2011-01-12 18:29:56 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2011-01-12 18:29:56 +00:00
|
|
|
##
|
2011-01-11 22:31:37 +00:00
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Post
|
2013-08-30 21:28:54 +00:00
|
|
|
include Msf::Post::Windows::Registry
|
|
|
|
include Msf::Post::Windows::Priv
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super( update_info( info,
|
|
|
|
'Name' => 'Windows Gather SMB Share Enumeration via Registry',
|
|
|
|
'Description' => %q{ This module will enumerate configured and recently used file shares},
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
|
|
|
|
'Platform' => [ 'win' ],
|
|
|
|
'SessionTypes' => [ 'meterpreter' ]
|
|
|
|
))
|
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
OptBool.new("CURRENT" , [ true, "Enumerate currently configured shares" , true]),
|
|
|
|
OptBool.new("RECENT" , [ true, "Enumerate Recently mapped shares" , true]),
|
|
|
|
OptBool.new("ENTERED" , [ true, "Enumerate Recently entered UNC Paths in the Run Dialog" , true])
|
2017-05-03 20:42:21 +00:00
|
|
|
])
|
2013-08-30 21:28:54 +00:00
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
# Stolen from modules/auxiliary/scanner/smb/smb_enumshares.rb
|
|
|
|
def share_type(val)
|
|
|
|
stypes = [
|
|
|
|
'DISK',
|
|
|
|
'PRINTER',
|
|
|
|
'DEVICE',
|
|
|
|
'IPC',
|
|
|
|
'SPECIAL',
|
|
|
|
'TEMPORARY'
|
|
|
|
]
|
|
|
|
|
|
|
|
if val > (stypes.length - 1)
|
|
|
|
return 'UNKNOWN'
|
|
|
|
end
|
|
|
|
|
|
|
|
stypes[val]
|
|
|
|
end
|
|
|
|
|
|
|
|
# Method for enumerating recent mapped drives on target machine
|
|
|
|
def enum_recent_mounts(base_key)
|
|
|
|
recent_mounts = []
|
|
|
|
partial_path = base_key + "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"
|
|
|
|
full_path = "#{partial_path}\\Map Network Drive MRU"
|
|
|
|
explorer_keys = registry_enumkeys(partial_path) || ''
|
|
|
|
if explorer_keys.include?("Map Network Drive MRU")
|
|
|
|
vals_found = registry_enumvals(full_path)
|
|
|
|
if vals_found
|
|
|
|
registry_enumvals(full_path).each do |k|
|
|
|
|
if not k =~ /MRUList/
|
|
|
|
recent_mounts << registry_getvaldata(full_path,k)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
return recent_mounts
|
|
|
|
end
|
|
|
|
|
|
|
|
# Method for enumerating UNC Paths entered in run dialog box
|
|
|
|
def enum_run_unc(base_key)
|
|
|
|
unc_paths = []
|
|
|
|
full_path = base_key + "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU"
|
|
|
|
vals_found = registry_enumvals(full_path)
|
|
|
|
if vals_found
|
|
|
|
vals_found.each do |k|
|
|
|
|
if k =~ /./
|
|
|
|
run_entrie = registry_getvaldata(full_path,k)
|
|
|
|
unc_paths << run_entrie if run_entrie =~ /^\\\\/
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
return unc_paths
|
|
|
|
end
|
|
|
|
|
|
|
|
# Method for enumerating configured shares on a target box
|
|
|
|
def enum_conf_shares()
|
|
|
|
if sysinfo["OS"] =~ /Windows 7|Vista|2008/
|
|
|
|
shares_key = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\LanmanServer\\Shares"
|
|
|
|
else
|
|
|
|
shares_key = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\lanmanserver\\Shares"
|
|
|
|
end
|
|
|
|
share_names = registry_enumvals(shares_key)
|
|
|
|
|
|
|
|
if share_names.length > 0
|
|
|
|
shares = []
|
|
|
|
print_status("The following shares were found:")
|
|
|
|
share_names.each do |sname|
|
|
|
|
info = registry_getvaldata(shares_key,sname)
|
|
|
|
next if info.nil?
|
|
|
|
share_info = info.split("\000")
|
|
|
|
print_status("\tName: #{sname}")
|
|
|
|
stype = remark = path = nil
|
|
|
|
share_info.each do |e|
|
|
|
|
name,val = e.split("=")
|
|
|
|
case name
|
|
|
|
when "Path"
|
|
|
|
print_status "\tPath: #{val}"
|
|
|
|
path = val
|
|
|
|
when "Type"
|
|
|
|
print_status "\tType: #{val}"
|
|
|
|
stype = share_type(val.to_i)
|
|
|
|
when "Remark"
|
|
|
|
remark = val
|
|
|
|
end
|
|
|
|
end
|
|
|
|
# Match the format used by auxiliary/scanner/smb/smb_enumshares
|
|
|
|
# with an added field for path
|
|
|
|
shares << [ sname, stype, remark, path ]
|
|
|
|
print_status()
|
|
|
|
end
|
|
|
|
report_note(
|
|
|
|
:host => session,
|
|
|
|
:type => 'smb.shares',
|
|
|
|
:data => { :shares => shares },
|
|
|
|
:update => :unique_data
|
|
|
|
)
|
|
|
|
else
|
|
|
|
print_status("No shares were found")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def run
|
|
|
|
print_status("Running against session #{datastore["SESSION"]}")
|
|
|
|
|
|
|
|
# Variables to hold info
|
|
|
|
mount_history = []
|
|
|
|
run_history = []
|
|
|
|
|
|
|
|
# Enumerate shares being offered
|
|
|
|
enum_conf_shares() if datastore["CURRENT"]
|
|
|
|
if is_system?
|
|
|
|
mount_history = enum_recent_mounts("HKEY_CURRENT_USER")
|
|
|
|
run_history = enum_run_unc("HKEY_CURRENT_USER")
|
|
|
|
else
|
|
|
|
user_sid = []
|
|
|
|
key = "HKU\\"
|
|
|
|
root_key, base_key = session.sys.registry.splitkey(key)
|
|
|
|
open_key = session.sys.registry.open_key(root_key, base_key)
|
|
|
|
keys = open_key.enum_key
|
|
|
|
keys.each do |k|
|
|
|
|
user_sid << k if k =~ /S-1-5-21-\d*-\d*-\d*-\d{3,6}$/
|
|
|
|
end
|
|
|
|
user_sid.each do |us|
|
|
|
|
mount_history = mount_history + enum_recent_mounts("HKU\\#{us.chomp}") if datastore["RECENT"]
|
|
|
|
run_history = run_history + enum_run_unc("HKU\\#{us.chomp}") if datastore["ENTERED"]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
# Enumerate Mount History
|
|
|
|
if mount_history.length > 0
|
|
|
|
print_status("Recent Mounts found:")
|
|
|
|
mount_history.each do |i|
|
|
|
|
print_status("\t#{i}")
|
|
|
|
end
|
|
|
|
print_status()
|
|
|
|
end
|
|
|
|
|
|
|
|
# Enumerate UNC Paths entered in the Dialog box
|
|
|
|
if run_history.length > 0
|
|
|
|
print_status("Recent UNC paths entered in Run Dialog found:")
|
|
|
|
run_history.each do |i|
|
|
|
|
print_status("\t#{i}")
|
|
|
|
end
|
|
|
|
print_status()
|
|
|
|
end
|
|
|
|
|
|
|
|
end
|
2011-01-11 22:31:37 +00:00
|
|
|
end
|