mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-11-12 11:52:01 +01:00
307 lines
10 KiB
Ruby
307 lines
10 KiB
Ruby
#Meterpreter script for detecting if target host is a Virtual Machine
|
|
#Provided by Carlos Perez at carlos_perez[at]darkoperator.com
|
|
#Verion: 0.2.0
|
|
session = client
|
|
#Function for detecting if it is a Hyper-V VM
|
|
def hypervchk(session)
|
|
begin
|
|
vm = false
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SOFTWARE\Microsoft', KEY_READ)
|
|
sfmsvals = key.enum_key
|
|
if sfmsvals.include?("Hyper-V")
|
|
print_status("This is a Hyper-V Virtual Machine")
|
|
vm = true
|
|
elsif sfmsvals.include?("VirtualMachine")
|
|
print_status("This is a Hyper-V Virtual Machine")
|
|
vm = true
|
|
end
|
|
key.close
|
|
rescue
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SYSTEM\ControlSet001\Services', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("vmicheartbeat")
|
|
print_status("This is a Hyper-V Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("vmicvss")
|
|
print_status("This is a Hyper-V Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("vmicshutdown")
|
|
print_status("This is a Hyper-V Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("vmicexchange")
|
|
print_status("This is a Hyper-V Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
|
|
end
|
|
return vm
|
|
end
|
|
#Function for checking if it is a VMware VM
|
|
def vmwarechk(session)
|
|
vm = false
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SYSTEM\ControlSet001\Services', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("vmci")
|
|
print_status("This is a VMware Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("vmdebug")
|
|
print_status("This is a VMware Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("vmmouse")
|
|
print_status("This is a VMware Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("VMTools")
|
|
print_status("This is a VMware Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("VMMEMCTL")
|
|
print_status("This is a VMware Virtual Machine")
|
|
vm = true
|
|
end
|
|
key.close
|
|
rescue
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0')
|
|
if key.query_value('Identifier').data.downcase =~ /vmware/
|
|
print_status("This is a VMware Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
vmwareprocs = [
|
|
"vmwareuser.exe",
|
|
"vmwaretray.exe"
|
|
]
|
|
vmwareprocs.each do |p|
|
|
session.sys.process.get_processes().each do |x|
|
|
if p == (x['name'].downcase)
|
|
print_status("This is a VMware Virtual Machine") if not vm
|
|
vm = true
|
|
end
|
|
end
|
|
end
|
|
end
|
|
key.close
|
|
return vm
|
|
|
|
end
|
|
#Function for checking if it is a Virtual PC VM
|
|
def checkvrtlpc(session)
|
|
vm = false
|
|
vpcprocs = [
|
|
"vmusrvc.exe",
|
|
"vmsrvc.exe"
|
|
]
|
|
vpcprocs.each do |p|
|
|
session.sys.process.get_processes().each do |x|
|
|
if p == (x['name'].downcase)
|
|
print_status("This is a VirtualPC Virtual Machine") if not vm
|
|
vm = true
|
|
end
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SYSTEM\ControlSet001\Services', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("vpcbus")
|
|
print_status("This is a VirtualPC Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("vpc-s3")
|
|
print_status("This is a VirtualPC Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("vpcuhub")
|
|
print_status("This is a VirtualPC Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("msvmmouf")
|
|
print_status("This is a VirtualPC Virtual Machine")
|
|
vm = true
|
|
end
|
|
key.close
|
|
rescue
|
|
end
|
|
end
|
|
return vm
|
|
end
|
|
|
|
def vboxchk(session)
|
|
vm = false
|
|
vboxprocs = [
|
|
"vboxservice.exe",
|
|
"vboxtray.exe"
|
|
]
|
|
vboxprocs.each do |p|
|
|
session.sys.process.get_processes().each do |x|
|
|
if p == (x['name'].downcase)
|
|
print_status("This is a Sun VirtualBox Virtual Machine") if not vm
|
|
vm = true
|
|
end
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\ACPI\DSDT', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("VBOX__")
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\ACPI\FADT', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("VBOX__")
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\ACPI\RSDT', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("VBOX__")
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0')
|
|
if key.query_value('Identifier').data.downcase =~ /vbox/
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\DESCRIPTION\System')
|
|
if key.query_value('SystemBiosVersion').data.downcase =~ /vbox/
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SYSTEM\ControlSet001\Services', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("VBoxMouse")
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("VBoxGuest")
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("VBoxService")
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("VBoxSF")
|
|
print_status("This is a Sun VirtualBox Virtual Machine")
|
|
vm = true
|
|
end
|
|
key.close
|
|
rescue
|
|
end
|
|
end
|
|
return vm
|
|
end
|
|
|
|
def xenchk(session)
|
|
vm = false
|
|
xenprocs = [
|
|
"xenservice.exe"
|
|
]
|
|
xenprocs.each do |p|
|
|
session.sys.process.get_processes().each do |x|
|
|
if p == (x['name'].downcase)
|
|
print_status("This is a Xen Virtual Machine") if not vm
|
|
vm = true
|
|
end
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\ACPI\DSDT', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("Xen")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\ACPI\FADT', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("Xen")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'HARDWARE\ACPI\RSDT', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("Xen")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
end
|
|
rescue
|
|
end
|
|
end
|
|
if not vm
|
|
begin
|
|
key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, 'SYSTEM\ControlSet001\Services', KEY_READ)
|
|
srvvals = key.enum_key
|
|
if srvvals.include?("xenevtchn")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("xennet")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("xennet6")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("xensvc")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
elsif srvvals.include?("xenvdb")
|
|
print_status("This is a Xen Virtual Machine")
|
|
vm = true
|
|
end
|
|
key.close
|
|
rescue
|
|
end
|
|
end
|
|
return vm
|
|
end
|
|
print_status("Checking if target is a Virtual Machine .....")
|
|
found = hypervchk(session)
|
|
found = vmwarechk(session) if not found
|
|
found = checkvrtlpc(session) if not found
|
|
found = vboxchk(session) if not found
|
|
found = xenchk(session) if not found
|
|
print_status("It appears to be phisical host.") if not found
|
|
|