1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Windows::Registry
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Multi Manage Set Wallpaper',
15
        'Description' => %q{
16
          This module will set the desktop wallpaper background on the specified session.
17
          The method of setting the wallpaper depends on the platform type.
18
        },
19
        'License' => MSF_LICENSE,
20
        'Author' => [ 'timwr'],
21
        'Platform' => [ 'win', 'osx', 'linux', 'android' ],
22
        'SessionTypes' => [ 'meterpreter' ],
23
        'Compat' => {
24
          'Meterpreter' => {
25
            'Commands' => %w[
26
              android_*
27
              stdapi_railgun_api
28
            ]
29
          }
30
        },
31
        'Notes' => {
32
          'Stability' => [CRASH_SAFE],
33
          'SideEffects' => [SCREEN_EFFECTS],
34
          'Reliability' => []
35
        }
36
      )
37
    )
38

39
    register_options(
40
      [
41
        OptPath.new('WALLPAPER_FILE', [true, 'The local wallpaper file to set on the remote session'])
42
      ]
43
    )
44
  end
45

46
  def upload_wallpaper(tempdir, file)
47
    remote_file = "#{tempdir}#{File.basename(file)}"
48
    print_status("#{peer} - Uploading to #{remote_file}")
49

50
    write_file(remote_file, File.binread(file))
51
    print_status("#{peer} - Uploaded to #{remote_file}")
52
    remote_file
53
  end
54

55
  #
56
  # The OS X version uses an AppleScript to do this
57
  #
58
  def osx_set_wallpaper(file)
59
    remote_file = upload_wallpaper('/tmp/', file)
60
    script = %(osascript -e 'tell application "Finder" to set desktop picture to POSIX file "#{remote_file}"')
61
    begin
62
      cmd_exec(script)
63
    rescue EOFError
64
      return false
65
    end
66
    true
67
  end
68

69
  #
70
  # The Windows version uses the SystemParametersInfo call
71
  #
72
  def win_set_wallpaper(file)
73
    remote_file = upload_wallpaper('%TEMP%\\', file)
74
    client.railgun.user32.SystemParametersInfoA(0x0014, nil, remote_file, 0x2) != 0
75
  end
76

77
  #
78
  # The Android version uses the set_wallpaper command
79
  #
80
  def android_set_wallpaper(file)
81
    client.android.set_wallpaper(File.binread(file))
82
    true
83
  end
84

85
  def os_set_wallpaper(file)
86
    case session.platform
87
    when 'osx'
88
      osx_set_wallpaper(file)
89
    when 'windows'
90
      win_set_wallpaper(file)
91
    when 'android'
92
      android_set_wallpaper(file)
93
    end
94
  end
95

96
  def run
97
    file = datastore['WALLPAPER_FILE']
98
    if os_set_wallpaper(file)
99
      print_good("#{peer} - The wallpaper has been set")
100
    else
101
      print_error("#{peer} - Unable to set the wallpaper")
102
    end
103
  end
104
end
105

106