infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Cleanup

bug/bundler_fix
Meatballs 2016-06-15 22:41:59 +01:00
parent 8a68e86a0a
commit 0451d4f079
No known key found for this signature in database
GPG Key ID: 5380EAF01F2F8B38
1 changed files with 44 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

93
modules/post/windows/gather/enum_trusted_locations.rb
View File

@ -11,10 +11,13 @@ class MetasploitModule < Msf::Post
include Msf::Post::Windows::Registry include Msf::Post::Windows::Registry
include Msf::Post::Common include Msf::Post::Common
OFFICE_REGISTRY_PATH = 'HKCU\\SOFTWARE\\Microsoft\\Office'
TRUSTED_LOCATIONS_PATH = 'Security\\Trusted Locations'
def initialize(info = {}) def initialize(info = {})
super(update_info(info, super(update_info(info,
'Name' => 'Windows Gather Microsoft Office Trusted Locations', 'Name' => 'Windows Gather Microsoft Office Trusted Locations',
'Description' => %q( This module will enumerate the Microsoft Office trusted locations on the target host.), 'Description' => %q( This module will enumerate the Microsoft Office trusted locations on the target host. ),
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => [ 'vysec <vincent.yiu[at]mwrinfosecurity.com>' ], 'Author' => [ 'vysec <vincent.yiu[at]mwrinfosecurity.com>' ],
'Platform' => [ 'win' ], 'Platform' => [ 'win' ],
@ -31,57 +34,49 @@ class MetasploitModule < Msf::Post
end end
def run def run
reg_view = sysinfo['Architecture'] =~ /x64/ ? REGISTRY_VIEW_64_BIT : REGISTRY_VIEW_32_BIT locations = ""
reg_keys = registry_enumkeys('HKCU\\SOFTWARE\\Microsoft\\Office', reg_view) [REGISTRY_VIEW_64_BIT, REGISTRY_VIEW_32_BIT].each do |registry_arch|
if reg_keys.nil? arch = registry_arch == REGISTRY_VIEW_64_BIT ? 'x64' : 'x86'
print_status('Failed to enumerate Office.') reg_keys = registry_enumkeys(OFFICE_REGISTRY_PATH, registry_arch)
else if reg_keys.nil?
print_status('') print_status("Failed to enumerate Office in #{arch} registry hive.")
print_status('Found Office.') return
#find version to use end
reg_keys.each do |path|
if not /[0-9][0-9].0/.match(path).nil?
val1 = path
print_status("Version found: #{val1}")
reg_keys2 = registry_enumkeys("HKCU\\SOFTWARE\\Microsoft\\Office\\#{val1}", reg_view)
if reg_keys2.nil?
print_status('Failed to enumerate applications.')
else
print_status('Found applications.')
print_status('') reg_keys.each do |version|
#find version to use next if /[0-9][0-9].0/.match(version).nil?
reg_keys2.each do |path2|
val2 = path2 print_status("Version found: #{version}")
reg_keys3 = registry_enumkeys("HKCU\\SOFTWARE\\Microsoft\\Office\\#{val1}\\#{val2}\\Security\\Trusted Locations", reg_view) version_path = "#{OFFICE_REGISTRY_PATH}\\#{version}"
if not reg_keys3.nil? applications = registry_enumkeys(version_path, registry_arch)
print_status('')
print_good("Found trusted locations in #{val2}") if applications.nil?
#find version to use print_status('Failed to enumerate applications.')
reg_keys3.each do |path3| next
val3 = path3 end
#print_status(path3)
print_status('') vprint_status('Found applications.')
reg_vals = registry_getvaldata("HKCU\\SOFTWARE\\Microsoft\\Office\\#{val1}\\#{val2}\\Security\\Trusted Locations\\#{val3}", "Description", reg_view) #find version to use
if not reg_vals.nil? applications.each do |application|
print_status("Description: #{reg_vals}") trusted_locations_path = "#{version_path}\\#{application}\\#{TRUSTED_LOCATIONS_PATH}"
end trusted_locations = registry_enumkeys(trusted_locations_path, registry_arch)
reg_vals2 = registry_getvaldata("HKCU\\SOFTWARE\\Microsoft\\Office\\#{val1}\\#{val2}\\Security\\Trusted Locations\\#{val3}", "AllowSubFolders", reg_view) next if trusted_locations.nil?
reg_vals = registry_getvaldata("HKCU\\SOFTWARE\\Microsoft\\Office\\#{val1}\\#{val2}\\Security\\Trusted Locations\\#{val3}", "Path", reg_view)
if not reg_vals.nil? print_good("Found trusted locations in #{application}")
if not reg_vals2.nil? #find version to use
print_status("Path: #{reg_vals}, AllowSub: True") trusted_locations.each do |location|
else location_path = "#{trusted_locations_path}\\#{location}"
print_status("Path: #{reg_vals}, AllowSub: False") description = registry_getvaldata(location_path, 'Description', registry_arch)
end allow_subfolders = registry_getvaldata(location_path, 'AllowSubFolders', registry_arch)
end path = registry_getvaldata(location_path, 'Path', registry_arch)
end vprint_status("Description: #{description}")
end result = "Application: #{application}, Path: #{path}, AllSubFolders: #{!!allow_subfolders}"
end locations << "#{result}\n"
end print_status(result)
end
end end
end end
path = store_loot('host.trusted_locations', 'text/plain', session, reg_keys.join("\r\n"), 'trusted_locations.txt', 'Trusted Locations') path = store_loot('host.trusted_locations', 'text/plain', session, locations, 'trusted_locations.txt', 'Trusted Locations')
print_good("Results stored in: #{path}") print_good("Results stored in: #{path}")
end end
end end