pwn 0.4.333

data/lib/pwn/plugins/mail_agent.rb

@@ -0,0 +1,344 @@
+# frozen_string_literal: true
+
+module PWN
+  module Plugins
+    # This plugin is used for sending email from multiple mail agents such as
+    # corporate mail, yahoo, hotmail/live, and mail relays (spoofing).  Supports
+    # sending multiple file attachments and works pretty well.
+    module MailAgent
+      # Supported Method Parameters::
+      # parent_mail_agent(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   address: 'smtp server ip or domain',
+      #   port: 'smtp port',
+      #   tls_auto: true|false,
+      #   username: 'optional',
+      #   password: 'optional',
+      #   debug: true|false
+      # )
+      @@logger = PWN::Plugins::PWNLogger.create
+
+      private_class_method def self.parent_mail_agent(opts = {})
+        from = opts[:from]
+        to = opts[:to]
+        cc = opts[:cc]
+        bcc = opts[:bcc]
+        reply_to = opts[:reply_to]
+        subject = opts[:subject]
+        html_body = opts[:html_body]
+        txt_body = opts[:txt_body] # If HTML is NOT supported or desired
+        authentication = opts[:authentication]
+        attachments_hash = {}
+        opts[:attachments_hash]&.each do |attachment_name, attachment_path|
+          attachments_hash[attachment_name] = File.binread(attachment_path)
+        end
+
+        debug = opts[:debug]
+
+        address = opts[:address]
+        port = opts[:port]
+        tls_auto = opts[:tls_auto]
+        username = opts[:username]
+        password = if !username.nil? && opts[:password].nil?
+                     PWN::Plugins::AuthenticationHelper.mask_password
+                   else
+                     opts[:password]
+                   end
+
+        @@logger.info("DEBUG ENABLED: from: #{from.inspect}, to: #{to.inspect}, cc: #{cc.inspect}, bcc: #{bcc.inspect}, reply_to: #{reply_to} subject: #{subject.inspect}, html_body: #{html_body.inspect}, txt_body: #{txt_body.inspect}, attachments: #{attachments_hash.inspect}, address: #{address.inspect}, port: #{port.inspect}, username: #{username.inspect}, password: #{password.inspect} enable_starttls_auto: #{tls_auto.inspect}, authentication: #{authentication.inspect}") if debug == true
+        # The :body symbol below is known to be problematic until the author of pony fixes it.  better to use :html_body symbol
+        PWN::Plugins::Pony.mail(
+          from: from,
+          to: to,
+          cc: cc,
+          bcc: bcc,
+          reply_to: reply_to,
+          subject: subject,
+          html_body: html_body,
+          body: txt_body,
+          attachments: attachments_hash,
+          via: :smtp,
+          via_options: {
+            address: address,
+            port: port,
+            enable_starttls_auto: tls_auto,
+            user_name: username,
+            password: password,
+            authentication: authentication.to_sym,
+            domain: 'localhost.localdomain'
+          }
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.office365(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required username',
+      #   password: 'optional (but will be prompted if not submitted)',
+      #   debug: true|false
+      # )
+
+      public_class_method def self.office365(opts = {})
+        # Send mail from corporate mail solution
+        opts[:address] = 'smtp.office365.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :login
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.gmail(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required',
+      #   password: 'optional (but will be prompted if not submitted)'
+      #   debug: true|false
+      # )
+
+      public_class_method def self.gmail(opts = {})
+        opts[:address] = 'smtp.gmail.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :plain
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.hotmail_n_live(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required',
+      #   password: 'optional (but will be prompted if not submitted)'
+      #   debug: true|false
+      # )
+
+      public_class_method def self.hotmail_n_live(opts = {})
+        opts[:address] = 'smtp.live.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :plain
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.yahoo(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required',
+      #   password: 'optional (but will be prompted if not submitted)'
+      #   debug: true|false
+      # )
+
+      public_class_method def self.yahoo(opts = {})
+        opts[:address] = 'smtp.mail.yahoo.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :plain
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.manual(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   address: 'smtp server ip or domain',
+      #   port: 'smtp port',
+      #   tls_auto: true|false,
+      #   username: 'optional',
+      #   password: 'optional',
+      #   debug: true|false
+      # )
+
+      public_class_method def self.manual(opts = {})
+        # Spoof mail from known relay
+        opts[:authentication] = :plain if opts[:authentication].nil?
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: Jacob Hoopes <jake.hoopes@gmail.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          Jacob Hoopes <jake.hoopes@gmail.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          #{self}.office365(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required domain\\username',
+            password: 'optional (but will be prompted if not submitted)',
+            debug: true|false
+          )
+
+          #{self}.gmail(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required',
+            password: 'optional (but will be prompted if not submitted)'
+            debug: true|false
+          )
+
+          #{self}.hotmail_n_live(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required',
+            password: 'optional (but will be prompted if not submitted)'
+            debug: true|false
+          )
+
+          #{self}.yahoo(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required',
+            password: 'optional (but will be prompted if not submitted)'
+            debug: true|false
+          )
+
+          #{self}.manual(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            address: 'smtp server ip or domain',
+            port: 'smtp port',
+            tls_auto: true|false,
+            authentication: 'optional defaults to :plain - available :login, :plain, or :cram_md5',
+            username: 'optional',
+            password: 'optional',
+            debug: true|false
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/plugins/metasploit.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require 'msfrpc-client'
+require 'yaml'
+require 'json'
+
+module PWN
+  module Plugins
+    # Plugin used to integrate Metasploit into PWN leveraging a listening MSFRPCD daemon.
+    module Metasploit
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.connect(
+      #   yaml_conf: 'optional -  path to userland yaml (defaults to /pwn/etc/userland/PWN_PROVIDEDR/metasploit/vagrant.yaml)'
+      # )
+
+      public_class_method def self.connect(opts = {})
+        if opts[:yaml_conf] && File.exist?(opts[:yaml_conf])
+          yaml_conf = YAML.load_file(opts[:yaml_conf].to_s.strip.chomp.scrub)
+        else
+          pwn_root = ENV['PWN_ROOT'] if ENV['PWN_ROOT']
+          pwn_provider = ENV['PWN_PROVIDER'] if ENV['PWN_PROVIDER']
+          yaml_conf = YAML.load_file("#{pwn_root}/etc/userland/#{pwn_provider}/metasploit/vagrant.yaml")
+        end
+
+        msfrpcd_host = yaml_conf['msfrpcd_host'].to_s
+        port = yaml_conf['port'].to_i
+        username = yaml_conf['username'].to_s
+        password = yaml_conf['password'].to_s
+
+        msfrpcd_conn = Msf::RPC::Client.new
+        msfrpcd_conn.info[:host] = msfrpcd_host
+        msfrpcd_conn.info[:port] = port
+        msfrpcd_conn.login(username, password)
+
+        console_obj = {}
+        console_obj[:msfrpcd_conn] = msfrpcd_conn
+        msfrpcd_resp = msfrpcd_conn.call('console.create')
+        session = JSON.parse(msfrpcd_resp.to_json, symbolize_names: true)
+        console_obj[:session] = session
+
+        console_obj
+      rescue StandardError => e
+        raise "#{e}\nIs the msfrpcd daemon running on #{msfrpcd_host}?"
+      end
+
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.queue_console_cmd(
+      #   console_obj: 'required - console_obj object returned from #connect method',
+      #   cmd: 'required - msfconsole command string or array of strings'
+      # )
+      private_class_method def self.queue_console_cmd(opts = {})
+        console_obj = opts[:console_obj]
+        cmd = opts[:cmd].to_s.strip.chomp.scrub
+
+        msfrpcd_conn = console_obj[:msfrpcd_conn]
+        console_obj[:last_cmd] = cmd
+        console_id = console_obj[:session][:id]
+        msfrpcd_conn.call('console.read', console_id)
+        msfrpcd_conn.call('console.write', console_id, "#{cmd}\n")
+
+        loop do
+          sleep(1)
+          msfrpcd_resp = msfrpcd_conn.call('console.read', console_id)
+          next unless msfrpcd_resp.instance_of?(Hash)
+
+          last_cmd_result = JSON.parse(msfrpcd_resp.to_json, symbolize_names: true)
+          console_obj[:last_cmd_result] = last_cmd_result
+
+          if console_obj[:last_cmd_result][:busy] == true
+            print '.'
+            next
+          end
+          puts "\n#{console_obj[:last_cmd_result][:data]}" unless console_obj[:last_cmd_result][:data].nil?
+          break
+        end
+
+        console_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.console_exec(
+      #   console_obj: 'required - console_obj object returned from #connect method',
+      #   cmd: 'required - msfconsole command string or array of strings'
+      # )
+      public_class_method def self.console_exec(opts = {})
+        console_obj = opts[:console_obj]
+        cmd = opts[:cmd]
+
+        case cmd
+        when String
+          console_obj = queue_console_cmd(console_obj: console_obj, cmd: cmd)
+        when Array
+          cmd.each { |this_cmd| console_obj = queue_console_cmd(console_obj: console_obj, cmd: this_cmd) }
+        else
+          raise "ERROR: cmd parameter must be a String or Array object - object is currently #{cmd.class}"
+        end
+
+        console_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.disconnect(
+      #   console_obj: 'required - console_obj returned from #console_exec method to terminate'
+      # )
+      public_class_method def self.disconnect(opts = {})
+        console_obj = opts[:console_obj]
+        msfrpcd_conn = console_obj[:msfrpcd_conn]
+        console_id = console_obj[:session][:id]
+        msfrpcd_conn.call('console.destroy', console_id)
+        msfrpcd_conn.call('auth.logout', msfrpcd_conn.token)
+
+        console_obj = nil
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: Jacob Hoopes <jake.hoopes@gmail.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          Jacob Hoopes <jake.hoopes@gmail.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          console_obj = #{self}.connect(
+            yaml_conf: 'optional -  path to userland yaml (defaults to $PWN_ROOT/etc/userland/$PWN_PROVIDER/metasploit/vagrant.yaml)'
+          )
+
+          console_obj = #{self}.console_exec(
+            console_obj: 'required - msfrpcd_conn object returned from #connect method',
+            cmd: 'required - msfconsole command string or array of strings'
+          )
+
+          console_obj = #{self}.disconnect(
+            console_obj: 'required - msfrpcd_conn object returned from #connect method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end