2021-09-02 21:58:07 +10:00
|
|
|
##
|
|
|
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
|
##
|
|
|
|
|
|
|
|
|
|
require 'winrm'
|
2021-09-10 15:13:30 +10:00
|
|
|
require 'net/winrm/stdin_shell'
|
|
|
|
|
require 'net/winrm/rex_http_transport'
|
2021-09-06 09:33:44 +10:00
|
|
|
|
2021-09-02 21:58:07 +10:00
|
|
|
module Net
|
|
|
|
|
module MsfWinRM
|
2021-09-10 15:13:30 +10:00
|
|
|
# Connection to a WinRM service, using Rex sockets
|
2021-09-02 21:58:07 +10:00
|
|
|
class RexWinRMConnection < WinRM::Connection
|
2021-09-10 15:13:30 +10:00
|
|
|
# Factory class to create a shell of the appropriate type.
|
|
|
|
|
# Subclassed to be able to provide a StdinShell
|
2021-09-02 21:58:07 +10:00
|
|
|
class ShellFactory < WinRM::Shells::ShellFactory
|
|
|
|
|
def create_shell(shell_type, shell_opts = {})
|
|
|
|
|
args = [
|
|
|
|
|
@connection_opts,
|
|
|
|
|
@transport,
|
2021-09-14 10:31:17 +10:00
|
|
|
@logger,
|
|
|
|
|
shell_opts
|
2021-09-02 21:58:07 +10:00
|
|
|
]
|
|
|
|
|
return StdinShell.new(*args) if shell_type == :stdin
|
2021-09-10 15:13:30 +10:00
|
|
|
|
2021-09-02 21:58:07 +10:00
|
|
|
super(shell_type, shell_opts)
|
|
|
|
|
end
|
|
|
|
|
end
|
2021-09-06 22:25:34 +10:00
|
|
|
|
2021-09-10 15:13:30 +10:00
|
|
|
# Creates a WinRM transport, subclassed to support Rex sockets
|
|
|
|
|
class TransportFactory < WinRM::HTTP::TransportFactory
|
2021-09-02 21:58:07 +10:00
|
|
|
def create_transport(connection_opts)
|
2021-09-08 07:36:59 +10:00
|
|
|
raise NotImplementedError unless connection_opts[:transport] == :rexhttp
|
2021-09-10 15:13:30 +10:00
|
|
|
|
2021-09-02 21:58:07 +10:00
|
|
|
super
|
|
|
|
|
end
|
2021-09-10 15:13:30 +10:00
|
|
|
|
2021-09-02 21:58:07 +10:00
|
|
|
private
|
2021-09-10 15:13:30 +10:00
|
|
|
|
2021-09-08 07:36:59 +10:00
|
|
|
def init_rexhttp_transport(opts)
|
2021-09-02 21:58:07 +10:00
|
|
|
RexHttpTransport.new(opts)
|
|
|
|
|
end
|
|
|
|
|
end
|
2021-09-10 15:13:30 +10:00
|
|
|
|
|
|
|
|
# Provide an adapter for logging WinRM module messages to the MSF log
|
|
|
|
|
class WinRMProxyLogger
|
|
|
|
|
def error(msg)
|
|
|
|
|
elog(msg, 'winrm')
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def warn(msg)
|
|
|
|
|
wlog(msg, 'winrm')
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def info(msg)
|
|
|
|
|
ilog(msg, 'winrm')
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
def debug(msg)
|
|
|
|
|
dlog(msg, 'winrm')
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
|
2021-09-02 21:58:07 +10:00
|
|
|
def shell_factory
|
|
|
|
|
@shell_factory ||= ShellFactory.new(@connection_opts, transport, logger)
|
|
|
|
|
end
|
2021-09-10 15:13:30 +10:00
|
|
|
|
2021-09-02 21:58:07 +10:00
|
|
|
def transport
|
|
|
|
|
@transport ||= begin
|
|
|
|
|
transport_factory = TransportFactory.new
|
|
|
|
|
transport_factory.create_transport(@connection_opts)
|
|
|
|
|
end
|
|
|
|
|
end
|
2021-09-10 15:13:30 +10:00
|
|
|
|
|
|
|
|
def configure_logger
|
|
|
|
|
@logger = WinRMProxyLogger.new
|
|
|
|
|
end
|
2021-09-02 21:58:07 +10:00
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
end
|