Module: Msf::Exploit::Remote::MsWkst

Includes:
SMB::Client::Ipc
Defined in:
lib/msf/core/exploit/remote/ms_wkst.rb

Defined Under Namespace

Classes: MsWkstAuthenticationError, MsWkstConnectionError, MsWkstError, MsWkstUnexpectedReplyError

Constant Summary collapse

WKS_UUID = 
'6bffd098-a112-3610-9833-46c3f87e345a'.freeze
WKS_VERS = 
'1.0'.freeze
WKSSVC_ENDPOINT = 
RubySMB::Dcerpc::Wkssvc.freeze

Constants included from SMB::Client

SMB::Client::CONST, SMB::Client::DCERPCClient, SMB::Client::DCERPCPacket, SMB::Client::DCERPCResponse, SMB::Client::DCERPCUUID, SMB::Client::NDR, SMB::Client::SIMPLE, SMB::Client::XCEPT

Instance Attribute Summary collapse

Attributes included from SMB::Client

#simple

Attributes included from Tcp

#sock

Class Method Summary collapse

Instance Method Summary collapse

Methods included from SMB::Client::Ipc

connect_ipc, disconnect_ipc

Methods included from Auxiliary::Report

#active_db?, #create_cracked_credential, #create_credential, #create_credential_and_login, #create_credential_login, #db, #db_warning_given?, #get_client, #get_host, #inside_workspace_boundary?, #invalidate_login, #mytask, #myworkspace, #myworkspace_id, #report_auth_info, #report_client, #report_exploit, #report_host, #report_loot, #report_note, #report_service, #report_vuln, #report_web_form, #report_web_page, #report_web_site, #report_web_vuln, #store_cred, #store_local, #store_loot

Methods included from Metasploit::Framework::Require

optionally, optionally_active_record_railtie, optionally_include_metasploit_credential_creation, #optionally_include_metasploit_credential_creation, optionally_require_metasploit_db_gem_engines

Methods included from SMB::Client::Authenticated

#initialize

Methods included from Kerberos::ServiceAuthenticator::Options

#kerberos_auth_options

Methods included from Kerberos::Ticket::Storage

#initialize, #kerberos_storage_options, #kerberos_ticket_storage, store_ccache

Methods included from SMB::Client

#connect, #domain, #domain_username_split, #initialize, #smb_create, #smb_direct, #smb_enumprinters, #smb_enumprintproviders, #smb_file_exist?, #smb_file_rm, #smb_fingerprint, #smb_fingerprint_windows_lang, #smb_fingerprint_windows_sp, #smb_hostname, #smb_lanman_netshareenumall, #smb_login, #smb_lookup_share_type, #smb_netshareenumall, #smb_netsharegetinfo, #smb_open, #smb_peer_lm, #smb_peer_os, #smb_srvsvc_netshareenumall, #smb_srvsvc_netsharegetinfo, #smbhost, #splitname, #unicode

Methods included from Tcp

#chost, #cleanup, #connect, #connect_timeout, #cport, #disconnect, #handler, #initialize, #lhost, #lport, #peer, #print_prefix, #proxies, #rhost, #rport, #set_tcp_evasions, #shutdown, #ssl, #ssl_cipher, #ssl_verify_mode, #ssl_version

Instance Attribute Details

#wkssvc_pipe ⇒ Object (readonly)

The currently connected WKSSVC pipe



30
31
32
 
# File 'lib/msf/core/exploit/remote/ms_wkst.rb', line 30

def wkssvc_pipe
  @wkssvc_pipe
end

Class Method Details

.connect_wkssvc(tree) ⇒ Object 



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/msf/core/exploit/remote/ms_wkst.rb', line 52

def connect_wkssvc(tree)
  begin
    vprint_status('Connecting to Workstation Service Remote Protocol')
    self.wkssvc_pipe = tree.open_file(filename: 'wkssvc', write: true, read: true)

    raise MsWkstConnectionError.new('Could not open wkssvc pipe on remote SMB server.') unless wkssvc_pipe

    vprint_status('Binding to \\wkssvc...')
    self.wkssvc_pipe.bind(endpoint: WKSSVC_ENDPOINT)
    vprint_good('Bound to \\wkssvc')

    self.wkssvc_pipe
  rescue RubySMB::Dcerpc::Error::FaultError => e
    elog(e.message, error: e)
    raise MsWkstUnexpectedReplyError, "Connection failed (DCERPC fault: #{e.status_name})"
  end
end

Instance Method Details

#disconnect_wkssvc ⇒ Object 



42
43
44
45
46
47
48
 
# File 'lib/msf/core/exploit/remote/ms_wkst.rb', line 42

def disconnect_wkssvc
  begin
    self.wkssvc_pipe.close if self.wkssvc_pipe&.is_connected?
  rescue RubySMB::Error::UnexpectedStatusCode, RubySMB::Error::CommunicationError => e
    wlog e
  end
end

#get_info ⇒ Object 



38
39
40
 
# File 'lib/msf/core/exploit/remote/ms_wkst.rb', line 38

def get_info()
  self.wkssvc_pipe.netr_wksta_get_info
end

#user_enum(level) ⇒ Object 



32
33
34
35
36
 
# File 'lib/msf/core/exploit/remote/ms_wkst.rb', line 32

def user_enum(level)
  self.wkssvc_pipe.netr_wksta_user_enum(
    level: level
  )
end