rapid7/metasploit-framework — pull request #4489 by jhart-r7 (2014-12-30 17:56:37+00:00)
Title: Update SMB admin modules to use Scanner, more

This fixes #3994. I had a patch that I had used a while back that did the ```Scanner```/```RHOSTS``` functionality that I never submitted so I just dusted that off an threw in the rest of #3994 while I was at it. @mubix, feel free to resubmit a variant of this if you want since you had expressed some interest in it -- I took it given the age and the fact that I already had most of it laying around.

@maaaaz, this is a slight variant of what you asked for in #3994.

This introduces two new mixins for smb, one that provides handling for remote paths and another for local paths. It ensures that one and only one of each option type (local vs remote) is specified, and wraps each file operation in a ``begin```/```rescue```. I also had to tidy up the printing to keep all of these consistent with one another as well as other scanner modules. These should be backwards compatible with existing option usage patterns.

Validation was done by finding 3 hosts -- one that I have a working user/pass for, another that I don't have creds for and another that isn't even running smb. I then used the upload, download and delete modules to operate on one file at a time (using the ```RPATH``` and/or ```LPATH``` options, as appropriate):

```
resource (/tmp/smb.rc)> echo "this is a test file" > /tmp/test1.txt
[*] exec: echo "this is a test file" > /tmp/test1.txt

resource (/tmp/smb.rc)> echo "this is another test file" > /tmp/test2.txt
[*] exec: echo "this is another test file" > /tmp/test2.txt

resource (/tmp/smb.rc)> setg RHOSTS 10.4.31.157 10.4.16.90 10.4.16.1
RHOSTS => 10.4.31.157 10.4.16.90 10.4.16.1
resource (/tmp/smb.rc)> setg THREADS 5
THREADS => 5
resource (/tmp/smb.rc)> setg SMBUser Administrator
SMBUser => Administrator
resource (/tmp/smb.rc)> setg SMBPass notpassword
SMBPass => notpassword
resource (/tmp/smb.rc)> setg LPATH /tmp/test1.txt
LPATH => /tmp/test1.txt
resource (/tmp/smb.rc)> setg RPATH test1.txt
RPATH => test1.txt
resource (/tmp/smb.rc)> use auxiliary/admin/smb/upload_file
resource (/tmp/smb.rc)> run
[-] 10.4.31.157:445 Unable to login: Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Scanned 2 of 3 hosts (66% complete)
[+] 10.4.16.90:445: /tmp/test1.txt uploaded to test1.txt
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
resource (/tmp/smb.rc)> use auxiliary/admin/smb/download_file
resource (/tmp/smb.rc)> run
[-] 10.4.31.157:445 Unable to login: Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Scanned 2 of 3 hosts (66% complete)
[+] 10.4.16.90:445: test1.txt saved as: /home/jhart/.msf4/loot/20141230093706_smb_10.4.16.90_smb.shares.file_462636.txt
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
resource (/tmp/smb.rc)> use auxiliary/admin/smb/delete_file
resource (/tmp/smb.rc)> run
[-] 10.4.31.157:445: Unable to login: Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Scanned 2 of 3 hosts (66% complete)
[+] 10.4.16.90:445: Deleted: test1.txt...
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
```

Similarly, for the multi-file variants (using ```FILE_RPATHS``` and/or ```FILE_LPATHS``` options, as appropriate:

```
resource (/tmp/smb.rc)> use auxiliary/admin/smb/upload_file
resource (/tmp/smb.rc)> unsetg LPATH RPATH FILE_RPATHS FILE_LPATHS
Unsetting LPATH...
Unsetting RPATH...
Unsetting FILE_RPATHS...
Unsetting FILE_LPATHS...
resource (/tmp/smb.rc)> echo /tmp/test1.txt > /tmp/local_files.txt
[*] exec: echo /tmp/test1.txt > /tmp/local_files.txt

resource (/tmp/smb.rc)> echo /tmp/test2.txt >> /tmp/local_files.txt
[*] exec: echo /tmp/test2.txt >> /tmp/local_files.txt

resource (/tmp/smb.rc)> set FILE_LPATHS /tmp/local_files.txt
FILE_LPATHS => /tmp/local_files.txt
resource (/tmp/smb.rc)> set RPATH test1.txt
RPATH => test1.txt
resource (/tmp/smb.rc)> run
[*] Error: 10.4.16.90: TypeError no implicit conversion of nil into String
[-] 10.4.31.157:445 Unable to login: Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
resource (/tmp/smb.rc)> use auxiliary/admin/smb/download_file
resource (/tmp/smb.rc)> unsetg LPATH RPATH FILE_RPATHS FILE_LPATHS
Unsetting LPATH...
Unsetting RPATH...
Unsetting FILE_RPATHS...
Unsetting FILE_LPATHS...
resource (/tmp/smb.rc)> echo test1.txt > /tmp/remote_files.txt
[*] exec: echo test1.txt > /tmp/remote_files.txt

resource (/tmp/smb.rc)> echo test2.txt >> /tmp/remote_files.txt
[*] exec: echo test2.txt >> /tmp/remote_files.txt

resource (/tmp/smb.rc)> set FILE_RPATHS /tmp/remote_files.txt
FILE_RPATHS => /tmp/remote_files.txt
resource (/tmp/smb.rc)> run
[-] 10.4.31.157:445 Unable to login: Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Scanned 2 of 3 hosts (66% complete)
[+] 10.4.16.90:445: test1.txt saved as: /home/jhart/.msf4/loot/20141230093706_smb_10.4.16.90_smb.shares.file_609054.txt
[-] 10.4.16.90:445 Unable to download test2.txt: The server responded with error: STATUS_OBJECT_NAME_NOT_FOUND (Command=45 WordCount=0)
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
resource (/tmp/smb.rc)> use auxiliary/admin/smb/delete_file
resource (/tmp/smb.rc)> unsetg LPATH RPATH FILE_RPATHS FILE_LPATHS
Unsetting LPATH...
Unsetting RPATH...
Unsetting FILE_RPATHS...
Unsetting FILE_LPATHS...
resource (/tmp/smb.rc)> set FILE_RPATHS /tmp/remote_files.txt
FILE_RPATHS => /tmp/remote_files.txt
resource (/tmp/smb.rc)> run
[-] 10.4.31.157:445: Unable to login: Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Scanned 2 of 3 hosts (66% complete)
[+] 10.4.16.90:445: Deleted: test1.txt...
[-] 10.4.16.90:445: Cannot delete test2.txt: The server responded with error: STATUS_OBJECT_NAME_NOT_FOUND (Command=6 WordCount=0)
[*] Scanned 3 of 3 hosts (100% complete)
[*] Auxiliary module execution completed
```

I'll add some specs to finish this off.