Improve post/windows/gather/checkvm

[jvoisin]

I tried to split this PR into meaningful commits.

Verification

List the steps needed to make sure this thing works

• Test Parallels detection
• Test VirtualBox detection
• Test VMware detection
• Test Qemu detection
• Test Hyper-V detection
• Test Xen detection

[jheysel-r7]

Testing Windows 7 running in Qemu

msf6 post(windows/gather/checkvm) > sessions -i -1
[*] Starting interaction with 2...
meterpreter > getuid
Server username: msfuser-PC\msfuser
meterpreter > sysinfo
Computer        : MSFUSER-PC
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > bg
[*] Backgrounding session 2...
msf6 exploit(multi/handler) > use post/windows/gather/checkvm
msf6 post(windows/gather/checkvm) > set session -1
session => -1
msf6 post(windows/gather/checkvm) > run
[*] Checking if the target is a Virtual Machine ...
[+] This is a Qemu/KVM Virtual Machine
[*] Post module execution completed

Testing Windows 7 running in Virtual Box

msf6 post(windows/gather/checkvm) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > getuid
Server username: WINDOW7\msfuser
meterpreter > sysinfo
Computer        : WINDOW7
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > bg
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > use post/windows/gather/checkvm
msf6 post(windows/gather/checkvm) > rexploit
[*] Reloading module...
[*] Checking if the target is a Virtual Machine ...
[+] This is a VirtualBox Virtual Machine
[*] Post module execution completed

Testing Windows 11 running in VMware (with Hyper-V enabled)

msf6 exploit(multi/handler) > sessions -i -1
[*] Starting interaction with 3...
meterpreter > getuid
Server username: msfdevice\msfuser
meterpreter > sysinfo
Computer        : MSFDEVICE
OS              : Windows 10 (10.0 Build 22621).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > bg
[*] Backgrounding session 3...
msf6 exploit(multi/handler) > use post/windows/gather/checkvm
msf6 post(windows/gather/checkvm) > set session -1
session => -1
msf6 post(windows/gather/checkvm) > rexploit
[*] Reloading module...
[*] Checking if the target is a Virtual Machine ...
[+] This is a VMware Virtual Machine
[*] Post module execution completed

Testing Windows 11 running in Parallels

msf6 exploit(multi/handler) > sessions -i -1
[*] Starting interaction with 4...
meterpreter > getuid
Server username: JACKHEYSELAAD5\jheysel
meterpreter > sysinfo
Computer        : JACKHEYSELAAD5
OS              : Windows 10 (10.0 Build 22621).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > bg
[*] Backgrounding session 4...
msf6 exploit(multi/handler) > use multi/handler
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > use post/windows/gather/checkvm
msf6 post(windows/gather/checkvm) > set session -1
session => -1
msf6 post(windows/gather/checkvm) > run
[*] Checking if the target is a Virtual Machine ...
[+] This is a Parallels Virtual Machine
[*] Post module execution completed

[gardnerapp]

I have attempted to DRY up this modules code and avoid redundant queries to the registry, processes and services. You can find my code here and a deeper explanation of the improvements in my comments at #18149 . Is it OK to request a pull ?

[jvoisin]

Absolutely :)

[jheysel-r7]

Hey @jvoisin, after speaking with the team we think the Virtual PC (due to it's age) and JoeSandbox (due to it being a cloud based malware analysis tool and not a hypervisor) detections should probably be removed from this PR.

Xen testing is still blocking this PR and the post/linux/gather/checkvm changes.

[jvoisin]

Sure, done :)

[jheysel-r7]

After reviewing the two untested detections Hyper-V and Xen I think this should be good to be landed.

The only change to Hyper-V detection was changing all the registry_getvaldata to get_regval_str which we know helps prevent against an array being return instead of a string.

As for the Xen detection looking in the reg value HKLM\\HARDWARE\\DESCRIPTION\\System\\BIOS\\SystemProductName for the string xen is backed by this blog titled Determine if a machine is virtual

[jheysel-r7]

Release Notes

This PR improves the windows checkvm post module by adding new techniques to identify the hypervisor in which the session is running.