msf MessageBox后渗透模块编写

最新推荐文章于 2023-03-06 18:13:58 发布

Cosmop01itan

最新推荐文章于 2023-03-06 18:13:58 发布

阅读量749

点赞数

CC 4.0 BY-SA版权

分类专栏：渗透测试

本文链接：https://blog.youkuaiyun.com/CosmopolitanMe/article/details/88345051

渗透测试专栏收录该内容

10 篇文章

订阅专栏

本文介绍了一个名为Windows MessageBox的Metasploit模块，该模块允许在目标Windows系统上显示自定义消息框，适用于Meterpreter会话。模块支持设置消息框的内容和标题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

message_box.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Post
  include Msf::Post::File
  include Msf::Post::Windows::Registry
  include Msf::Post::Windows::Powershell
  def initialize(info={})
    super(update_info(info,
      'Name'            => "Windows Message Box",
      'Description'     => %q{
        Show a MessageBox in desktop.
      },
      'License'         => MSF_LICENSE,
      'Platform'        => ['win'],
      'SessionTypes'    => ['meterpreter'],
      'Author'          => ['cosmop01tain']
    ))
    register_options(
    [
          OptString.new( 'TEXT', [true, 'Message Box content']),
          OptString.new( 'CAPTION', [true, 'Message Box caption'])
    ])
  end

  #
  # RAILGUN HELPER FUNCTIONS
  #
  def is_86
    pid = session.sys.process.open.pid
    return session.sys.process.each_process.find { |i| i["pid"] == pid} ["arch"] == "x86"
  end

  def add_railgun_messagebox

    if client.railgun.libraries.find_all {|d| d.first == 'user32'}.empty?
      session.railgun.add_dll('user32','user32')
      session.railgun.add_function(
        'user32', 'MessageBoxW', 'DWORD',
          [
            #['DWORD', 'pCaller', 'in'],
            ['pBLOB','hWnd','in']
            ['PWCHAR','szText','in'],
            ['PWCHAR','szCaption','in'],
            ['DWORD','dwType','in'],
            #['PBLOB','lpfnCB','inout']
      ])
      vprint_good("user32 loaded and configured")
    else
      vprint_status("user32 already loaded")
    end

end
  def run
    #check for meterpreter and version of ie
    if session.type != "meterpreter" and session.platform !~ /win/
      print_error("This module only works with Windows Meterpreter sessions")
      return 0
    end
    #print_status(session.sys.config.getenv("TEMP"))
    #print_status(datastore['TEXT'])
    content = datastore['TEXT']
    caption = datastore['CAPTION']
    client.railgun.user32.MessageBoxW(0,content,caption,0)
  end
end

复制到msf post/windows/gather目录下,msfconsole进入,然后执行reload_all
使用 use post/windows/gather/message_box
set caption kkk
set text kkk
run