Mirror of metasploit
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

enum_shares.rb 3.7KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124
  1. ##
  2. # WARNING: Metasploit no longer maintains or accepts meterpreter scripts.
  3. # If you'd like to improve this script, please try to port it as a post
  4. # module instead. Thank you.
  5. ##
  6. # Author: Carlos Perez at carlos_perez[at]darkoperator.com
  7. #-------------------------------------------------------------------------------
  8. ################## Variable Declarations ##################
  9. opts = Rex::Parser::Arguments.new(
  10. "-h" => [ false, "Help menu." ]
  11. )
  12. opts.parse(args) { |opt, idx, val|
  13. case opt
  14. when "-h"
  15. print_line "Meterpreter Script for Enumerating Shares Offered, History of Mounted Shares,"
  16. print_line "History of UNC Paths entered in Run Dialog."
  17. print_line(opts.usage)
  18. raise Rex::Script::Completed
  19. end
  20. }
  21. # Function for enumerating recent mapped drives on target machine
  22. def enum_recent_mounts(base_key)
  23. recent_mounts = []
  24. partial_path = base_key + '\Software\\Microsoft\Windows\CurrentVersion\Explorer'
  25. full_path = "#{partial_path}\\Map Network Drive MRU"
  26. explorer_keys = registry_enumkeys(partial_path)
  27. if explorer_keys.include?("Map Network Drive MRU")
  28. registry_enumvals(full_path).each do |k|
  29. if not k =~ /MRUList/
  30. recent_mounts << registry_getvaldata(full_path,k)
  31. end
  32. end
  33. end
  34. return recent_mounts
  35. end
  36. # Function for enumerating UNC Paths entered in run dialog box
  37. def enum_run_unc(base_key)
  38. unc_paths = []
  39. full_path = base_key + '\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU'
  40. registry_enumvals(full_path).each do |k|
  41. if k =~ /./
  42. run_entrie = registry_getvaldata(full_path,k)
  43. unc_paths << run_entrie if run_entrie =~ /^\\\\/
  44. end
  45. end
  46. return unc_paths
  47. end
  48. def enum_conf_shares()
  49. target_os = client.sys.config.sysinfo['OS']
  50. if target_os =~ /Windows 7|Vista|2008/
  51. shares_key = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\LanmanServer\\Shares'
  52. else
  53. shares_key = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\lanmanserver\\Shares'
  54. end
  55. shares = registry_enumvals(shares_key)
  56. if shares.length > 0
  57. print_status()
  58. print_status("The following shares where found:")
  59. shares.each do |s|
  60. share_info = registry_getvaldata(shares_key,s).split("\000")
  61. print_status("\tName: #{s}")
  62. share_info.each do |e|
  63. name,val = e.split("=")
  64. print_status("\t#{name}: #{val}") if name =~ /Path|Type/
  65. end
  66. print_status()
  67. end
  68. end
  69. end
  70. if client.platform =~ /win32|64/
  71. # Variables to hold info
  72. mount_history = []
  73. run_history = []
  74. # Enumerate shares being offered
  75. enum_conf_shares()
  76. if not is_system?
  77. mount_history = enum_recent_mounts("HKEY_CURRENT_USER")
  78. run_history = enum_run_unc("HKEY_CURRENT_USER")
  79. else
  80. user_sid = []
  81. key = "HKU\\"
  82. root_key, base_key = client.sys.registry.splitkey(key)
  83. open_key = client.sys.registry.open_key(root_key, base_key)
  84. keys = open_key.enum_key
  85. keys.each do |k|
  86. user_sid << k if k =~ /S-1-5-21-\d*-\d*-\d*-\d{3,6}$/
  87. end
  88. user_sid.each do |us|
  89. mount_history = mount_history + enum_recent_mounts("HKU\\#{us.chomp}")
  90. run_history = run_history + enum_run_unc("HKU\\#{us.chomp}")
  91. end
  92. end
  93. # Enumerate Mount History
  94. if mount_history.length > 0
  95. print_status("Recent Mounts found:")
  96. mount_history.each do |i|
  97. print_status("\t#{i}")
  98. end
  99. print_status()
  100. end
  101. #Enumerate UNC Paths entered in the Dialog box
  102. if run_history.length > 0
  103. print_status("Recent UNC paths entered in Run Dialog found:")
  104. run_history.each do |i|
  105. print_status("\t#{i}")
  106. end
  107. print_status()
  108. end
  109. else
  110. print_error("This version of Meterpreter is not supported with this Script!")
  111. raise Rex::Script::Completed
  112. end