and "3" is used for the INF. When the cmd is "-3", DoVerb will bail. But when "3"
40
40
is used (again, for the INF file), it will cause the packager to try to find appropriate
41
41
handler for it, which will end up with C:\Windows\System32\infDefaultInstall.exe, and that
42
- will install/run the malicious file, and finally give us arbitrary code execution.
42
+ will install/run the malicious INF file, and finally give us arbitrary code execution.
43
43
} ,
44
44
'License' => MSF_LICENSE ,
45
45
'Author' =>
0 commit comments