mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-11-05 14:57:30 +01:00
I shoulda checked before git commit
This commit is contained in:
parent
4c0048f26a
commit
a79427a659
@ -28,10 +28,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
leveraged for code execution. First of all, Packager does not load the INF file directly.
|
||||
But as an attacker, you can trick it to load your INF anyway by embedding the file path as
|
||||
a remote share in an OLE object. The packager will then treat it as a type of media file,
|
||||
and load it with the packager!CPackage::OLE2MPlayerReadFromStream, which will download it
|
||||
with a CopyFileW call, save it in a temp folder, and pass that information for later. The
|
||||
exploit will do this loading process twice: first for a fake gif file that's actually the
|
||||
payload, and the second for the INF file.
|
||||
and load it with the packager!CPackage::OLE2MPlayerReadFromStream function, which will
|
||||
download it with a CopyFileW call, save it in a temp folder, and pass that information for
|
||||
later. The exploit will do this loading process twice: first for a fake gif file that's
|
||||
actually the payload, and the second for the INF file.
|
||||
|
||||
The packager will also look at each OLE object's XML Presentation Command, specifically the
|
||||
type and cmd property. In the exploit, "verb" media command type is used, and this triggers
|
||||
@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
property, and "3" is used for the INF. When the cmd is "-3", DoVerb will bail. But when "3"
|
||||
is used (again, for the INF file), it will cause the packager to try to find appropriate
|
||||
handler for it, which will end up with C:\Windows\System32\infDefaultInstall.exe, and that
|
||||
will install/run the malicious file, and finally give us arbitrary code execution.
|
||||
will install/run the malicious INF file, and finally give us arbitrary code execution.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
|
Loading…
Reference in New Issue
Block a user