Skip to content

Commit a79427a

Browse files
committed
I shoulda checked before git commit
1 parent 4c0048f commit a79427a

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

modules/exploits/windows/fileformat/ms14_060_sandworm.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,18 +28,18 @@ def initialize(info={})
2828
leveraged for code execution. First of all, Packager does not load the INF file directly.
2929
But as an attacker, you can trick it to load your INF anyway by embedding the file path as
3030
a remote share in an OLE object. The packager will then treat it as a type of media file,
31-
and load it with the packager!CPackage::OLE2MPlayerReadFromStream, which will download it
32-
with a CopyFileW call, save it in a temp folder, and pass that information for later. The
33-
exploit will do this loading process twice: first for a fake gif file that's actually the
34-
payload, and the second for the INF file.
31+
and load it with the packager!CPackage::OLE2MPlayerReadFromStream function, which will
32+
download it with a CopyFileW call, save it in a temp folder, and pass that information for
33+
later. The exploit will do this loading process twice: first for a fake gif file that's
34+
actually the payload, and the second for the INF file.
3535
3636
The packager will also look at each OLE object's XML Presentation Command, specifically the
3737
type and cmd property. In the exploit, "verb" media command type is used, and this triggers
3838
the packager!CPackage::DoVerb function. Also, "-3" is used as the fake gif file's cmd
3939
property, and "3" is used for the INF. When the cmd is "-3", DoVerb will bail. But when "3"
4040
is used (again, for the INF file), it will cause the packager to try to find appropriate
4141
handler for it, which will end up with C:\Windows\System32\infDefaultInstall.exe, and that
42-
will install/run the malicious file, and finally give us arbitrary code execution.
42+
will install/run the malicious INF file, and finally give us arbitrary code execution.
4343
},
4444
'License' => MSF_LICENSE,
4545
'Author' =>

0 commit comments

Comments
 (0)