1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7

8
  # Exploit mixins should be called first
9
  include Msf::Exploit::Remote::SMB::Client
10
  include Msf::Exploit::Remote::SMB::Client::Authenticated
11
  include Msf::Exploit::Remote::SMB::Client::RemotePaths
12
  include Msf::Auxiliary::Report
13
  include Msf::Auxiliary::Scanner
14
  include Msf::OptionalSession::SMB
15

16
  # Aliases for common classes
17
  SIMPLE = Rex::Proto::SMB::SimpleClient
18
  XCEPT = Rex::Proto::SMB::Exceptions
19
  CONST = Rex::Proto::SMB::Constants
20

21
  def initialize
22
    super(
23
      'Name' => 'SMB File Delete Utility',
24
      'Description' => %(
25
        This module deletes a file from a target share and path. The usual reason
26
      to use this module is to work around limitations in an existing SMB client that may not
27
      be able to take advantage of pass-the-hash style authentication.
28
      ),
29
      'Author' => [
30
        'mubix' # copied from hdm upload_file module
31
      ],
32
      'License' => MSF_LICENSE,
33
      'Notes' => {
34
        'Stability' => [OS_RESOURCE_LOSS],
35
        'SideEffects' => [],
36
        'Reliability' => []
37
      }
38
      )
39

40
    register_options([
41
      OptString.new('SMBSHARE', [true, 'The name of a share on the RHOST', 'C$'])
42
    ])
43
  end
44

45
  def smb_delete_files
46
    if session
47
      print_status("Using existing session #{session.sid}")
48
      self.simple = session.simple_client
49
    else
50
      vprint_status('Connecting to the server...')
51
      connect
52
      smb_login
53
    end
54

55
    vprint_status("Mounting the remote share \\\\#{simple.address}\\#{datastore['SMBSHARE']}'...")
56
    simple.connect("\\\\#{simple.address}\\#{datastore['SMBSHARE']}")
57

58
    remote_paths.each do |remote_path|
59
      simple.delete("\\#{remote_path}")
60

61
      # If there's no exception raised at this point, we assume the file has been removed.
62
      print_good("Deleted: #{remote_path}")
63
    rescue Rex::Proto::SMB::Exceptions::ErrorCode, RubySMB::Error::RubySMBError => e
64
      elog("Cannot delete #{remote_path}:", error: e)
65
      print_error("Cannot delete #{remote_path}: #{e.message}")
66
    end
67
  end
68

69
  def run_host(_ip)
70
    validate_rpaths!
71

72
    begin
73
      smb_delete_files
74
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
75
      elog('Unable to login', error: e)
76
      print_error("Unable to login: #{e.message}")
77
    end
78
  end
79
end
80

81