Massively improve windows' vm fingerprinting module by jvoisin · Pull Request #18140 · rapid7/metasploit-framework

jvoisin · 2023-06-24T15:55:53Z

The following resources were used:

modules/post/windows/gather/checkvm.rb

cdelafuente-r7

Thanks @jvoisin for improving this module. I left some comments and suggestions for you to review when you get a chance.

modules/post/windows/gather/checkvm.rb

cdelafuente-r7 · 2023-06-26T13:55:06Z

modules/post/windows/gather/checkvm.rb

    return true if registry_getvaldata('HKLM\HARDWARE\DESCRIPTION\System\BIOS', 'SystemManufacturer') =~ /vmware/i
    return true if registry_getvaldata('HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0', 'Identifier') =~ /vmware/i
+    return true if registry_getvaldata('HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0', 'Identifier') =~ /vmware/i
+    return true if registry_getvaldata('HKLM\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000', 'DriverDesc') =~ /cl_vmx_svga/i


I checked this with Windows 11 on VMware Fusion 12.2.5 and the value of the is registry key is VMware SVGA 3D. Should this value also be checked?

cdelafuente-r7 · 2023-06-26T14:17:24Z

modules/post/windows/gather/checkvm.rb

    return true if registry_getvaldata('HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0', 'Identifier') =~ /vmware/i
+    return true if registry_getvaldata('HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0', 'Identifier') =~ /vmware/i
+    return true if registry_getvaldata('HKLM\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000', 'DriverDesc') =~ /cl_vmx_svga/i
+    return true if registry_getvaldata('HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'DisplayName') =~ /vmware tools/i


This registry key looks weird to me. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall usually includes sub-keys for each installed software. VMware Tools seems to be in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1FF5D624-5515-4343-837A-E54C101573E6} on my environment.

cdelafuente-r7 · 2023-06-26T15:33:49Z

modules/post/windows/gather/checkvm.rb

+          module supports detection of JoeSandbox, Hyper-V, VMWare, Virtual PC,
+          VirtualBox, Xen, MicrosoftSandbox, Parallels, Bochs and QEMU.
        },
        'License' => MSF_LICENSE,


That would be interesting to also add a References key with the links you mentioned in this PR's description:

https://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf
https://www.heise.de/security/downloads/07/1/1/8/3/5/5/9/vmde.pdf
https://evasions.checkpoint.com/
In particular https://evasions.checkpoint.com/techniques/registry.html

cdelafuente-r7 · 2023-06-26T17:36:32Z

modules/post/windows/gather/checkvm.rb

+
    %w[HKLM\HARDWARE\ACPI\DSDT HKLM\HARDWARE\ACPI\FADT HKLM\HARDWARE\ACPI\RSDT].each do |key|
      srvvals = registry_enumkeys(key)
      return true if srvvals && srvvals.include?('BOCHS_')


If I understand it correctly, this check is now exclusively for bochs emulation software. It has been removed from qemu detection logic. Is there a specific reason for this?

According to the documentation, qemu also uses some bochs components.

QEMU uses the PC BIOS from the Seabios project and the Plex86/Bochs LGPL VGA BIOS.

cdelafuente-r7 · 2023-06-27T12:41:45Z

modules/post/windows/gather/checkvm.rb

  include Msf::Post::Windows::Process
  include Msf::Post::Windows::Registry
+  include Msf::Post::Windows::UserProfiles
+  include Msf::Post::Windows::WMIC


This mixin brings the SMB* options to authenticate. Since it is a local connection, they should not be used. I would recommend deregistering these options:

deregister_options('SMBUser', 'SMBPass', 'SMBDomain')

modules/post/windows/gather/checkvm.rb

cdelafuente-r7 · 2023-06-27T13:17:20Z

modules/post/windows/gather/checkvm.rb

    key_path = 'HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0'
    return true if registry_getvaldata(key_path, 'ProcessorNameString') =~ /qemu/i

+    return true if registry_getvaldata('HKLM\HARDWARE\DESCRIPTION\System', 'SystemBiosVersion') =~ /qemu/i


HKLM\HARDWARE\DESCRIPTION\System\SystemBiosVersion is a Multi String value and this call returns an array of characters:

[4] pry(#<Msf::Modules::Post__Windows__Gather__Checkvm::MetasploitModule>)> registry_getvaldata('HKLM\HARDWARE\DESCRIPTION\System', 'SystemBiosVersion') => ["I", "N", "T", "E", "L", " ", " ", "-", ...

So, this regex won't work. Maybe this would be enough to fix it (not tested):

Suggested change

return true if registry_getvaldata('HKLM\HARDWARE\DESCRIPTION\System', 'SystemBiosVersion') =~ /qemu/i

return true if registry_getvaldata('HKLM\HARDWARE\DESCRIPTION\System', 'SystemBiosVersion').join =~ /qemu/i

I also noticed this issue in many times in this file and they should also be fixed.

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

bwatters-r7 · 2023-06-29T13:45:04Z

modules/post/windows/gather/checkvm.rb

+  def get_computer_model
+    wmic_query('computersystem get model')
+  end


Suggested change

def get_computer_model

wmic_query('computersystem get model')

end

def get_computer_model

@get_computer_model ||= wmic_query('computersystem get model')

end

This prevents us from executing the command multiple times- same for the other data retrieval methods below.

jvoisin · 2023-07-08T18:03:31Z

I'll re-open smaller PR.

jvoisin · 2023-07-11T19:15:29Z

Superseeded by #18179

Massively improve windows' vm fingerprinting module

b400f91

h00die reviewed Jun 24, 2023

View reviewed changes

modules/post/windows/gather/checkvm.rb Outdated Show resolved Hide resolved

Fix a typo

15c67cb

cdelafuente-r7 self-assigned this Jun 26, 2023

cdelafuente-r7 requested changes Jun 27, 2023

View reviewed changes

jvoisin and others added 6 commits June 27, 2023 16:15

Update modules/post/windows/gather/checkvm.rb

e334a89

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

Update modules/post/windows/gather/checkvm.rb

a64f7b1

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

Update modules/post/windows/gather/checkvm.rb

225cc3c

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

Update modules/post/windows/gather/checkvm.rb

dc5238f

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

Update modules/post/windows/gather/checkvm.rb

5b7ee9e

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

Update modules/post/windows/gather/checkvm.rb

053cebe

Co-authored-by: Christophe De La Fuente <56716719+cdelafuente-r7@users.noreply.github.com>

bwatters-r7 reviewed Jun 29, 2023

View reviewed changes

bwatters-r7 mentioned this pull request Jun 29, 2023

modules/post/windows/gather/checkvm.rb improvement suggestions #18149

Open

jvoisin closed this Jul 8, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Massively improve windows' vm fingerprinting module#18140

Massively improve windows' vm fingerprinting module#18140
jvoisin wants to merge 8 commits intorapid7:masterfrom
jvoisin:improve_vm_detection

jvoisin commented Jun 24, 2023

Uh oh!

Uh oh!

cdelafuente-r7 left a comment

Uh oh!

Uh oh!

cdelafuente-r7 Jun 26, 2023

Uh oh!

cdelafuente-r7 Jun 26, 2023

Uh oh!

cdelafuente-r7 Jun 26, 2023

Uh oh!

cdelafuente-r7 Jun 26, 2023

Uh oh!

cdelafuente-r7 Jun 27, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cdelafuente-r7 Jun 27, 2023

Uh oh!

bwatters-r7 Jun 29, 2023

Uh oh!

jvoisin commented Jul 8, 2023

Uh oh!

jvoisin commented Jul 11, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	return true if registry_getvaldata('HKLM\HARDWARE\DESCRIPTION\System', 'SystemBiosVersion') =~ /qemu/i
	return true if registry_getvaldata('HKLM\HARDWARE\DESCRIPTION\System', 'SystemBiosVersion').join =~ /qemu/i

Conversation

jvoisin commented Jun 24, 2023

Uh oh!

Uh oh!

cdelafuente-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cdelafuente-r7 Jun 26, 2023

Choose a reason for hiding this comment

Uh oh!

cdelafuente-r7 Jun 26, 2023

Choose a reason for hiding this comment

Uh oh!

cdelafuente-r7 Jun 26, 2023

Choose a reason for hiding this comment

Uh oh!

cdelafuente-r7 Jun 26, 2023

Choose a reason for hiding this comment

Uh oh!

cdelafuente-r7 Jun 27, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cdelafuente-r7 Jun 27, 2023

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Jun 29, 2023

Choose a reason for hiding this comment

Uh oh!

jvoisin commented Jul 8, 2023

Uh oh!

jvoisin commented Jul 11, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants