WinRM Command Runner

2012-10-31T20:10:45
ID MSF:AUXILIARY/SCANNER/WINRM/WINRM_CMD
Type metasploit
Reporter Rapid7
Modified 2019-02-28T21:03:04

Description

This module runs arbitrary Windows commands using the WinRM Service

                                        
                                            ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/proto/ntlm/message'



class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::WinRM
  include Msf::Auxiliary::Report


  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'           => 'WinRM Command Runner',
      'Description'    => %q{
        This module runs arbitrary Windows commands using the WinRM Service
        },
      'Author'         => [ 'thelightcosine' ],
      'License'        => MSF_LICENSE
    )

    register_options(
      [
        OptString.new('CMD', [ true, "The windows command to run", "ipconfig /all" ]),
        OptString.new('USERNAME', [ true, "The username to authenticate as"]),
        OptString.new('PASSWORD', [ true, "The password to authenticate with"])
      ])
  end


  def run_host(ip)
    streams = winrm_run_cmd(datastore['CMD'])
    return unless streams.class == Hash
    print_error streams['stderr'] unless streams['stderr'] == ''
    print_good "#{peer}: #{streams['stdout']}"
    path = store_loot("winrm.cmd_results", "text/plain", ip, streams['stdout'], "winrm_cmd_results.txt", "WinRM CMD Results")
    print_good "Results saved to #{path}"
  end



end