Skip to content

Commit eb4e3f8

Browse files
committed
Fix os detection
1 parent 8b51877 commit eb4e3f8

File tree

1 file changed

+15
-7
lines changed

1 file changed

+15
-7
lines changed

modules/exploits/windows/local/ms_ndproxy.rb

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -287,18 +287,26 @@ def check
287287
return Exploit::CheckCode::Detected
288288
end
289289

290-
os = sysinfo["OS"]
291-
unless os =~ /windows xp/i or os =~ /[2003|.net server].*service pack 2/i
292-
return Exploit::CheckCode::Safe
293-
end
294-
295290
handle = open_device("\\\\.\\NDProxy")
296291
if handle.nil?
297292
return Exploit::CheckCode::Safe
298293
end
299294
session.railgun.kernel32.CloseHandle(handle)
300295

301-
return Exploit::CheckCode::Appears
296+
os = sysinfo["OS"]
297+
case os
298+
when /windows xp.*service pack 3/i
299+
return Exploit::CheckCode::Appears
300+
when /[2003|.net server].*service pack 2/i
301+
return Exploit::CheckCode::Appears
302+
when /windows xp/i
303+
return Exploit::CheckCode::Detected
304+
when /[2003|.net server]/i
305+
return Exploit::CheckCode::Detected
306+
else
307+
return Exploit::CheckCode::Safe
308+
end
309+
302310
end
303311

304312
def exploit
@@ -316,7 +324,7 @@ def exploit
316324
if target.name =~ /Automatic/
317325
print_status("Detecting the target system...")
318326
os = sysinfo["OS"]
319-
if os =~ /windows xp/i
327+
if os =~ /windows xp.*service pack 3/i
320328
my_target = targets[1]
321329
print_status("Running against #{my_target.name}")
322330
elsif ((os =~ /2003/) and (os =~ /service pack 2/i))

0 commit comments

Comments
 (0)