Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added auxiliary/scanner/winrm docs #11437

Merged
merged 2 commits into from Feb 19, 2019
Merged

Added auxiliary/scanner/winrm docs #11437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6916b56
Added auxiliary/scanner/winrm docs
Yashvendra Feb 19, 2019
806ba2c
Update documentation/modules/auxiliary/scanner/winrm/winrm_auth_metho…
bcoles Feb 19, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
23 changes: 23 additions & 0 deletions documentation/modules/auxiliary/scanner/winrm/winrm_auth_methods.md
View file
Open in desktop
@@ -0,0 +1,23 @@
## Description
This module sends a request to an HTTP/HTTPS service to see if it is a WinRM service. If it is a WinRM service, it also gathers the Authentication Methods supported.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this on by default, did you have to set anything to enable it to be vulnerable?

## Verification Steps

1. Do: ```use auxiliary/scanner/winrm/winrm_auth_methods```
2. Do: ```set RHOSTS [IP]```
3. Do: ```run```

## Scenarios

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

### Windows ????

```
msf > use auxiliary/scanner/winrm/winrm_auth_methods
msf auxiliary(scanner/winrm/winrm_auth_methods) > set RHOSTS 1.1.1.10
RHOSTS => 1.1.1.10
msf auxiliary(scanner/winrm/winrm_auth_methods) > run

[+] 1.1.1.10:5985: Negotiate protocol supported
[+] 1.1.1.10:5985: Basic protocol supported
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/winrm/winrm_auth_methods) >
```
34 changes: 34 additions & 0 deletions documentation/modules/auxiliary/scanner/winrm/winrm_cmd.md
View file
Open in desktop
@@ -0,0 +1,34 @@
## Description
This module runs arbitrary Windows commands using the WinRM Service. It needs login credentials to do so.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needs valid login credentials to do so.

I'd also ask what auth/group level they need to be. Local admin, domain admin, guest account?


## Verification Steps

1. Do: ```use auxiliary/scanner/winrm/winrm_cmd```
2. Do: ```set CMD [WINDOWS COMMAND]```
3. Do: ```set RHOSTS [IP]```
4. Do: ```set USERNAME [USERNAME]```
5. Do: ```set PASSWORD [PASSWORD]```
6. Do: ```run```

## Scenarios

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

### Windows ????

```
msf > use auxiliary/scanner/winrm/winrm_cmd
msf auxiliary(scanner/winrm/winrm_cmd) > set CMD hostname
CMD => hostname
msf auxiliary(scanner/winrm/winrm_cmd) > set RHOSTS 1.1.1.10
RHOSTS => 1.1.1.10
msf auxiliary(scanner/winrm/winrm_cmd) > set USERNAME Administrator
USERNAME => Administrator
msf auxiliary(scanner/winrm/winrm_cmd) > set PASSWORD vagrant
PASSWORD => vagrant
msf auxiliary(scanner/winrm/winrm_cmd) > run

[+] vagrant-2008R2

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf auxiliary(scanner/winrm/winrm_cmd) >
```

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another good scenario would be showing how to turn this into an exploit. Can you run powershell from it to grab a meterpreter, or other such maneuver?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How would I grab meterpreter and turn it into an exploit? Can you describe it a bit more.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe @h00die is referring to creating a session using this module, as this module only executes a command, and does not return a session.

One scenario would be using the web_delivery module to generate a staging command, then send that command using the WinRM module.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, exactly. I'm not sure it's possible, just seemed like it should be

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, exactly. I'm not sure it's possible, just seemed like it should be

It should be. That's what the exploit/windows/winrm/winrm_script_exec.rb module is for.

I'm not sure why there's two modules.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#11456

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, exactly. I'm not sure it's possible, just seemed like it should be

Will do it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried running running powershell script of web_delivery as a CMD of winrm_cmd but this error threw up.
pppp
Looks like the code has syntax errors.
And ignore the test in auxiliary/scanner/winrm/test , it is same as auxiliary/scanner/winrm/winrm_cmd

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If there is a direct exploitation route through a module, you could just reference it directly. ie https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/x11/open_x11.md#direct-exploitation
It looks like maybe there is an encoding issue, or some other deeper issue going on. Throw the exploitation reference to the msf module and call it a day. While it would be cool to show this other method, it may be more than its worth since there's a module already

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I even tried running commands like start to connect to the listener server, but didn't work. Will go with the reference I guess.