1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7

8
  # Exploit mixins should be called first
9
  include Msf::Exploit::Remote::SMB::Client
10
  include Msf::Exploit::Remote::SMB::Client::Authenticated
11
  include Msf::Exploit::Remote::SMB::Client::LocalPaths
12
  include Msf::Exploit::Remote::SMB::Client::RemotePaths
13
  include Msf::Auxiliary::Report
14
  include Msf::Auxiliary::Scanner
15
  include Msf::OptionalSession::SMB
16

17
  def initialize
18
    super(
19
      'Name' => 'SMB File Upload Utility',
20
      'Description' => %(
21
        This module uploads a file to a target share and path. The only reason
22
      to use this module is if your existing SMB client is not able to support the features
23
      of the Metasploit Framework that you need, like pass-the-hash authentication.
24
      ),
25
      'Author' => [
26
        'hdm' # metasploit module
27
      ],
28
      'References' => [
29
        [ 'ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES ]
30
      ],
31
      'License' => MSF_LICENSE,
32
      'Notes' => {
33
        'Stability' => [CRASH_SAFE],
34
        'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK],
35
        'Reliability' => []
36
      }
37
    )
38

39
    register_options([
40
      OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$'])
41
    ])
42
  end
43

44
  def run_host(_ip)
45
    validate_lpaths!
46
    validate_rpaths!
47
    begin
48
      if session
49
        print_status("Using existing session #{session.sid}")
50
        self.simple = session.simple_client
51
      else
52
        vprint_status('Connecting to the server...')
53
        connect
54
        smb_login
55
      end
56

57
      vprint_status("Mounting the remote share \\\\#{simple.address}\\#{datastore['SMBSHARE']}'...")
58
      simple.connect("\\\\#{simple.address}\\#{datastore['SMBSHARE']}")
59

60
      remote_path = remote_paths.first
61

62
      if local_paths.nil?
63
        print_error('Local paths not specified')
64
        return
65
      end
66

67
      local_paths.each do |local_path|
68
        vprint_status("Trying to upload #{local_path} to #{remote_path}...")
69

70
        fd = simple.open(remote_path.to_s, 'wct', write: true)
71
        data = ::File.read(datastore['LPATH'], ::File.size(datastore['LPATH']), mode: 'rb')
72
        fd.write(data)
73
        fd.close
74

75
        print_good("#{local_path} uploaded to #{remote_path}")
76
      rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
77
        elog("Unable to upload #{local_path} to #{remote_path}", error: e)
78
        print_error("Unable to upload #{local_path} to #{remote_path} : #{e.message}")
79
      end
80
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
81
      elog('Unable to login:', error: e)
82
      print_error("Unable to login: #{e.message}")
83
    end
84
  end
85
end
86

87