Metasploit Revealed: Secrets of the Expert Pentester

Fabricating sophisticated RailGun scripts

Taking a step further, let's delve deeper into writing scripts using RailGun for meterpreter extensions. Let's first create a script which will add a custom-named DLL file to the Metasploit context:

if client.railgun.get_dll('urlmon') == nil 
print_status("Adding Function") 
end 
client.railgun.add_dll('urlmon','C:\\WINDOWS\\system32\\urlmon.dll') 
client.railgun.add_function('urlmon','URLDownloadToFileA','DWORD',[ 
["DWORD","pcaller","in"], 
["PCHAR","szURL","in"], 
["PCHAR","szFileName","in"], 
["DWORD","Reserved","in"], 
["DWORD","lpfnCB","in"], 
]) 

Save the code under a file named urlmon.rb under the /scripts/meterpreter directory.

The preceding script adds a reference path to the C:\\WINDOWS\\system32\\urlmon.dll ...