more spaces at EOL
parent
8f56dc1504
commit
4ac21afcbc
|
@ -1,7 +1,7 @@
|
||||||
module Msf
|
module Msf
|
||||||
class Post
|
class Post
|
||||||
module Windows
|
module Windows
|
||||||
|
|
||||||
module Accounts
|
module Accounts
|
||||||
|
|
||||||
##
|
##
|
||||||
|
@ -23,39 +23,39 @@ module Accounts
|
||||||
# :access_denied - You do not have permission to delete the given user
|
# :access_denied - You do not have permission to delete the given user
|
||||||
#
|
#
|
||||||
# OR nil if there was an exceptional windows error (example: ran out of memory)
|
# OR nil if there was an exceptional windows error (example: ran out of memory)
|
||||||
#
|
#
|
||||||
# Caveats:
|
# Caveats:
|
||||||
# nil is returned if there is an *exceptional* windows error. That error is printed.
|
# nil is returned if there is an *exceptional* windows error. That error is printed.
|
||||||
# Everything other than ':success' signifies failure
|
# Everything other than ':success' signifies failure
|
||||||
##
|
##
|
||||||
def delete_user(username, server_name = nil)
|
def delete_user(username, server_name = nil)
|
||||||
deletion = client.railgun.netapi32.NetUserDel(server_name, username)
|
deletion = client.railgun.netapi32.NetUserDel(server_name, username)
|
||||||
|
|
||||||
#http://msdn.microsoft.com/en-us/library/aa370674.aspx
|
#http://msdn.microsoft.com/en-us/library/aa370674.aspx
|
||||||
case deletion['return']
|
case deletion['return']
|
||||||
when 2221 # NERR_UserNotFound
|
when 2221 # NERR_UserNotFound
|
||||||
return :user_not_found
|
return :user_not_found
|
||||||
when 2351 # NERR_InvalidComputer
|
when 2351 # NERR_InvalidComputer
|
||||||
return :invalid_server
|
return :invalid_server
|
||||||
when 2226 # NERR_NotPrimary
|
when 2226 # NERR_NotPrimary
|
||||||
return :not_on_primary
|
return :not_on_primary
|
||||||
when client.railgun.const('ERROR_ACCESS_DENIED')
|
when client.railgun.const('ERROR_ACCESS_DENIED')
|
||||||
return :access_denied
|
return :access_denied
|
||||||
when 0
|
when 0
|
||||||
return :success
|
return :success
|
||||||
else
|
else
|
||||||
error = deletion['GetLastError']
|
error = deletion['GetLastError']
|
||||||
if error != 0
|
if error != 0
|
||||||
print_error "Unexpected Windows System Error #{error}"
|
print_error "Unexpected Windows System Error #{error}"
|
||||||
else
|
else
|
||||||
# Uh... we shouldn't be here
|
# Uh... we shouldn't be here
|
||||||
print_error "DeleteUser unexpectedly returned #{deletion['return']}"
|
print_error "DeleteUser unexpectedly returned #{deletion['return']}"
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
# If we got here, then something above failed
|
# If we got here, then something above failed
|
||||||
return nil
|
return nil
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
##
|
##
|
||||||
|
@ -71,7 +71,7 @@ module Accounts
|
||||||
# Returns:
|
# Returns:
|
||||||
# {
|
# {
|
||||||
# :name => account name (e.g. "SYSTEM")
|
# :name => account name (e.g. "SYSTEM")
|
||||||
# :domain => domain where the account name was found. May have values such as
|
# :domain => domain where the account name was found. May have values such as
|
||||||
# the work station's name, BUILTIN, NT AUTHORITY, or an empty string
|
# the work station's name, BUILTIN, NT AUTHORITY, or an empty string
|
||||||
# :type => one of :user, :group, :domain, :alias, :well_known_group,
|
# :type => one of :user, :group, :domain, :alias, :well_known_group,
|
||||||
# :deleted_account, :invalid, :unknown, :computer
|
# :deleted_account, :invalid, :unknown, :computer
|
||||||
|
@ -106,9 +106,9 @@ module Accounts
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
# A reference to the SID data structure. Generally needed when working with sids
|
# A reference to the SID data structure. Generally needed when working with sids
|
||||||
psid = conversion['pSid']
|
psid = conversion['pSid']
|
||||||
|
|
||||||
# http://msdn.microsoft.com/en-us/library/aa379166(v=vs.85).aspx
|
# http://msdn.microsoft.com/en-us/library/aa379166(v=vs.85).aspx
|
||||||
# TODO: The buffer sizes here need to be reviewed/adjusted/optimized
|
# TODO: The buffer sizes here need to be reviewed/adjusted/optimized
|
||||||
lookup = adv.LookupAccountSidA(system_name, psid, 100, 100, 100, 100, 1)
|
lookup = adv.LookupAccountSidA(system_name, psid, 100, 100, 100, 100, 1)
|
||||||
|
@ -144,7 +144,7 @@ module Accounts
|
||||||
:mapped => true
|
:mapped => true
|
||||||
}
|
}
|
||||||
end
|
end
|
||||||
|
|
||||||
private
|
private
|
||||||
|
|
||||||
##
|
##
|
||||||
|
|
|
@ -24,7 +24,7 @@ module Priv
|
||||||
else
|
else
|
||||||
return true
|
return true
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
#
|
#
|
||||||
|
@ -76,7 +76,7 @@ module Priv
|
||||||
end
|
end
|
||||||
return uac
|
return uac
|
||||||
end
|
end
|
||||||
|
|
||||||
def session_has_ext
|
def session_has_ext
|
||||||
begin
|
begin
|
||||||
return !!(session.railgun and session.sys.config)
|
return !!(session.railgun and session.sys.config)
|
||||||
|
|
|
@ -15,7 +15,7 @@ module Registry
|
||||||
retval=meterpreter_registry_loadkey(key,file)
|
retval=meterpreter_registry_loadkey(key,file)
|
||||||
else
|
else
|
||||||
retval=shell_registry_loadkey(key,file)
|
retval=shell_registry_loadkey(key,file)
|
||||||
end
|
end
|
||||||
return retval
|
return retval
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -24,7 +24,7 @@ module Registry
|
||||||
retval=meterpreter_registry_unloadkey(key)
|
retval=meterpreter_registry_unloadkey(key)
|
||||||
else
|
else
|
||||||
retval=shell_registry_unloadkey(key)
|
retval=shell_registry_unloadkey(key)
|
||||||
end
|
end
|
||||||
return retval
|
return retval
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -152,7 +152,7 @@ protected
|
||||||
elsif results =~ /^Error:/
|
elsif results =~ /^Error:/
|
||||||
error_hash = win_parse_error(results)
|
error_hash = win_parse_error(results)
|
||||||
else
|
else
|
||||||
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
||||||
end
|
end
|
||||||
return boo
|
return boo
|
||||||
end
|
end
|
||||||
|
@ -167,7 +167,7 @@ protected
|
||||||
elsif results =~ /^Error:/
|
elsif results =~ /^Error:/
|
||||||
error_hash = win_parse_error(results)
|
error_hash = win_parse_error(results)
|
||||||
else
|
else
|
||||||
error_hash = win_parse_error("ERROR:Unknown error running #{cmd} INSPECT: #{error_hash.inspect}")
|
error_hash = win_parse_error("ERROR:Unknown error running #{cmd} INSPECT: #{error_hash.inspect}")
|
||||||
end
|
end
|
||||||
return boo
|
return boo
|
||||||
end
|
end
|
||||||
|
@ -185,7 +185,7 @@ protected
|
||||||
elsif results =~ /^Error:/
|
elsif results =~ /^Error:/
|
||||||
error_hash = win_parse_error(results)
|
error_hash = win_parse_error(results)
|
||||||
else
|
else
|
||||||
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
@ -220,7 +220,7 @@ protected
|
||||||
elsif results =~ /^Error:/
|
elsif results =~ /^Error:/
|
||||||
error_hash = win_parse_error(results)
|
error_hash = win_parse_error(results)
|
||||||
else
|
else
|
||||||
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
return boo
|
return boo
|
||||||
|
@ -229,8 +229,8 @@ protected
|
||||||
def shell_registry_enumkeys(key)
|
def shell_registry_enumkeys(key)
|
||||||
key = normalize_key(key)
|
key = normalize_key(key)
|
||||||
subkeys = []
|
subkeys = []
|
||||||
reg_data_types = 'REG_SZ|REG_MULTI_SZ|REG_DWORD_BIG_ENDIAN|REG_DWORD|REG_BINARY|'
|
reg_data_types = 'REG_SZ|REG_MULTI_SZ|REG_DWORD_BIG_ENDIAN|REG_DWORD|REG_BINARY|'
|
||||||
reg_data_types << 'REG_DWORD_LITTLE_ENDIAN|REG_NONE|REG_EXPAND_SZ|REG_LINK|REG_FULL_RESOURCE_DESCRIPTOR'
|
reg_data_types << 'REG_DWORD_LITTLE_ENDIAN|REG_NONE|REG_EXPAND_SZ|REG_LINK|REG_FULL_RESOURCE_DESCRIPTOR'
|
||||||
begin
|
begin
|
||||||
bslashes = key.count('\\')
|
bslashes = key.count('\\')
|
||||||
cmd = "cmd.exe /c reg query \"#{key}\""
|
cmd = "cmd.exe /c reg query \"#{key}\""
|
||||||
|
@ -249,7 +249,7 @@ protected
|
||||||
end
|
end
|
||||||
#else
|
#else
|
||||||
# error_hash = win_parse_error("ERROR:Unrecognizable results from #{cmd}")
|
# error_hash = win_parse_error("ERROR:Unrecognizable results from #{cmd}")
|
||||||
end
|
end
|
||||||
else
|
else
|
||||||
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
error_hash = win_parse_error("ERROR:Unknown error running #{cmd}")
|
||||||
end
|
end
|
||||||
|
@ -260,7 +260,7 @@ protected
|
||||||
def shell_registry_enumvals(key)
|
def shell_registry_enumvals(key)
|
||||||
key = normalize_key(key)
|
key = normalize_key(key)
|
||||||
values = []
|
values = []
|
||||||
reg_data_types = 'REG_SZ|REG_MULTI_SZ|REG_DWORD_BIG_ENDIAN|REG_DWORD|REG_BINARY|'
|
reg_data_types = 'REG_SZ|REG_MULTI_SZ|REG_DWORD_BIG_ENDIAN|REG_DWORD|REG_BINARY|'
|
||||||
reg_data_types << 'REG_DWORD_LITTLE_ENDIAN|REG_NONE|REG_EXPAND_SZ|REG_LINK|REG_FULL_RESOURCE_DESCRIPTOR'
|
reg_data_types << 'REG_DWORD_LITTLE_ENDIAN|REG_NONE|REG_EXPAND_SZ|REG_LINK|REG_FULL_RESOURCE_DESCRIPTOR'
|
||||||
begin
|
begin
|
||||||
# REG QUERY KeyName [/v ValueName | /ve] [/s]
|
# REG QUERY KeyName [/v ValueName | /ve] [/s]
|
||||||
|
@ -368,7 +368,7 @@ protected
|
||||||
return true
|
return true
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
rescue
|
rescue
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
#!/usr/bin/env ruby
|
#!/usr/bin/env ruby
|
||||||
|
|
||||||
$:.unshift(File.join(File.dirname(__FILE__), '..','..','..','..','..', 'lib'))
|
$:.unshift(File.join(File.dirname(__FILE__), '..','..','..','..','..', 'lib'))
|
||||||
|
|
||||||
require 'msf/core/post/windows/registry'
|
require 'msf/core/post/windows/registry'
|
||||||
require 'test/unit'
|
require 'test/unit'
|
||||||
|
|
|
@ -8,7 +8,7 @@ module Windows
|
||||||
module UserProfiles
|
module UserProfiles
|
||||||
include Msf::Post::Windows::Registry
|
include Msf::Post::Windows::Registry
|
||||||
include Msf::Post::Windows::Accounts
|
include Msf::Post::Windows::Accounts
|
||||||
|
|
||||||
def grab_user_profiles
|
def grab_user_profiles
|
||||||
hives = load_missing_hives()
|
hives = load_missing_hives()
|
||||||
profiles = parse_profiles(hives)
|
profiles = parse_profiles(hives)
|
||||||
|
@ -59,10 +59,10 @@ module UserProfiles
|
||||||
read_profile_list().each do |hive|
|
read_profile_list().each do |hive|
|
||||||
hive['OURS']=false
|
hive['OURS']=false
|
||||||
if hive['LOADED']== false
|
if hive['LOADED']== false
|
||||||
if session.fs.file.exists?(hive['DAT'])
|
if session.fs.file.exists?(hive['DAT'])
|
||||||
hive['OURS'] = registry_loadkey(hive['HKU'], hive['DAT'])
|
hive['OURS'] = registry_loadkey(hive['HKU'], hive['DAT'])
|
||||||
print_error("Error loading USER #{hive['SID']}: Hive could not be loaded, are you Admin?") unless hive['OURS']
|
print_error("Error loading USER #{hive['SID']}: Hive could not be loaded, are you Admin?") unless hive['OURS']
|
||||||
else
|
else
|
||||||
print_error("Error loading USER #{hive['SID']}: Profile doesn't exist or cannot be accessed")
|
print_error("Error loading USER #{hive['SID']}: Profile doesn't exist or cannot be accessed")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
@ -86,7 +86,7 @@ module UserProfiles
|
||||||
end
|
end
|
||||||
return hives
|
return hives
|
||||||
end
|
end
|
||||||
|
|
||||||
def loaded_hives
|
def loaded_hives
|
||||||
hives=[]
|
hives=[]
|
||||||
registry_enumkeys('HKU').each do |k|
|
registry_enumkeys('HKU').each do |k|
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
#!/usr/bin/env ruby
|
#!/usr/bin/env ruby
|
||||||
|
|
||||||
$:.unshift(File.join(File.dirname(__FILE__), '..','..','..','..','..', 'lib'))
|
$:.unshift(File.join(File.dirname(__FILE__), '..','..','..','..','..', 'lib'))
|
||||||
|
|
||||||
require 'msf/core/post/windows/user_profiles'
|
require 'msf/core/post/windows/user_profiles'
|
||||||
require 'test/unit'
|
require 'test/unit'
|
||||||
|
|
Loading…
Reference in New Issue