Module: Msf::Sessions::VncInjectOptions

Defined in:
lib/msf/base/sessions/vncinject_options.rb

Instance Method Summary collapse

Instance Method Details

#initialize(info = {}) ⇒ Object 



7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/msf/base/sessions/vncinject_options.rb', line 7

def initialize(info = {})
  super(info)

  # Override the DLL path with the path to the meterpreter server DLL
  register_options(
    [
      OptPort.new('VNCPORT',
        [
          true,
          "The local port to use for the VNC proxy",
          5900
        ]),
      OptAddress.new('VNCHOST',
        [
          true,
          "The local host to use for the VNC proxy",
          '127.0.0.1'
        ]),
      OptBool.new('DisableCourtesyShell',
        [
          false,
          "Disables the Metasploit Courtesy shell",
          true
        ]),
      OptBool.new('ViewOnly',
        [
          false,
          "Runs the viewer in view mode",
          true
        ]),
      OptBool.new('AUTOVNC',
        [
          true,
          "Automatically launch VNC viewer if present",
          true
        ])
    ], self.class)

  register_advanced_options(
    [
      OptBool.new('DisableSessionTracking',
        [
          false,
          "Disables the VNC payload from following the active session as users log in an out of the input desktop",
          false
        ])
    ], self.class)
  deregister_options('DLL')

end

#library_name ⇒ Object

The library name that we’re injecting the DLL as can be random.



61
62
63
 
# File 'lib/msf/base/sessions/vncinject_options.rb', line 61

def library_name
  Rex::Text::rand_text_alpha(8) + ".dll"
end

#on_session(session) ⇒ Object

If the AUTOVNC flag is set to true, automatically try to launch VNC viewer.



69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/msf/base/sessions/vncinject_options.rb', line 69

def on_session(session)
  # Taken from: https://github.com/rapid7/metasploit-framework/blob/73a0914c4ac1d4c01919fb3b7dc1260c72ad6122/lib/msf/base/sessions/command_shell_options.rb#L35
  platform = nil
  if self.platform and self.platform.kind_of? Msf::Module::PlatformList
    platform = self.platform.platforms.first.realname.downcase
  end
  if self.platform and self.platform.kind_of? Msf::Module::Platform
    platform = self.platform.realname.downcase
  end

  # a blank platform is *all* platforms and used by the generic modules, in that case only set this instance if it was
  # not previously set to a more specific value through some means
  session.platform = platform unless platform.blank? && !session.platform.blank?

  if self.arch
    if self.arch.kind_of?(Array)
      session.arch = self.arch.join('')
    else
      session.arch = self.arch
    end
  end

  # Calculate the flags to send to the DLL
  flags = 0

  flags |= 1 if (datastore['DisableCourtesyShell'])
  flags |= 2 if (datastore['DisableSessionTracking'])

  # Transmit the one byte flag
  session.rstream.put([ flags ].pack('C'))

  # Set up the local relay
  print_status("Starting local TCP relay on #{datastore['VNCHOST']}:#{datastore['VNCPORT']}...")

  session.setup_relay(datastore['VNCPORT'], datastore['VNCHOST'])

  print_status("Local TCP relay started.")

  # If the AUTOVNC flag is set, launch VNC viewer.
  if datastore['AUTOVNC']
    if (session.autovnc(datastore['ViewOnly']))
      print_status("Launched vncviewer.")
    else
      print_error("Failed to launch vncviewer.  Is it installed and in your path?")
    end
  end

  super
end