Resource Scripts
Resource scripts can chain together a series of Metasploit console commands
and Ruby code.
This means that we can either use the built-in commands of Metasploit
or write code in Ruby (as it’s the language Metasploit is developed in)
to manage control flow as well as develop advanced logic components
for resource scripts.
In a penetration test, we may need to set up several multi/handler listeners
each time we want to receive an incoming reverse shell.
We could either let Metasploit run in the background the whole time
or start Metasploit and manually set up a listener each time.
We could also create a resource script to automate this task for us.
Let’s create a resource script that starts a multi/handler listener for a non-staged
Windows 64-bit Meterpreter payload.
To do this, we can create a file in the home directory of the user kali
named listener.rc and open it in an editor such as Mousepad.
We first need to think about the sequence of the commands we want to execute.
For this example, the first command is to activate the multi/handler module.
Then, we set the payload, which in our case,
is windows/meterpreter_reverse_https.
Next, we can set the LHOST and LPORT options to fit our needs.
In addition, we can configure the AutoRunScript option to automatically
execute a module after a session was created.
For this example, let’s use the post/windows/manage/migrate module.
This will cause the spawned Meterpreter to automatically launch
a background notepad process and migrate to it.
Automating process migration helps to avoid situations where our payload
is killed prematurely either by defensive mechanisms or the termination
of the related process.
Let’s also set ExitOnSession to false to ensure that the listener keeps accepting
new connections after a session is created.
Finally, we’ll add run with the arguments -z and -j to run it as a job
in the background and to stop us from automatically interacting
with the session.
Now, let’s save the script,
and start Metasploit by entering msfconsole with the resource script
as argument for -r.
The output shows that all of our commands were executed as specified in the script.
Let’s connect to the BRUTE2 machine via RDP with user justin and his password,
start PowerShell,
download the malicious Windows executable met.exe
that we already used in previous sections,
and execute it.
Once met.exe is executed, Metasploit notifies us about the incoming connection.
Nice!
Metasploit automatically migrated to the newly spawned Notepad process.
Instead of creating our own resource scripts,
we can also use the already provided resource scripts from Metasploit.
They can be found in the scripts/resource/ directory
in the Metasploit directory.
The output shows that there are resource scripts provided for port scanning,
brute forcing, protocol enumerations, and so on.
Before we attempt to use them, we should thoroughly examine, understand,
and modify them to fit our needs.
Some of these scripts use the global datastore of Metasploit to set options
such as RHOSTS.
When we use set or unset,
we define options in the context of a running module.
However, we can also define values for options across all modules
by setting global options.
These options can be set with setg and unset with unsetg.
Resource scripts can be quite handy to automate parts of a penetration test.
We can create a set of resource scripts for repetitive tasks and operations.
We can prepare those scripts and then modify them for each penetration test.
For example, we could prepare resource scripts for listeners,
pivoting, post-exploitation, and much more.
Using them on multiple penetration tests can save us a lot of time.