Migrated enum_shares script to module

git-svn-id: file:///home/svn/framework3/trunk@11549 4d416f70-5f16-0410-b530-b9f4589650da

modules/post/windows/gather/enum_shares.rb

@@ -0,0 +1,142 @@
+#
+# $Id$ ##
+
+# ## This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/ ##
+
+require 'msf/core'
+require 'rex'
+require 'msf/core/post/registry'
+
+class Metasploit3 < Msf::Post
+
+	include Msf::Post::Registry
+
+	def initialize(info={})
+		super( update_info( info,
+				'Name'          => 'Enumerate Shares',
+				'Description'   => %q{ This module will enumerate recent and configured file shares},
+				'License'       => MSF_LICENSE,
+				'Author'        => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
+				'Version'       => '$Revision$',
+				'Platform'      => [ 'windows' ],
+				'SessionTypes'  => [ 'meterpreter' ]
+			))
+		register_options(
+			[
+				OptBool.new('CURRENT' , [ true, 'Enumerate currently configured shares'                  , true]),
+				OptBool.new('RECENT'  , [ true, 'Enumerate Recently mapped shares'                       , true]),
+				OptBool.new('ENTERED' , [ true, 'Enumerate Recently entered UNC Paths in the Run Dialog' , true])
+
+			], self.class)
+
+	end
+
+
+	# Method for enumerating recent mapped drives on target machine
+	def enum_recent_mounts(base_key)
+		recent_mounts = []
+		partial_path = base_key + '\Software\\Microsoft\Windows\CurrentVersion\Explorer'
+		full_path = "#{partial_path}\\Map Network Drive MRU"
+		explorer_keys = registry_enumkeys(partial_path)
+		if explorer_keys.include?("Map Network Drive MRU")
+			registry_enumvals(full_path).each do |k|
+				if not k =~ /MRUList/
+					recent_mounts << registry_getvaldata(full_path,k)
+				end
+			end
+		end
+		return recent_mounts
+	end
+
+	# Method for enumerating UNC Paths entered in run dialog box
+	def enum_run_unc(base_key)
+		unc_paths = []
+		full_path = base_key + '\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU'
+		registry_enumvals(full_path).each do |k|
+			if k =~ /./
+				run_entrie = registry_getvaldata(full_path,k)
+				unc_paths << run_entrie if run_entrie =~ /^\\\\/
+			end
+		end
+
+		return unc_paths
+	end
+
+	# Method for enumerating configured shares on a target box
+	def enum_conf_shares()
+		target_os = session.sys.config.sysinfo['OS']
+		if target_os =~ /Windows 7|Vista|2008/
+			shares_key = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\LanmanServer\\Shares'
+		else
+			shares_key = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\lanmanserver\\Shares'
+		end
+		shares = registry_enumvals(shares_key)
+		print_status("The following shares where found:")
+		if shares.length > 0
+			shares.each do |s|
+				share_info = registry_getvaldata(shares_key,s).split("\000")
+				print_status("\tName: #{s}")
+				share_info.each do |e|
+					name,val = e.split("=")
+					print_status("\t#{name}: #{val}") if name =~ /Path|Type/
+				end
+				print_status()
+			end
+		else
+			print_status("No Shares where found")
+		end
+	end
+
+
+
+	def run
+		print_status("Running against session #{datastore['SESSION']}")
+
+		# Variables to hold info
+		mount_history = []
+		run_history = []
+
+		# Enumerate shares being offered
+		enum_conf_shares() if datastore['CURRENT']
+		user = session.sys.config.getuid
+		if user != "NT AUTHORITY\\SYSTEM"
+			mount_history = enum_recent_mounts("HKEY_CURRENT_USER")
+			run_history = enum_run_unc("HKEY_CURRENT_USER")
+		else
+			user_sid = []
+			key = "HKU\\"
+			root_key, base_key = session.sys.registry.splitkey(key)
+			open_key = session.sys.registry.open_key(root_key, base_key)
+			keys = open_key.enum_key
+			keys.each do |k|
+				user_sid << k if k =~ /S-1-5-21-\d*-\d*-\d*-\d{3,6}$/
+			end
+			user_sid.each do |us|
+				mount_history = mount_history + enum_recent_mounts("HKU\\#{us.chomp}") if datastore['RECENT']
+				run_history = run_history + enum_run_unc("HKU\\#{us.chomp}") if datastore['ENTERED']
+			end
+		end
+
+		# Enumerate Mount History
+		if mount_history.length > 0
+			print_status("Recent Mounts found:")
+			mount_history.each do |i|
+				print_status("\t#{i}")
+			end
+			print_status()
+		end
+
+		# #Enumerate UNC Paths entered in the Dialog box
+		if run_history.length > 0
+			print_status("Recent UNC paths entered in Run Dialog found:")
+			run_history.each do |i|
+				print_status("\t#{i}")
+			end
+			print_status()
+		end
+
+	end
+end