diff --git a/documentation/modules/exploit/multi/misc/erlang_cookie_rce.md b/documentation/modules/exploit/multi/misc/erlang_cookie_rce.md index 2743af852906..7c842a2c5a6c 100644 --- a/documentation/modules/exploit/multi/misc/erlang_cookie_rce.md +++ b/documentation/modules/exploit/multi/misc/erlang_cookie_rce.md @@ -1,11 +1,11 @@ ## Vulnerable Application The [Erlang Port Mapper Daemon](https://www.erlang.org/) is used to coordinate distributed erlang - instances. Should an attacker gain access to this cookie code execution is trivial. Normally this + instances. Should an attacker get the authentication cookie code execution is trivial. Normally this cookie can be found in the home directory as ".erlang.cookie", however it varies system to system - as well as it's configuration. As an example on a Windows 10 instance it can be found under the - users home directory: e.g "C:\Users\\.erlang.cookie". Code execution is achieved via the - "os:cmd('cmd')." command + as well as its configuration. As an example on a Windows 10 instance it can be found under the + users home directory: e.g `C:\Users\\.erlang.cookie`. Code execution is achieved via the + `os:cmd('cmd').` command ## Verification Steps @@ -116,6 +116,7 @@ msf exploit(multi/misc/erlang_cookie_rce) > exploit Once exploitation is complete the tester can authenticate. Another method that can be used is SMB as shown below. exploit.rc -> + ``` use exploit/windows/smb/smb_delivery set SHARE MSF