Skip to content

Commit

Permalink
Update zerologon error handling to output invalid computer name details
Browse files Browse the repository at this point in the history
  • Loading branch information
adfoster-r7 committed Aug 3, 2022
1 parent 6c2cf58 commit 94f25bd
Showing 1 changed file with 12 additions and 1 deletion.
13 changes: 12 additions & 1 deletion modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb
Expand Up @@ -3,6 +3,8 @@
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'windows_error'

class MetasploitModule < Msf::Auxiliary

include Msf::Exploit::Remote::DCERPC
Expand Down Expand Up @@ -33,7 +35,10 @@ def initialize(info = {})
'Dirk-jan Mollema' # password restoration technique
],
'Notes' => {
'AKA' => [ 'Zerologon' ]
'AKA' => ['Zerologon'],
'Stability' => [CRASH_SAFE],
'Reliability' => [],
'SideEffects' => [CONFIG_CHANGES, IOC_IN_LOGS]
},
'License' => MSF_LICENSE,
'Actions' => [
Expand Down Expand Up @@ -86,6 +91,12 @@ def check
response = netr_server_authenticate3

break if (status = response.error_status) == 0

windows_error = ::WindowsError::NTStatus.find_by_retval(response.error_status.to_i).first
# Try again if the Failure should be STATUS_ACCESS_DENIED, otherwise something has gone wrong
next if windows_error == ::WindowsError::NTStatus::STATUS_ACCESS_DENIED

fail_with(Failure::UnexpectedReply, windows_error)
end

return CheckCode::Detected unless status == 0
Expand Down

0 comments on commit 94f25bd

Please sign in to comment.