PEASS-ng/metasploit

PEASS Post Exploitation Module for Metasploit

You can use this module to automatically execute a PEASS script from a meterpreter or shell session obtained in metasploit.

Manual Installation

Copy the peass.rb file to the path modules/post/multi/gather/ inside the metasploit installation.

In Kali:

sudo cp ./peass.rb /usr/share/metasploit-framework/modules/post/multi/gather/
# or
sudo wget https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/metasploit/peass.rb -O /usr/share/metasploit-framework/modules/post/multi/gather/peass.rb

Now you can do reload_all inside a running msfconsole or the next time you launch a new msfconsole the peass module will be automatically loaded.

How to use it

msf6 exploit(multi/handler) > use post/multi/gather/peass
msf6 post(multi/gather/peass) > show info

       Name: Multi PEASS launcher
     Module: post/multi/gather/peass
   Platform: BSD, Linux, OSX, Unix, Windows
       Arch: 
       Rank: Normal

Provided by:
  Carlos Polop <@hacktricks_live>

Compatible session types:
  Meterpreter
  Shell

Basic options:
  Name        Current Setting                                                           Required  Description
  ----        ---------------                                                           --------  -----------
  PARAMETERS                                                                            no        Parameters to pass to the script
  PASSWORD    um1xipfws17nkw1bi1ma3bh7tzt4mo3e                                          no        Password to encrypt and obfuscate the script (randomly generated). The length must be 32B. If no password is set, only base64 will be used
                                                                                                  .
  PEASS_URL   https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/winPEAS/wi  yes       Path to the PEASS script. Accepted: http(s):// URL or absolute local path. Linpeas: https://raw.githubusercontent.com/carlospolop/PEASS-ng
              nPEASexe/binaries/Obfuscated%20Releases/winPEASany.exe                              /master/linPEAS/linpeas.sh
  SESSION                                                                               yes       The session to run this module on.
  SRVHOST                                                                               no        Set your metasploit instance IP if you want to download the PEASS script from here via http(s) instead of uploading it.
  SRVPORT     443                                                                       no        Port to download the PEASS script from using http(s) (only used if SRVHOST)
  SSL         true                                                                      no        Indicate if you want to communicate with https (only used if SRVHOST)
  SSLCert                                                                               no        Path to a custom SSL certificate (default is randomly generated)
  TEMP_DIR                                                                              no        Path to upload the obfuscated PEASS script inside the compromised machine. By default "C:\Windows\System32\spool\drivers\color" is used in
                                                                                                   Windows and "/tmp" in Unix.
  TIMEOUT     900                                                                       no        Timeout of the execution of the PEASS script (15min by default)
  URIPATH     /mvpo.txt                                                                 no        URI path to download the script from there (only used if SRVHOST)

Description:
  This module will launch the indicated PEASS (Privilege Escalation 
  Awesome Script Suite) script to enumerate the system. You need to 
  indicate the URL or local path to LinPEAS if you are in some Unix or 
  to WinPEAS if you are in Windows. By default this script will upload 
  the PEASS script to the host (encrypted and/or encoded) and will 
  load it and execute it. You can configure this module to download 
  the encrypted/encoded PEASS script from this metasploit instance via 
  HTTP instead of uploading it.

References:
  https://github.com/carlospolop/PEASS-ng
  https://www.youtube.com/watch?v=9_fJv_weLU0

The options are pretty self-explanatory.

Notice that by default the obfuscated PEASS script if going to be uploaded but if you set SRVHOST it will be downloaded via http(s) from the metasploit instance (so nothing will be written in the disk of the compromised host).

Notice that you can set parametes like -h in PARAMETERS and then linpeas/winpeas will just show the help (just like when you execute them from a console).

IMPORTANT: You won't see any output until the execution of the script is completed.