1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7

8
  # Exploit mixins should be called first
9
  include Msf::Exploit::Remote::SMB::Client
10
  include Msf::Exploit::Remote::SMB::Client::Authenticated
11
  include Msf::Exploit::Remote::SMB::Client::LocalPaths
12
  include Msf::Exploit::Remote::SMB::Client::RemotePaths
13
  include Msf::Auxiliary::Report
14
  include Msf::Auxiliary::Scanner
15
  include Msf::OptionalSession::SMB
16

17
  def initialize
18
    super(
19
      'Name' => 'SMB File Upload Utility',
20
      'Description' => %(
21
        This module uploads a file to a target share and path. The only reason
22
      to use this module is if your existing SMB client is not able to support the features
23
      of the Metasploit Framework that you need, like pass-the-hash authentication.
24
      ),
25
      'Author' => [
26
        'hdm' # metasploit module
27
      ],
28
      'References' => [
29
      ],
30
      'License' => MSF_LICENSE,
31
      'Notes' => {
32
        'Stability' => [CRASH_SAFE],
33
        'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK],
34
        'Reliability' => []
35
      }
36
    )
37

38
    register_options([
39
      OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$'])
40
    ])
41
  end
42

43
  def run_host(_ip)
44
    validate_lpaths!
45
    validate_rpaths!
46
    begin
47
      if session
48
        print_status("Using existing session #{session.sid}")
49
        self.simple = session.simple_client
50
      else
51
        vprint_status('Connecting to the server...')
52
        connect
53
        smb_login
54
      end
55

56
      vprint_status("Mounting the remote share \\\\#{simple.address}\\#{datastore['SMBSHARE']}'...")
57
      simple.connect("\\\\#{simple.address}\\#{datastore['SMBSHARE']}")
58

59
      remote_path = remote_paths.first
60

61
      if local_paths.nil?
62
        print_error('Local paths not specified')
63
        return
64
      end
65

66
      local_paths.each do |local_path|
67
        vprint_status("Trying to upload #{local_path} to #{remote_path}...")
68

69
        fd = simple.open(remote_path.to_s, 'wct', write: true)
70
        data = ::File.read(datastore['LPATH'], ::File.size(datastore['LPATH']), mode: 'rb')
71
        fd.write(data)
72
        fd.close
73

74
        print_good("#{local_path} uploaded to #{remote_path}")
75
      rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
76
        elog("Unable to upload #{local_path} to #{remote_path}", error: e)
77
        print_error("Unable to upload #{local_path} to #{remote_path} : #{e.message}")
78
      end
79
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
80
      elog('Unable to login:', error: e)
81
      print_error("Unable to login: #{e.message}")
82
    end
83
  end
84
end
85

86