1
mirror of https://github.com/rapid7/metasploit-framework synced 2024-11-05 14:57:30 +01:00

I shoulda checked before git commit

This commit is contained in:
sinn3r 2014-10-17 00:54:45 -05:00
parent 4c0048f26a
commit a79427a659

View File

@ -28,10 +28,10 @@ class Metasploit3 < Msf::Exploit::Remote
leveraged for code execution. First of all, Packager does not load the INF file directly.
But as an attacker, you can trick it to load your INF anyway by embedding the file path as
a remote share in an OLE object. The packager will then treat it as a type of media file,
and load it with the packager!CPackage::OLE2MPlayerReadFromStream, which will download it
with a CopyFileW call, save it in a temp folder, and pass that information for later. The
exploit will do this loading process twice: first for a fake gif file that's actually the
payload, and the second for the INF file.
and load it with the packager!CPackage::OLE2MPlayerReadFromStream function, which will
download it with a CopyFileW call, save it in a temp folder, and pass that information for
later. The exploit will do this loading process twice: first for a fake gif file that's
actually the payload, and the second for the INF file.
The packager will also look at each OLE object's XML Presentation Command, specifically the
type and cmd property. In the exploit, "verb" media command type is used, and this triggers
@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote
property, and "3" is used for the INF. When the cmd is "-3", DoVerb will bail. But when "3"
is used (again, for the INF file), it will cause the packager to try to find appropriate
handler for it, which will end up with C:\Windows\System32\infDefaultInstall.exe, and that
will install/run the malicious file, and finally give us arbitrary code execution.
will install/run the malicious INF file, and finally give us arbitrary code execution.
},
'License' => MSF_LICENSE,
'Author' =>