metasploit-framework/modules/post/windows/manage/run_as_psh.rb

90 lines
3.3 KiB
Ruby

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core/post/windows/powershell'
class MetasploitModule < Msf::Post
include Msf::Post::Windows::Powershell
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Windows \'Run As\' Using Powershell',
'Description' => %q( This module will start a process as another user using powershell. ),
'License' => MSF_LICENSE,
'Author' => ['p3nt4'],
'Platform' => ['win'],
'SessionTypes' => ['meterpreter']
)
)
register_options(
[
OptString.new('USER', [true, 'User to run executable as', nil]),
OptString.new('PASS', [true, 'Password of user', nil]),
OptString.new('DOMAIN', [false, 'Domain of user', '']),
OptString.new('EXE', [true, 'Executable to run', 'cmd.exe']),
OptString.new('ARGS', [false, 'Arguments', nil]),
OptString.new('PATH', [true, 'Working Directory', 'C:\\']),
OptBool.new('CHANNELIZE', [true, 'Chanelize output, required for reading output or interracting', true]),
OptBool.new('INTERACTIVE', [true, 'Run interactively', true]),
OptBool.new('HIDDEN', [true, 'Hide the window', true])
])
end
def run
raise "Powershell is required" if !have_powershell?
# Variable Setup
user = datastore['user']
pass = datastore['pass']
domain = datastore['domain']
exe = datastore['exe'].gsub('\\', '\\\\\\\\')
inter = datastore['interactive']
args = datastore['args']
path = datastore['path'].gsub('\\', '\\\\\\\\')
channelized = datastore['channelize']
hidden = datastore['hidden']
if user.include? '\\'
domain = user.split('\\')[0]
user = user.split('\\')[1]
end
# Check if session is interactive
if !session.interacting && inter
print_error('Interactive mode can only be used in a meterpreter console')
print_error("Use 'run post/windows/manage/run_as_psh USER=x PASS=X EXE=X' or 'SET INTERACTIVE false'")
raise 'Invalide console'
end
# Prepare powershell script
scr = "$pw = convertto-securestring '#{pass}' -asplaintext -force; "
scr << "$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist '#{domain}\\#{user}',$pw; "
scr << "Start-process '#{exe}' -WorkingDirectory '#{path}' -Credential $pp"
if args && args != ''
scr << " -argumentlist '#{args}' "
end
if hidden
print_status('Hidden mode may not work on older powershell versions, if it fails, try HIDDEN=false')
scr << ' -WindowStyle hidden'
end
scr = " -c \"#{scr}\""
# Execute script
p = client.sys.process.execute("powershell.exe", scr,
'Channelized' => channelized,
'Desktop' => false,
'Session' => false,
'Hidden' => true,
'Interactive' => inter,
'InMemory' => false,
'UseThreadToken' => false)
print_status("Process #{p.pid} created.")
print_status("Channel #{p.channel.cid} created.") if p.channel
# Process output
if inter && p.channel
client.console.interact_with_channel(p.channel)
elsif p.channel
data = p.channel.read
print_line(data) if data
end
end
end