Path: blob/master/modules/post/windows/manage/driver_loader.rb
19718 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Post6include Msf::Post::File7include Msf::Post::Windows::Priv8include Msf::Post::Windows::Services9include Msf::Post::Windows::Error1011START_TYPE = {12'demand' => 'SERVICE_DEMAND_START',13'boot' => 'SERVICE_BOOT_START',14'auto' => 'SERVICE_AUTO_START',15'disabled' => 'SERVICE_DISABLED',16'system' => 'SERVICE_SYSTEM_START'17}1819ERROR_TYPE = {20'critical' => 'SERVICE_ERROR_CRITICAL',21'normal' => 'SERVICE_ERROR_NORMAL',22'severe' => 'SERVICE_ERROR_SEVERE',23'ignore' => 'SERVICE_ERROR_IGNORE'24}2526SERVICE_TYPE = {27'kernel' => 'SERVICE_KERNEL_DRIVER',28'file_system' => 'SERVICE_FILE_SYSTEM_DRIVER',29'adapter' => 'SERVICE_ADAPTER',30'recognizer' => 'SERVICE_RECOGNIZER_DRIVER'31}3233def initialize(info = {})34super(35update_info(36info,37'Name' => 'Windows Manage Driver Loader',38'Description' => %q{39This module loads a KMD (Kernel Mode Driver) using the Windows Service API.40},41'License' => MSF_LICENSE,42'Author' => 'Borja Merino <bmerinofe[at]gmail.com>',43'Platform' => 'win',44'SessionTypes' => [ 'meterpreter' ],45'Notes' => {46'Stability' => [CRASH_OS_DOWN],47'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES],48'Reliability' => []49}50)51)5253register_options(54[55OptString.new('DRIVER_PATH', [true, 'Driver path in %SYSTEMROOT%. Example: c:\\windows\\system32\\msf.sys']),56OptString.new('DRIVER_NAME', [false, 'Driver Name.']),57OptEnum.new('START_TYPE', [true, 'Start type.', 'auto', [ 'boot', 'system', 'auto', 'demand', 'disabled']]),58OptEnum.new('SERVICE_TYPE', [true, 'Service type.', 'kernel', [ 'kernel', 'file_system', 'adapter', 'recognizer']]),59OptEnum.new('ERROR_TYPE', [true, 'Error type.', 'ignore', [ 'ignore', 'normal', 'severe', 'critical']])60]61)62end6364def run65driver = datastore['DRIVER_PATH']66start = START_TYPE[datastore['START_TYPE']]67error = ERROR_TYPE[datastore['ERROR_TYPE']]68service = SERVICE_TYPE[datastore['SERVICE_TYPE']]6970name = datastore['DRIVER_NAME'].blank? ? Rex::Text.rand_text_alpha(6..13) : datastore['DRIVER_NAME']7172unless is_admin?73print_error("Administrator or better privileges needed. Try 'getsystem' first.")74return75end7677unless driver =~ Regexp.new(Regexp.escape(expand_path('%SYSTEMROOT%')), Regexp::IGNORECASE)78print_error('The driver must be inside %SYSTEMROOT%.')79return80end8182unless file_exist?(driver)83print_error("Driver #{driver} does not exist.")84return85end8687inst = install_driver(name, path: driver, starttype: start, error_control: error, service_type: service)8889if inst == Windows::Error::SUCCESS90ss = service_start(name)91case ss92when Windows::Error::SUCCESS93print_good('Driver loaded successfully.')94when Windows::Error::SERVICE_ALREADY_RUNNING95print_error('Service already started.')96when Windows::Error::SERVICE_DISABLED97print_error('Service disabled.')98else99print_error('There was an error starting the service.')100end101end102end103104def install_driver(name, opts = {})105rc = service_create(name, opts)106107if rc == Windows::Error::SUCCESS108print_status("Service object \"#{name}\" added to the Service Control Manager database.")109return true110end111112if rc == Windows::Error::SERVICE_EXISTS113print_error('The specified service already exists.')114# Show ImagePath just to know if the service corresponds to the desired driver.115service = service_info(name)116print_error("Path of driver file in \"#{name}\" service: #{service[:path]}.")117else118print_error("There was an error opening the driver handler. GetLastError=#{rc}.")119end120121return false122end123end124125126