1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  def initialize(info = {})
8
    super(
9
      update_info(
10
        info,
11
        'Name' => 'Write Messages to Users',
12
        'Description' => %q{
13
          This module utilizes the wall(1) or write(1) utilities, as appropriate,
14
          to send messages to users on the target system.
15
        },
16
        'License' => MSF_LICENSE,
17
        'Author' => [
18
          'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module
19
        ],
20
        # TODO: is there a way to do this on Windows?
21
        'Platform' => %w[linux osx unix],
22
        'SessionTypes' => %w[shell meterpreter],
23
        'Notes' => {
24
          'Stability' => [CRASH_SAFE],
25
          'SideEffects' => [SCREEN_EFFECTS],
26
          'Reliability' => []
27
        }
28
      )
29
    )
30
    register_options(
31
      [
32
        OptString.new('MESSAGE', [false, 'The message to send', '']),
33
        OptString.new('USERS', [
34
          false,
35
          'List of users to write(1) to, separated by commas. wall(1)s to all users by default.'
36
        ]),
37
        OptBool.new('COWSAY', [true, 'Display MESSAGE in a ~cowsay way', false])
38
      ]
39
    )
40
  end
41

42
  def users
43
    datastore['USERS'] ? datastore['USERS'].split(/\s*,\s*/) : nil
44
  end
45

46
  def message
47
    if datastore['MESSAGE'].blank?
48
      text = "Hello from a metasploit session at #{Time.now}"
49
    else
50
      text = datastore['MESSAGE']
51
    end
52

53
    datastore['COWSAY'] ? Rex::Text.cowsay(text) : text
54
  end
55

56
  def run
57
    if users
58
      # this requires that the target user has write turned on
59
      users.map { |user| cmd_exec("echo '#{message}' | write #{user}") }
60
    else
61
      # this will send the messages to all users, regardless of whether or
62
      # not they have write turned on.  If the session is root, the -n will disable
63
      # the annoying banner
64
      cmd_exec("echo '#{message}' | wall -n")
65
    end
66
  end
67
end
68

69