-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Converts the external ms17_010_eternalblue_win8 to run only with Python3 #14411
Conversation
'\xc1\x41\x5f\x5e\x5f\x5b\x5d\xc3\x48\x92\x31\xc9\x51\x51\x49' | ||
'\x89\xc9\x4c\x8d\x05\x0d\x00\x00\x00\x89\xca\x48\x83\xec\x20' | ||
'\xff\xd0\x48\x83\xc4\x30\xc3' | ||
b'\x55\xe8\x2e\x00\x00\x00\xb9\x82\x00\x00\xc0\x0f\x32\x4c\x8d'+ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You could get rid of the +
symbols in this code and clean it up, like so:
b'\x55\xe8\x2e\x00\x00\x00\xb9\x82\x00\x00\xc0\x0f\x32\x4c\x8d'+ | |
b'\x55\xe8\x2e\x00\x00\x00\xb9\x82\x00\x00\xc0\x0f\x32\x4c\x8d' |
But it doesn't seem to work as well ¯\_(ツ)_/¯
Just to confirm, does this PR fix that issue? 👀 |
Nope. Fixed the |
This looks good to me, we'll have to confirm what the experience is for a python 2.x user, and if we want to use |
IIRC the script won't work for python2.x |
@cgranleese-r7 What's the result of running |
001a30e
to
5e4e52c
Compare
I wonder if the you're running out of file descriptors as the external modules are spun up in their own process, which in this case will include loading the python runtime and all of the associated dependencies 🤔 There's probably easier ways than this, but this might help get you started on confirming what's happening:
|
This error was found during testing, I believe this only occurred once. @agalway-r7 and I found this when when running through some testing on a call but adding it here for visibility. |
Fixed with latest commit, there was a stray |
Release NotesThis PR changes the ms17_010_eternalblue_win8.py external module to run only with python3, and makes the necessary changes to the strings in the exploit to ensure shellcode is generated successfully. One of the main differences between Python2 & Python3 is that in python2, strings are stored as bytes, where as in python3, they are stored as unicode strings. |
Closes #13478
This PR changes the
![image](https://user-images.githubusercontent.com/54621924/99803207-f3953a80-2b30-11eb-8d4c-424f708931d3.png)
ms17_010_eternalblue_win8.py
external module to run only with python3, and makes the necessary changes to the strings in the exploit to ensure shellcode is generated successfully. One of the main differences between Python2 & Python3 is that in python2, strings are stored as bytes, where as in python3, they are stored as unicode strings:This means that any shellcode that needs to be stored as bytes before being sent to the victim machine has to be explicitly set as a byte string with
b'<shellcode>'
.Verification
msfconsole
use windows/smb/ms17_010_eternalblue_win8
run
meterpreter
sessionpayload/cmd/windows/generic
)Big thanks to @kal1s for his detailed post on the issue.