File tree Expand file tree Collapse file tree 1 file changed +2
-2
lines changed
modules/exploits/windows/fileformat Expand file tree Collapse file tree 1 file changed +2
-2
lines changed Original file line number Diff line number Diff line change @@ -25,13 +25,13 @@ def initialize(info={})
25
25
26
26
This module will generate three files: an INF, a GIF, and a PPSX file. You are required to
27
27
set up a SMB or Samba 3 server and host the INF and GIF there. Systems such as Ubuntu or an
28
- older version of Winodws (such as XP) work best for this because they require little
28
+ older version of Windows (such as XP) work best for this because they require little
29
29
configuration to get going. The PPSX file is what you should send to your target.
30
30
31
31
In detail, the vulnerability has to do with how the Object Packager 2 component
32
32
(packager.dll) handles an INF file that contains malicious registry changes, which may be
33
33
leveraged for code execution. First of all, Packager does not load the INF file directly.
34
- But as an attacker, you can trick it to load your INF anyway by embedding the file path as
34
+ As an attacker, you can trick it to load your INF anyway by embedding the file path as
35
35
a remote share in an OLE object. The packager will then treat it as a type of media file,
36
36
and load it with the packager!CPackage::OLE2MPlayerReadFromStream function, which will
37
37
download it with a CopyFileW call, save it in a temp folder, and pass that information for
You can’t perform that action at this time.
0 commit comments