@@ -9,6 +9,28 @@ class Metasploit3 < Msf::Post
99 include Msf ::Post ::Windows ::Priv
1010 include Msf ::Post ::Windows ::Services
1111
12+ START_TYPE = {
13+ "demand" => "SERVICE_DEMAND_START" ,
14+ "boot" => "SERVICE_BOOT_START" ,
15+ "auto" => "SERVICE_AUTO_START" ,
16+ "disabled" => "SERVICE_DISABLED" ,
17+ "system" => "SERVICE_SYSTEM_START"
18+ }
19+
20+ ERROR_TYPE = {
21+ "critical" => "SERVICE_ERROR_CRITICAL" ,
22+ "normal" => "SERVICE_ERROR_NORMAL" ,
23+ "severe" => "SERVICE_ERROR_SEVERE" ,
24+ "ignore" => "SERVICE_ERROR_IGNORE"
25+ }
26+
27+ SERVICE_TYPE = {
28+ "kernel" => "SERVICE_KERNEL_DRIVER" ,
29+ "file_system" => "SERVICE_FILE_SYSTEM_DRIVER" ,
30+ "adapter" => "SERVICE_ADAPTER" ,
31+ "recognizer" => "SERVICE_RECOGNIZER_DRIVER"
32+ }
33+
1234 def initialize ( info = { } )
1335 super ( update_info ( info ,
1436 'Name' => 'Windows Manage Driver Loader' ,
@@ -44,9 +66,7 @@ def run
4466 return
4567 end
4668
47- system_root = driver . split ( '\\' ) [ 0 ..1 ] . join ( '\\' ) . upcase
48-
49- unless system_root == expand_path ( "%SYSTEMROOT%" )
69+ unless driver =~ /#{ Regexp . escape ( expand_path ( "%SYSTEMROOT%" ) ) } /i
5070 print_error ( "The driver must be inside %SYSTEMROOT%." )
5171 return
5272 end
@@ -75,9 +95,9 @@ def run
7595
7696 def install_driver ( opts = { } )
7797 service_all_access = 0xF01FF
78- service_type = get_service ( opts [ :service ] )
79- service_error_type = get_error ( opts [ :error ] )
80- service_start_type = get_start ( opts [ :start ] )
98+ service_type = SERVICE_TYPE [ opts [ :service ] ]
99+ service_error_type = ERROR_TYPE [ opts [ :error ] ]
100+ service_start_type = START_TYPE [ opts [ :start ] ]
81101 advapi32 = client . railgun . advapi32
82102 name = opts [ :name ]
83103 # Default access: sc_manager_all_access (0xF003F)
@@ -100,38 +120,4 @@ def install_driver(opts={})
100120 end
101121 return false
102122 end
103-
104- def get_start ( type )
105- start_type = {
106- "demand" => "SERVICE_DEMAND_START" ,
107- "boot" => "SERVICE_BOOT_START" ,
108- "auto" => "SERVICE_AUTO_START" ,
109- "disabled" => "SERVICE_DISABLED" ,
110- "system" => "SERVICE_SYSTEM_START"
111- }
112-
113- return start_type [ type ]
114- end
115-
116- def get_error ( type )
117- error_type = {
118- "critical" => "SERVICE_ERROR_CRITICAL" ,
119- "normal" => "SERVICE_ERROR_NORMAL" ,
120- "severe" => "SERVICE_ERROR_SEVERE" ,
121- "ignore" => "SERVICE_ERROR_IGNORE"
122- }
123-
124- return error_type [ type ]
125- end
126-
127- def get_service ( type )
128- service_type = {
129- "kernel" => "SERVICE_KERNEL_DRIVER" ,
130- "file_system" => "SERVICE_FILE_SYSTEM_DRIVER" ,
131- "adapter" => "SERVICE_ADAPTER" ,
132- "recognizer" => "SERVICE_RECOGNIZER_DRIVER"
133- }
134-
135- return service_type [ type ]
136- end
137123end
0 commit comments