632 lines
62 KiB
HTML
632 lines
62 KiB
HTML
|
|
<!DOCTYPE html>
|
|||
|
|
<html>
|
|||
|
|
<head>
|
|||
|
|
<meta charset="utf-8">
|
|||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|||
|
|
<title>
|
|||
|
|
Module: Msf::Exploit::Remote::SMB::Client::WebExec
|
|||
|
|
|
|||
|
|
— Documentation by YARD 0.9.37
|
|||
|
|
|
|||
|
|
</title>
|
|||
|
|
|
|||
|
|
<link rel="stylesheet" href="../../../../../css/style.css" type="text/css" />
|
|||
|
|
|
|||
|
|
<link rel="stylesheet" href="../../../../../css/common.css" type="text/css" />
|
|||
|
|
|
|||
|
|
<script type="text/javascript">
|
|||
|
|
pathId = "Msf::Exploit::Remote::SMB::Client::WebExec";
|
|||
|
|
relpath = '../../../../../';
|
|||
|
|
</script>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<script type="text/javascript" charset="utf-8" src="../../../../../js/jquery.js"></script>
|
|||
|
|
|
|||
|
|
<script type="text/javascript" charset="utf-8" src="../../../../../js/app.js"></script>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</head>
|
|||
|
|
<body>
|
|||
|
|
<div class="nav_wrap">
|
|||
|
|
<iframe id="nav" src="../../../../../class_list.html?1"></iframe>
|
|||
|
|
<div id="resizer"></div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="main" tabindex="-1">
|
|||
|
|
<div id="header">
|
|||
|
|
<div id="menu">
|
|||
|
|
|
|||
|
|
<a href="../../../../../_index.html">Index (W)</a> »
|
|||
|
|
<span class='title'><span class='object_link'><a href="../../../../../Msf.html" title="Msf (module)">Msf</a></span></span> » <span class='title'><span class='object_link'><a href="../../../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span> » <span class='title'><span class='object_link'><a href="../../../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span> » <span class='title'><span class='object_link'><a href="../../SMB.html" title="Msf::Exploit::Remote::SMB (module)">SMB</a></span></span> » <span class='title'><span class='object_link'><a href="../Client.html" title="Msf::Exploit::Remote::SMB::Client (module)">Client</a></span></span>
|
|||
|
|
»
|
|||
|
|
<span class="title">WebExec</span>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="search">
|
|||
|
|
|
|||
|
|
<a class="full_list_link" id="class_list_link"
|
|||
|
|
href="../../../../../class_list.html">
|
|||
|
|
|
|||
|
|
<svg width="24" height="24">
|
|||
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|||
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|||
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|||
|
|
</svg>
|
|||
|
|
</a>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
<div class="clear"></div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="content"><h1>Module: Msf::Exploit::Remote::SMB::Client::WebExec
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h1>
|
|||
|
|
<div class="box_info">
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<dl>
|
|||
|
|
<dt>Includes:</dt>
|
|||
|
|
<dd>Failure, <span class='object_link'><a href="../../DCERPC.html" title="Msf::Exploit::Remote::DCERPC (module)">DCERPC</a></span>, <span class='object_link'><a href="Authenticated.html" title="Msf::Exploit::Remote::SMB::Client::Authenticated (module)">Authenticated</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html" title="Msf::Exploit::Windows_Constants (module)">Windows_Constants</a></span></dd>
|
|||
|
|
</dl>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<dl>
|
|||
|
|
<dt>Defined in:</dt>
|
|||
|
|
<dd>lib/msf/core/exploit/remote/smb/client/web_exec.rb</dd>
|
|||
|
|
</dl>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<h2>Overview</h2><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Makes use of a WebEx service vulnerability that works similarly to psexec.</p>
|
|||
|
|
|
|||
|
|
<p>This code was stolen straight out of the psexec module which was stolen from the standalone Psexec tool. Thanks very much for all who contributed to that module!! Instead of uploading and running a binary.</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h2>Constant Summary</h2>
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Constants included
|
|||
|
|
from <span class='object_link'><a href="../Client.html" title="Msf::Exploit::Remote::SMB::Client (module)">Msf::Exploit::Remote::SMB::Client</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../Client.html#CONST-constant" title="Msf::Exploit::Remote::SMB::Client::CONST (constant)">CONST</a></span>, <span class='object_link'><a href="../Client.html#DCERPCClient-constant" title="Msf::Exploit::Remote::SMB::Client::DCERPCClient (constant)">DCERPCClient</a></span>, <span class='object_link'><a href="../Client.html#DCERPCPacket-constant" title="Msf::Exploit::Remote::SMB::Client::DCERPCPacket (constant)">DCERPCPacket</a></span>, <span class='object_link'><a href="../Client.html#DCERPCResponse-constant" title="Msf::Exploit::Remote::SMB::Client::DCERPCResponse (constant)">DCERPCResponse</a></span>, <span class='object_link'><a href="../Client.html#DCERPCUUID-constant" title="Msf::Exploit::Remote::SMB::Client::DCERPCUUID (constant)">DCERPCUUID</a></span>, <span class='object_link'><a href="../Client.html#NDR-constant" title="Msf::Exploit::Remote::SMB::Client::NDR (constant)">NDR</a></span>, <span class='object_link'><a href="../Client.html#SIMPLE-constant" title="Msf::Exploit::Remote::SMB::Client::SIMPLE (constant)">SIMPLE</a></span>, <span class='object_link'><a href="../Client.html#XCEPT-constant" title="Msf::Exploit::Remote::SMB::Client::XCEPT (constant)">XCEPT</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Constants included
|
|||
|
|
from <span class='object_link'><a href="../../DCERPC.html" title="Msf::Exploit::Remote::DCERPC (module)">DCERPC</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC.html#DCERPCClient-constant" title="Msf::Exploit::Remote::DCERPC::DCERPCClient (constant)">DCERPC::DCERPCClient</a></span>, <span class='object_link'><a href="../../DCERPC.html#DCERPCPacket-constant" title="Msf::Exploit::Remote::DCERPC::DCERPCPacket (constant)">DCERPC::DCERPCPacket</a></span>, <span class='object_link'><a href="../../DCERPC.html#DCERPCResponse-constant" title="Msf::Exploit::Remote::DCERPC::DCERPCResponse (constant)">DCERPC::DCERPCResponse</a></span>, <span class='object_link'><a href="../../DCERPC.html#DCERPCUUID-constant" title="Msf::Exploit::Remote::DCERPC::DCERPCUUID (constant)">DCERPC::DCERPCUUID</a></span>, <span class='object_link'><a href="../../DCERPC.html#NDR-constant" title="Msf::Exploit::Remote::DCERPC::NDR (constant)">DCERPC::NDR</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Constants included
|
|||
|
|
from <span class='object_link'><a href="../../DCERPC_LSA.html" title="Msf::Exploit::Remote::DCERPC_LSA (module)">DCERPC_LSA</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC_LSA.html#NDR-constant" title="Msf::Exploit::Remote::DCERPC_LSA::NDR (constant)">DCERPC_LSA::NDR</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Constants included
|
|||
|
|
from <span class='object_link'><a href="../../DCERPC_MGMT.html" title="Msf::Exploit::Remote::DCERPC_MGMT (module)">DCERPC_MGMT</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC_MGMT.html#NDR-constant" title="Msf::Exploit::Remote::DCERPC_MGMT::NDR (constant)">DCERPC_MGMT::NDR</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Constants included
|
|||
|
|
from <span class='object_link'><a href="../../../Windows_Constants.html" title="Msf::Exploit::Windows_Constants (module)">Windows_Constants</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../../Windows_Constants.html#CHANGE_SERVICE_CONFIG2_W-constant" title="Msf::Exploit::Windows_Constants::CHANGE_SERVICE_CONFIG2_W (constant)">Windows_Constants::CHANGE_SERVICE_CONFIG2_W</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#CHANGE_SERVICE_CONFIG_W-constant" title="Msf::Exploit::Windows_Constants::CHANGE_SERVICE_CONFIG_W (constant)">Windows_Constants::CHANGE_SERVICE_CONFIG_W</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#CLOSE_SERVICE_HANDLE-constant" title="Msf::Exploit::Windows_Constants::CLOSE_SERVICE_HANDLE (constant)">Windows_Constants::CLOSE_SERVICE_HANDLE</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#CONTROL_SERVICE-constant" title="Msf::Exploit::Windows_Constants::CONTROL_SERVICE (constant)">Windows_Constants::CONTROL_SERVICE</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#CREATE_SERVICE_W-constant" title="Msf::Exploit::Windows_Constants::CREATE_SERVICE_W (constant)">Windows_Constants::CREATE_SERVICE_W</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#DELETE_SERVICE-constant" title="Msf::Exploit::Windows_Constants::DELETE_SERVICE (constant)">Windows_Constants::DELETE_SERVICE</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#OPEN_SC_MANAGER_W-constant" title="Msf::Exploit::Windows_Constants::OPEN_SC_MANAGER_W (constant)">Windows_Constants::OPEN_SC_MANAGER_W</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#OPEN_SERVICE_W-constant" title="Msf::Exploit::Windows_Constants::OPEN_SERVICE_W (constant)">Windows_Constants::OPEN_SERVICE_W</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#QUERY_SERVICE_STATUS-constant" title="Msf::Exploit::Windows_Constants::QUERY_SERVICE_STATUS (constant)">Windows_Constants::QUERY_SERVICE_STATUS</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SC_MANAGER_ALL_ACCESS-constant" title="Msf::Exploit::Windows_Constants::SC_MANAGER_ALL_ACCESS (constant)">Windows_Constants::SC_MANAGER_ALL_ACCESS</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SC_MANAGER_CONNECT-constant" title="Msf::Exploit::Windows_Constants::SC_MANAGER_CONNECT (constant)">Windows_Constants::SC_MANAGER_CONNECT</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SC_MANAGER_CREATE_SERVICE-constant" title="Msf::Exploit::Windows_Constants::SC_MANAGER_CREATE_SERVICE (constant)">Windows_Constants::SC_MANAGER_CREATE_SERVICE</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SC_MANAGER_ENUMERATE_SERVICE-constant" title="Msf::Exploit::Windows_Constants::SC_MANAGER_ENUMERATE_SERVICE (constant)">Windows_Constants::SC_MANAGER_ENUMERATE_SERVICE</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SC_MANAGER_LOCK-constant" title="Msf::Exploit::Windows_Constants::SC_MANAGER_LOCK (constant)">Windows_Constants::SC_MANAGER_LOCK</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SC_MANAGER_MODIFY_BOOT_CONFIG-constant" title="Msf::Exploit::Windows_Constants::SC_MANAGER_MODIFY_BOOT_CONFIG (constant)">Windows_Constants::SC_MANAGER_MODIFY_BOOT_CONFIG</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SC_MANAGER_QUERY_LOCK_STATUS-constant" title="Msf::Exploit::Windows_Constants::SC_MANAGER_QUERY_LOCK_STATUS (constant)">Windows_Constants::SC_MANAGER_QUERY_LOCK_STATUS</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SERVICE_ACCEPT_HARDWAREPROFILECHANGE-constant" title="Msf::Exploit::Windows_Constants::SERVICE_ACCEPT_HARDWAREPROFILECHANGE (constant)">Windows_Constants::SERVICE_ACCEPT_HARDWAREPROFILECHANGE</a></span>, <span class='object_link'><a href="../../../Windows_Constants.html#SERVICE_ACCEPT_NETBINDCHANGE-constant" title="Msf::Exploit::Windows_Constants::SERVICE_ACCEPT_NETBINDCHANGE (constant)">Windows_Constants::SERVIC
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h2>Instance Attribute Summary</h2>
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Attributes included from <span class='object_link'><a href="../Client.html" title="Msf::Exploit::Remote::SMB::Client (module)">Msf::Exploit::Remote::SMB::Client</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../Client.html#simple-instance_method" title="Msf::Exploit::Remote::SMB::Client#simple (method)">#simple</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Attributes included from <span class='object_link'><a href="../../Tcp.html" title="Msf::Exploit::Remote::Tcp (module)">Tcp</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../Tcp.html#sock-instance_method" title="Msf::Exploit::Remote::Tcp#sock (method)">#sock</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Attributes included from <span class='object_link'><a href="../../DCERPC.html" title="Msf::Exploit::Remote::DCERPC (module)">DCERPC</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC.html#dcerpc-instance_method" title="Msf::Exploit::Remote::DCERPC#dcerpc (method)">#dcerpc</a></span>, <span class='object_link'><a href="../../DCERPC.html#handle-instance_method" title="Msf::Exploit::Remote::DCERPC#handle (method)">#handle</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h2>
|
|||
|
|
Instance Method Summary
|
|||
|
|
<small><a href="#" class="summary_toggle">collapse</a></small>
|
|||
|
|
</h2>
|
|||
|
|
|
|||
|
|
<ul class="summary">
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#execute_single_command-instance_method" title="#execute_single_command (instance method)">#<strong>execute_single_command</strong>(command, opts) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#initialize-instance_method" title="#initialize (instance method)">#<strong>initialize</strong>(info = {}) ⇒ Object </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<li class="public ">
|
|||
|
|
<span class="summary_signature">
|
|||
|
|
|
|||
|
|
<a href="#wexec-instance_method" title="#wexec (instance method)">#<strong>wexec</strong>(disconnect = true) ⇒ Boolean </a>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class="summary_desc"><div class='inline'>
|
|||
|
|
<p>Executes a single windows command.</p>
|
|||
|
|
</div></span>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</ul>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../Kerberos/ServiceAuthenticator/Options.html" title="Msf::Exploit::Remote::Kerberos::ServiceAuthenticator::Options (module)">Kerberos::ServiceAuthenticator::Options</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../Kerberos/ServiceAuthenticator/Options.html#kerberos_auth_options-instance_method" title="Msf::Exploit::Remote::Kerberos::ServiceAuthenticator::Options#kerberos_auth_options (method)">#kerberos_auth_options</a></span>, <span class='object_link'><a href="../../Kerberos/ServiceAuthenticator/Options.html#kerberos_clock_skew_seconds-instance_method" title="Msf::Exploit::Remote::Kerberos::ServiceAuthenticator::Options#kerberos_clock_skew_seconds (method)">#kerberos_clock_skew_seconds</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../Kerberos/Ticket/Storage.html" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage (module)">Kerberos::Ticket::Storage</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../Kerberos/Ticket/Storage.html#kerberos_storage_options-instance_method" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage#kerberos_storage_options (method)">#kerberos_storage_options</a></span>, <span class='object_link'><a href="../../Kerberos/Ticket/Storage.html#kerberos_ticket_storage-instance_method" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage#kerberos_ticket_storage (method)">#kerberos_ticket_storage</a></span>, <span class='object_link'><a href="../../Kerberos/Ticket/Storage.html#store_ccache-class_method" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage.store_ccache (method)">store_ccache</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../Client.html" title="Msf::Exploit::Remote::SMB::Client (module)">Msf::Exploit::Remote::SMB::Client</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../Client.html#connect-instance_method" title="Msf::Exploit::Remote::SMB::Client#connect (method)">#connect</a></span>, <span class='object_link'><a href="../Client.html#domain-instance_method" title="Msf::Exploit::Remote::SMB::Client#domain (method)">#domain</a></span>, <span class='object_link'><a href="../Client.html#domain_username_split-instance_method" title="Msf::Exploit::Remote::SMB::Client#domain_username_split (method)">#domain_username_split</a></span>, <span class='object_link'><a href="../Client.html#smb_create-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_create (method)">#smb_create</a></span>, <span class='object_link'><a href="../Client.html#smb_direct-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_direct (method)">#smb_direct</a></span>, <span class='object_link'><a href="../Client.html#smb_enumprinters-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_enumprinters (method)">#smb_enumprinters</a></span>, <span class='object_link'><a href="../Client.html#smb_enumprintproviders-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_enumprintproviders (method)">#smb_enumprintproviders</a></span>, <span class='object_link'><a href="../Client.html#smb_file_exist%3F-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_file_exist? (method)">#smb_file_exist?</a></span>, <span class='object_link'><a href="../Client.html#smb_file_rm-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_file_rm (method)">#smb_file_rm</a></span>, <span class='object_link'><a href="../Client.html#smb_fingerprint-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_fingerprint (method)">#smb_fingerprint</a></span>, <span class='object_link'><a href="../Client.html#smb_fingerprint_windows_lang-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_fingerprint_windows_lang (method)">#smb_fingerprint_windows_lang</a></span>, <span class='object_link'><a href="../Client.html#smb_fingerprint_windows_sp-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_fingerprint_windows_sp (method)">#smb_fingerprint_windows_sp</a></span>, <span class='object_link'><a href="../Client.html#smb_hostname-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_hostname (method)">#smb_hostname</a></span>, <span class='object_link'><a href="../Client.html#smb_lanman_netshareenumall-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_lanman_netshareenumall (method)">#smb_lanman_netshareenumall</a></span>, <span class='object_link'><a href="../Client.html#smb_login-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_login (method)">#smb_login</a></span>, <span class='object_link'><a href="../Client.html#smb_lookup_share_type-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_lookup_share_type (method)">#smb_lookup_share_type</a></span>, <span class='object_link'><a href="../Client.html#smb_netshareenumall-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_netshareenumall (method)">#smb_netshareenumall</a></span>, <span class='object_link'><a href="../Client.html#smb_netsharegetinfo-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_netsharegetinfo (method)">#smb_netsharegetinfo</a></span>, <span class='object_link'><a href="../Client.html#smb_open-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_open (method)">#smb_open</a></span>, <span class='object_link'><a href="../Client.html#smb_peer_lm-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_peer_lm (method)">#smb_peer_lm</a></span>, <span class='object_link'><a href="../Client.html#smb_peer_os-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_peer_os (method)">#smb_peer_os</a></span>, <span class='object_link'><a href="../Client.html#smb_srvsvc_netshareenumall-instance_method" title="Msf::Exploit::Remote::SMB::Client#smb_srvsvc_netshareenumall (method)">#smb_srvsvc_netshareenumall</a></span>, <span class='object_link'><a href="../Client.html#smb_srvsvc_netsharegetinf
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../Tcp.html" title="Msf::Exploit::Remote::Tcp (module)">Tcp</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../Tcp.html#chost-instance_method" title="Msf::Exploit::Remote::Tcp#chost (method)">#chost</a></span>, <span class='object_link'><a href="../../Tcp.html#cleanup-instance_method" title="Msf::Exploit::Remote::Tcp#cleanup (method)">#cleanup</a></span>, <span class='object_link'><a href="../../Tcp.html#connect-instance_method" title="Msf::Exploit::Remote::Tcp#connect (method)">#connect</a></span>, <span class='object_link'><a href="../../Tcp.html#connect_timeout-instance_method" title="Msf::Exploit::Remote::Tcp#connect_timeout (method)">#connect_timeout</a></span>, <span class='object_link'><a href="../../Tcp.html#cport-instance_method" title="Msf::Exploit::Remote::Tcp#cport (method)">#cport</a></span>, <span class='object_link'><a href="../../Tcp.html#disconnect-instance_method" title="Msf::Exploit::Remote::Tcp#disconnect (method)">#disconnect</a></span>, <span class='object_link'><a href="../../Tcp.html#handler-instance_method" title="Msf::Exploit::Remote::Tcp#handler (method)">#handler</a></span>, <span class='object_link'><a href="../../Tcp.html#lhost-instance_method" title="Msf::Exploit::Remote::Tcp#lhost (method)">#lhost</a></span>, <span class='object_link'><a href="../../Tcp.html#lport-instance_method" title="Msf::Exploit::Remote::Tcp#lport (method)">#lport</a></span>, <span class='object_link'><a href="../../Tcp.html#peer-instance_method" title="Msf::Exploit::Remote::Tcp#peer (method)">#peer</a></span>, <span class='object_link'><a href="../../Tcp.html#print_prefix-instance_method" title="Msf::Exploit::Remote::Tcp#print_prefix (method)">#print_prefix</a></span>, <span class='object_link'><a href="../../Tcp.html#proxies-instance_method" title="Msf::Exploit::Remote::Tcp#proxies (method)">#proxies</a></span>, <span class='object_link'><a href="../../Tcp.html#replicant-instance_method" title="Msf::Exploit::Remote::Tcp#replicant (method)">#replicant</a></span>, <span class='object_link'><a href="../../Tcp.html#rhost-instance_method" title="Msf::Exploit::Remote::Tcp#rhost (method)">#rhost</a></span>, <span class='object_link'><a href="../../Tcp.html#rport-instance_method" title="Msf::Exploit::Remote::Tcp#rport (method)">#rport</a></span>, <span class='object_link'><a href="../../Tcp.html#set_tcp_evasions-instance_method" title="Msf::Exploit::Remote::Tcp#set_tcp_evasions (method)">#set_tcp_evasions</a></span>, <span class='object_link'><a href="../../Tcp.html#shutdown-instance_method" title="Msf::Exploit::Remote::Tcp#shutdown (method)">#shutdown</a></span>, <span class='object_link'><a href="../../Tcp.html#ssl-instance_method" title="Msf::Exploit::Remote::Tcp#ssl (method)">#ssl</a></span>, <span class='object_link'><a href="../../Tcp.html#ssl_cipher-instance_method" title="Msf::Exploit::Remote::Tcp#ssl_cipher (method)">#ssl_cipher</a></span>, <span class='object_link'><a href="../../Tcp.html#ssl_verify_mode-instance_method" title="Msf::Exploit::Remote::Tcp#ssl_verify_mode (method)">#ssl_verify_mode</a></span>, <span class='object_link'><a href="../../Tcp.html#ssl_version-instance_method" title="Msf::Exploit::Remote::Tcp#ssl_version (method)">#ssl_version</a></span>, <span class='object_link'><a href="../../Tcp.html#sslkeylogfile-instance_method" title="Msf::Exploit::Remote::Tcp#sslkeylogfile (method)">#sslkeylogfile</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../DCERPC.html" title="Msf::Exploit::Remote::DCERPC (module)">DCERPC</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC.html#dcerpc_bind-instance_method" title="Msf::Exploit::Remote::DCERPC#dcerpc_bind (method)">#dcerpc_bind</a></span>, <span class='object_link'><a href="../../DCERPC.html#dcerpc_call-instance_method" title="Msf::Exploit::Remote::DCERPC#dcerpc_call (method)">#dcerpc_call</a></span>, <span class='object_link'><a href="../../DCERPC.html#dcerpc_getarch-instance_method" title="Msf::Exploit::Remote::DCERPC#dcerpc_getarch (method)">#dcerpc_getarch</a></span>, <span class='object_link'><a href="../../DCERPC.html#dcerpc_handle-instance_method" title="Msf::Exploit::Remote::DCERPC#dcerpc_handle (method)">#dcerpc_handle</a></span>, <span class='object_link'><a href="../../DCERPC.html#dcerpc_handle_target-instance_method" title="Msf::Exploit::Remote::DCERPC#dcerpc_handle_target (method)">#dcerpc_handle_target</a></span>, <span class='object_link'><a href="../../DCERPC.html#unicode-instance_method" title="Msf::Exploit::Remote::DCERPC#unicode (method)">#unicode</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../DCERPC_LSA.html" title="Msf::Exploit::Remote::DCERPC_LSA (module)">DCERPC_LSA</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC_LSA.html#lsa_open_policy-instance_method" title="Msf::Exploit::Remote::DCERPC_LSA#lsa_open_policy (method)">#lsa_open_policy</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../DCERPC_MGMT.html" title="Msf::Exploit::Remote::DCERPC_MGMT (module)">DCERPC_MGMT</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC_MGMT.html#dcerpc_mgmt_connect-instance_method" title="Msf::Exploit::Remote::DCERPC_MGMT#dcerpc_mgmt_connect (method)">#dcerpc_mgmt_connect</a></span>, <span class='object_link'><a href="../../DCERPC_MGMT.html#dcerpc_mgmt_inq_if_ids-instance_method" title="Msf::Exploit::Remote::DCERPC_MGMT#dcerpc_mgmt_inq_if_ids (method)">#dcerpc_mgmt_inq_if_ids</a></span>, <span class='object_link'><a href="../../DCERPC_MGMT.html#dcerpc_mgmt_inq_if_stats-instance_method" title="Msf::Exploit::Remote::DCERPC_MGMT#dcerpc_mgmt_inq_if_stats (method)">#dcerpc_mgmt_inq_if_stats</a></span>, <span class='object_link'><a href="../../DCERPC_MGMT.html#dcerpc_mgmt_inq_princ_name-instance_method" title="Msf::Exploit::Remote::DCERPC_MGMT#dcerpc_mgmt_inq_princ_name (method)">#dcerpc_mgmt_inq_princ_name</a></span>, <span class='object_link'><a href="../../DCERPC_MGMT.html#dcerpc_mgmt_is_server_listening-instance_method" title="Msf::Exploit::Remote::DCERPC_MGMT#dcerpc_mgmt_is_server_listening (method)">#dcerpc_mgmt_is_server_listening</a></span>, <span class='object_link'><a href="../../DCERPC_MGMT.html#dcerpc_mgmt_stop_server_listening-instance_method" title="Msf::Exploit::Remote::DCERPC_MGMT#dcerpc_mgmt_stop_server_listening (method)">#dcerpc_mgmt_stop_server_listening</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../DCERPC_EPM.html" title="Msf::Exploit::Remote::DCERPC_EPM (module)">DCERPC_EPM</a></span></h3>
|
|||
|
|
<p class="inherited"><span class='object_link'><a href="../../DCERPC_EPM.html#dcerpc_endpoint_find_tcp-instance_method" title="Msf::Exploit::Remote::DCERPC_EPM#dcerpc_endpoint_find_tcp (method)">#dcerpc_endpoint_find_tcp</a></span>, <span class='object_link'><a href="../../DCERPC_EPM.html#dcerpc_endpoint_find_udp-instance_method" title="Msf::Exploit::Remote::DCERPC_EPM#dcerpc_endpoint_find_udp (method)">#dcerpc_endpoint_find_udp</a></span>, <span class='object_link'><a href="../../DCERPC_EPM.html#dcerpc_endpoint_list-instance_method" title="Msf::Exploit::Remote::DCERPC_EPM#dcerpc_endpoint_list (method)">#dcerpc_endpoint_list</a></span></p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
<div id="instance_method_details" class="method_details_list">
|
|||
|
|
<h2>Instance Method Details</h2>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<div class="method_details first">
|
|||
|
|
<h3 class="signature first" id="execute_single_command-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>execute_single_command</strong>(command, opts) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
35
|
|||
|
|
36
|
|||
|
|
37
|
|||
|
|
38
|
|||
|
|
39
|
|||
|
|
40
|
|||
|
|
41
|
|||
|
|
42
|
|||
|
|
43
|
|||
|
|
44
|
|||
|
|
45
|
|||
|
|
46
|
|||
|
|
47
|
|||
|
|
48
|
|||
|
|
49
|
|||
|
|
50
|
|||
|
|
51</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/smb/client/web_exec.rb', line 35</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_execute_single_command'>execute_single_command</span><span class='lparen'>(</span><span class='id identifier rubyid_command'>command</span><span class='comma'>,</span> <span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_command'>command</span> <span class='op'>=</span> <span class='id identifier rubyid_command'>command</span><span class='period'>.</span><span class='id identifier rubyid_split'>split</span><span class='lparen'>(</span><span class='tstring'><span class='regexp_beg'>/</span><span class='tstring_content'> </span><span class='regexp_end'>/</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_svc_status'>svc_status</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:svc_client</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_startservice'>startservice</span><span class='lparen'>(</span><span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:svc_handle</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>install</span><span class='tstring_end'>"</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>software-update</span><span class='tstring_end'>"</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>1</span><span class='tstring_end'>"</span></span><span class='comma'>,</span> <span class='op'>*</span><span class='id identifier rubyid_command'>command</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>case</span> <span class='id identifier rubyid_svc_status'>svc_status</span>
|
|||
|
|
<span class='kw'>when</span> <span class='const'>ERROR_SUCCESS</span>
|
|||
|
|
<span class='comment'># This happens a lot, so don't print it
|
|||
|
|
</span> <span class='comment'># print_good("Service started successfully...")
|
|||
|
|
</span> <span class='kw'>when</span> <span class='const'>ERROR_FILE_NOT_FOUND</span>
|
|||
|
|
<span class='id identifier rubyid_print_error'>print_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Service failed to start - FILE_NOT_FOUND</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>when</span> <span class='const'>ERROR_ACCESS_DENIED</span>
|
|||
|
|
<span class='id identifier rubyid_print_error'>print_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Service failed to start - ACCESS_DENIED</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>when</span> <span class='const'>ERROR_SERVICE_REQUEST_TIMEOUT</span>
|
|||
|
|
<span class='id identifier rubyid_print_good'>print_good</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Service start timed out</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>else</span>
|
|||
|
|
<span class='id identifier rubyid_print_error'>print_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Service failed to start, ERROR_CODE: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_svc_status'>svc_status</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="initialize-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>initialize</strong>(info = {}) ⇒ <tt>Object</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
23
|
|||
|
|
24
|
|||
|
|
25
|
|||
|
|
26
|
|||
|
|
27
|
|||
|
|
28
|
|||
|
|
29
|
|||
|
|
30
|
|||
|
|
31
|
|||
|
|
32
|
|||
|
|
33</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/smb/client/web_exec.rb', line 23</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_initialize'>initialize</span><span class='lparen'>(</span><span class='id identifier rubyid_info'>info</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>super</span>
|
|||
|
|
<span class='id identifier rubyid_register_options'>register_options</span><span class='lparen'>(</span>
|
|||
|
|
<span class='lbracket'>[</span>
|
|||
|
|
<span class='const'><span class='object_link'><a href="../../../../OptString.html" title="Msf::OptString (class)">OptString</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../OptString.html#initialize-instance_method" title="Msf::OptString#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>SERVICE_NAME</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span> <span class='kw'>false</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>The service name</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>WebExService</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|||
|
|
<span class='rbracket'>]</span><span class='comma'>,</span> <span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_class'>class</span><span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_register_advanced_options'>register_advanced_options</span><span class='lparen'>(</span>
|
|||
|
|
<span class='lbracket'>[</span>
|
|||
|
|
<span class='rbracket'>]</span><span class='comma'>,</span> <span class='kw'>self</span><span class='period'>.</span><span class='id identifier rubyid_class'>class</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="method_details ">
|
|||
|
|
<h3 class="signature " id="wexec-instance_method">
|
|||
|
|
|
|||
|
|
#<strong>wexec</strong>(disconnect = true) ⇒ <tt>Boolean</tt>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</h3><div class="docstring">
|
|||
|
|
<div class="discussion">
|
|||
|
|
|
|||
|
|
<p>Executes a single windows command.</p>
|
|||
|
|
|
|||
|
|
<p>If you want to retrieve the output of your command you’ll have to echo it to a .txt file and then use the #smb_read_file method to retrieve it. Make sure to remove the files manually or use <span class='object_link'><a href="../../../FileDropper.html#register_files_for_cleanup-instance_method" title="Msf::Exploit::FileDropper#register_files_for_cleanup (method)">FileDropper#register_files_for_cleanup</a></span> to have the <span class='object_link'><a href="../../../FileDropper.html#cleanup-instance_method" title="Msf::Exploit::FileDropper#cleanup (method)">FileDropper#cleanup</a></span> and <span class='object_link'><a href="../../../FileDropper.html#on_new_session-instance_method" title="Msf::Exploit::FileDropper#on_new_session (method)">FileDropper#on_new_session</a></span> handlers do it for you.</p>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="tags">
|
|||
|
|
<p class="tag_title">Parameters:</p>
|
|||
|
|
<ul class="param">
|
|||
|
|
|
|||
|
|
<li>
|
|||
|
|
|
|||
|
|
<span class='name'>command</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class='type'>(<tt>String</tt>)</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
—
|
|||
|
|
<div class='inline'>
|
|||
|
|
<p>Should be a valid windows command</p>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
<li>
|
|||
|
|
|
|||
|
|
<span class='name'>disconnect</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class='type'>(<tt>Boolean</tt>)</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<em class="default">(defaults to: <tt>true</tt>)</em>
|
|||
|
|
|
|||
|
|
|
|||
|
|
—
|
|||
|
|
<div class='inline'>
|
|||
|
|
<p>Disconnect afterwards</p>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
</ul>
|
|||
|
|
|
|||
|
|
<p class="tag_title">Returns:</p>
|
|||
|
|
<ul class="return">
|
|||
|
|
|
|||
|
|
<li>
|
|||
|
|
|
|||
|
|
|
|||
|
|
<span class='type'>(<tt>Boolean</tt>)</span>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
—
|
|||
|
|
<div class='inline'>
|
|||
|
|
<p>Whether everything went well</p>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</li>
|
|||
|
|
|
|||
|
|
</ul>
|
|||
|
|
|
|||
|
|
</div><table class="source_code">
|
|||
|
|
<tr>
|
|||
|
|
<td>
|
|||
|
|
<pre class="lines">
|
|||
|
|
|
|||
|
|
|
|||
|
|
65
|
|||
|
|
66
|
|||
|
|
67
|
|||
|
|
68
|
|||
|
|
69
|
|||
|
|
70
|
|||
|
|
71
|
|||
|
|
72
|
|||
|
|
73
|
|||
|
|
74
|
|||
|
|
75
|
|||
|
|
76
|
|||
|
|
77
|
|||
|
|
78
|
|||
|
|
79
|
|||
|
|
80
|
|||
|
|
81
|
|||
|
|
82
|
|||
|
|
83
|
|||
|
|
84
|
|||
|
|
85
|
|||
|
|
86
|
|||
|
|
87
|
|||
|
|
88
|
|||
|
|
89
|
|||
|
|
90
|
|||
|
|
91
|
|||
|
|
92
|
|||
|
|
93
|
|||
|
|
94
|
|||
|
|
95
|
|||
|
|
96
|
|||
|
|
97
|
|||
|
|
98
|
|||
|
|
99
|
|||
|
|
100
|
|||
|
|
101
|
|||
|
|
102
|
|||
|
|
103
|
|||
|
|
104</pre>
|
|||
|
|
</td>
|
|||
|
|
<td>
|
|||
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/smb/client/web_exec.rb', line 65</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_wexec'>wexec</span><span class='lparen'>(</span><span class='id identifier rubyid_disconnect'>disconnect</span><span class='op'>=</span><span class='kw'>true</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_simple'>simple</span><span class='period'>.</span><span class='id identifier rubyid_connect'>connect</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\\\\</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>RHOST</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='embexpr_end'>}</span><span class='tstring_content'>\\IPC$</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_handle'>handle</span> <span class='op'>=</span> <span class='id identifier rubyid_dcerpc_handle'>dcerpc_handle</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>367abb81-9844-35f1-ad32-98f038001003</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>2.0</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>ncacn_np</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\\svcctl</span><span class='tstring_end'>"</span></span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Binding to </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_handle'>handle</span><span class='embexpr_end'>}</span><span class='tstring_content'> ...</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_dcerpc_bind'>dcerpc_bind</span><span class='lparen'>(</span><span class='id identifier rubyid_handle'>handle</span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Bound to </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_handle'>handle</span><span class='embexpr_end'>}</span><span class='tstring_content'> ...</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Obtaining a service manager handle...</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_svc_client'>svc_client</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../../Rex/Proto/DCERPC.html" title="Rex::Proto::DCERPC (module)">DCERPC</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../../Rex/Proto/DCERPC/SVCCTL.html" title="Rex::Proto::DCERPC::SVCCTL (module)">SVCCTL</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../../Rex/Proto/DCERPC/SVCCTL/Client.html" title="Rex::Proto::DCERPC::SVCCTL::Client (class)">Client</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../../Rex/Proto/DCERPC/SVCCTL/Client.html#initialize-instance_method" title="Rex::Proto::DCERPC::SVCCTL::Client#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_dcerpc'>dcerpc</span><span class='rparen'>)</span>
|
|||
|
|
<span class='comment'># This is the only permission non-admin gets on Windows 7 (and likely others)
|
|||
|
|
</span> <span class='id identifier rubyid_scm_handle'>scm_handle</span><span class='comma'>,</span> <span class='id identifier rubyid_scm_status'>scm_status</span> <span class='op'>=</span> <span class='id identifier rubyid_svc_client'>svc_client</span><span class='period'>.</span><span class='id identifier rubyid_openscmanagerw'>openscmanagerw</span><span class='lparen'>(</span><span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>RHOST</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='int'>0x00001</span><span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_scm_status'>scm_status</span> <span class='op'>==</span> <span class='const'>ERROR_ACCESS_DENIED</span>
|
|||
|
|
<span class='id identifier rubyid_print_error'>print_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>ERROR_ACCESS_DENIED opening the Service Manager</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>return</span> <span class='kw'>false</span> <span class='kw'>unless</span> <span class='id identifier rubyid_scm_handle'>scm_handle</span>
|
|||
|
|
|
|||
|
|
<span class='comment'># These are the best permissions I could use for a non-admin account on Windows 7
|
|||
|
|
</span> <span class='id identifier rubyid_svc_handle'>svc_handle</span> <span class='op'>=</span> <span class='id identifier rubyid_svc_client'>svc_client</span><span class='period'>.</span><span class='id identifier rubyid_openservicew'>openservicew</span><span class='lparen'>(</span><span class='id identifier rubyid_scm_handle'>scm_handle</span><span class='comma'>,</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>SERVICE_NAME</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='int'>0x00010</span><span class='rparen'>)</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_svc_handle'>svc_handle</span><span class='period'>.</span><span class='id identifier rubyid_nil?'>nil?</span>
|
|||
|
|
<span class='id identifier rubyid_print_error'>print_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>No service handle retrieved</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>return</span> <span class='kw'>false</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Starting the service...</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>begin</span>
|
|||
|
|
<span class='kw'>yield</span><span class='lparen'>(</span><span class='lbrace'>{</span> <span class='symbol'>:svc_client</span> <span class='op'>=></span> <span class='id identifier rubyid_svc_client'>svc_client</span><span class='comma'>,</span> <span class='symbol'>:svc_handle</span> <span class='op'>=></span> <span class='id identifier rubyid_svc_handle'>svc_handle</span> <span class='rbrace'>}</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>ensure</span>
|
|||
|
|
<span class='id identifier rubyid_vprint_status'>vprint_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Closing service handle...</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='id identifier rubyid_svc_client'>svc_client</span><span class='period'>.</span><span class='id identifier rubyid_closehandle'>closehandle</span><span class='lparen'>(</span><span class='id identifier rubyid_svc_handle'>svc_handle</span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_disconnect'>disconnect</span>
|
|||
|
|
<span class='id identifier rubyid_simple'>simple</span><span class='period'>.</span><span class='id identifier rubyid_disconnect'>disconnect</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\\\\</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>RHOST</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='embexpr_end'>}</span><span class='tstring_content'>\\IPC$</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|||
|
|
<span class='kw'>end</span>
|
|||
|
|
|
|||
|
|
<span class='kw'>true</span>
|
|||
|
|
<span class='kw'>end</span></pre>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div id="footer">
|
|||
|
|
Generated on Fri May 8 17:02:30 2026 by
|
|||
|
|
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
|||
|
|
0.9.37 (ruby-3.1.5).
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
</div>
|
|||
|
|
</body>
|
|||
|
|
</html>
|