/
githubmirror
/
metasploit-framework
Обзор
Документация
Войти
/
githubmirror
/
metasploit-framework
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
modules/post/windows/gather/enum_av.rb
50 строк
2 KB
Jack Heysel
Changed vprint to print update docs
21 апр 2022, 21:35
21 апр 2022, 21:35
d8542ad
Код
Авторство
О чём код?
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Post include Msf::Post::Windows::Priv def initialize(info = {}) super( update_info( info, 'Name' => 'Windows Installed AntiVirus Enumeration', 'Description' => %q{ This module will enumerate the AV products detected by WMIC }, 'License' => MSF_LICENSE, 'Author' => [ 'rageltman <rageltman[at]sempervictus>' ], 'Platform' => %w[win], 'SessionTypes' => [ 'meterpreter', 'shell' ], 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [], 'SideEffects' => [] } ) ) end # Run Method for when run command is issued def run if command_exists?('wmic') == false print_error("The 'wmic' command doesn't exist on this host!") # wmic is technically marked as deprecated so this command could very well be removed in future releases. return end avs = {} cmd = 'wmic /namespace:\\\\root\\SecurityCenter2 path AntiVirusProduct get * /value' resp = cmd_exec(cmd, nil, 6000).to_s fail_with(Failure::Unknown, resp) if resp[0..5].upcase == 'ERROR:' resp.split("\r\r\n\r\r\n").map do |ent| next if ent.strip.empty? print_status("Found AV product:\n#{ent}\n") av_note = ent.lines.map(&:strip).map.select { |e| e.length > 1 }.map { |e| e.split('=', 2) }.to_h avn = av_note.delete('displayName') avs[avn] = av_note end report_note(host: target_host, type: 'windows.antivirus', data: avs, update: :unique_data) end end