CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Android::Priv
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Multiplatform Installed Software Version Enumerator',
14
        'Description' => %q{
15
          This module, when run against a compromised machine, will gather details on all installed software,
16
          including their versions and if available, when they were installed, and will save it into a loot file for later use.
17
          Users can then use this loot file to determine what additional vulnerabilites may affect the target machine.
18

19
          Note that for Linux systems, software enumeration is done via package managers. As a result the results may
20
          not reflect all of the available software on the system simply because users may have installed additional
21
          software from alternative sources such as source code that these package managers are not aware of.
22
        },
23
        'License' => MSF_LICENSE,
24
        'Author' => [ 'gwillcox-r7' ],
25
        'Platform' => %w[win linux osx bsd solaris android],
26
        'SessionTypes' => [ 'meterpreter', 'shell' ],
27
        'Notes' => {
28
          'Stability' => [CRASH_SAFE],
29
          'SideEffects' => [IOC_IN_LOGS],
30
          'Reliability' => []
31
        }
32
      )
33
    )
34
  end
35

36
  def store_linux_loot(listing)
37
    file = store_loot('host.linux.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
38
    print_good("Stored information about the installed products to the loot file at #{file}")
39
  end
40

41
  def enumerate_android_packages
42
    if command_exists?('pm') == false
43
      print_error("The command 'pm' does not exist on the host")
44
      return nil
45
    end
46
    listing = cmd_exec('pm list packages -f').to_s
47
    if listing.empty?
48
      print_error('No results were returned when trying to get software installed on the Linux host. An error likely occured.')
49
      return nil
50
    end
51
    listing
52
  end
53

54
  # Run Method for when run command is issued
55
  def run
56
    case session.platform
57
    when 'windows'
58
      if command_exists?('wmic') == false
59
        print_error("The 'wmic' command doesn't exist on this host!") # wmic is technically marked as depreciated so this command could very well be removed in future releases.
60
        return
61
      end
62
      listing = cmd_exec('wmic product get Name, Description, Version, InstallDate', nil, 6000).to_s
63
      unless listing.include?('Description')
64
        print_error('Was unable to get a listing of installed products...')
65
        return
66
      end
67
      file = store_loot('host.windows.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
68
      print_good("Stored information about the installed products to the loot file at #{file}")
69
    when 'linux'
70
      # All of the following options were taken from https://distrowatch.com/dwres.php?resource=package-management
71
      # and further verified against VMs that were set up in testing labs.
72
      if command_exists?('apt') # Debian, Ubuntu, and Debian derived distros.
73
        cmd = %w[apt list --installed]
74
      elsif command_exists?('dpkg') # Alternative for Debian based systems
75
        cmd = %w[dpkg -l]
76
      elsif command_exists?('pacman') # Arch and Manjaro are two popular examples
77
        cmd = %w[pacman -Q]
78
      elsif command_exists?('zypper') # OpenSUSE is a popular example
79
        cmd = %w[zypper search -is]
80
      elsif command_exists?('rpm') # Fedora, Centos, RHEL
81
        cmd = %w[rpm -qa]
82
      elsif command_exists?('apk') # Apline
83
        cmd = %w[apk info -v]
84
      elsif command_exists?('qlist') # Gentoo
85
        cmd = %w[qlist -Iv]
86
      elsif command_exists?('pkg') # FreeBSD
87
        cmd = %w[pkg info]
88
      elsif command_exists?('equo') # Sabayon
89
        cmd = %w[equo q list installed -v]
90
      elsif command_exists?('nix-env')
91
        cmd = %w[nix-env -q]
92
      else
93
        print_error("The target system either doesn't have a package manager system, or does not use a known package manager system!")
94
        print_error('Unable to enumerate the software on the target system. Exiting...')
95
        return nil
96
      end
97

98
      if command_exists?((cmd[0]).to_s) == false
99
        print_error("The command #{cmd[0]} was not found on the target.")
100
        return
101
      else
102
        listing = cmd_exec(cmd.join(' ')).to_s
103
        if listing.empty?
104
          print_error('No results were returned when trying to get software installed on the Linux host. An error likely occured.')
105
          return
106
        end
107
        store_linux_loot(listing)
108
      end
109
    when 'bsd', 'solaris'
110
      if command_exists?('pkg') == false
111
        print_error("The command 'pkg' does not exist on the host")
112
        return
113
      end
114
      listing = cmd_exec('pkg info').to_s
115
      if listing.empty?
116
        print_error('No results were returned when trying to get software installed on the BSD/Solaris host. An error likely occured.')
117
        return
118
      end
119
      file = store_loot('host.bsd.solaris.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
120
      print_good("Stored information about the installed products to the loot file at #{file}")
121
    when 'osx'
122
      listing = ''
123
      if command_exists?('system_profiler') == false
124
        print_error("The command 'system_profiler' does not exist on the host! Something is seriously wrong!")
125
        return
126
      end
127
      command_result = cmd_exec('system_profiler SPApplicationsDataType').to_s
128
      if command_result.empty?
129
        print_error('No results were returned when trying to get software installed on the OSX host via system_profiler!')
130
        return
131
      end
132
      listing += command_result
133

134
      # Start enumerating other potential MacOS package managers now that
135
      # the main system app manager has been enumerated.
136
      if command_exists?('brew') # HomeBrew
137
        listing += "\n\n----------------Brew Packages----------------\n"
138
        listing += cmd_exec('brew list --versions')
139
      end
140

141
      if command_exists?('port') # MacPorts
142
        listing += "\n\n----------------MacPorts Packages----------------\n"
143
        listing += cmd_exec('port installed')
144
      end
145

146
      file = store_loot('host.osx.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
147
      print_good("Stored information about the installed products to the loot file at #{file}")
148
    when 'android'
149
      if is_root?
150
        if command_exists?('dumpsys') == false
151
          print_error("Something is odd with this Android device. You are root but the dumpsys command doesn't exist. Perhaps the device is too old?")
152
          return
153
        end
154
        listing = cmd_exec('dumpsys package packages').to_s
155
        if listing.empty?
156
          print_error('Something went wrong with the command and no output was returned!')
157
          return
158
        elsif listing =~ /android.permission.DUMP/
159
          print_warning('You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.')
160
          listing = enumerate_android_packages
161
          return if listing.nil?
162
        end
163
      else
164
        print_warning('You do not have the permissions needed to dump the versions of software installed. Reverting to just enumerating what software is installed.')
165
        listing = enumerate_android_packages
166
        return if listing.nil?
167
      end
168
      file = store_loot('host.android.software.versions', 'text/plain', session, listing, 'installed_software.txt', 'Installed Software and Versions')
169
      print_good("Stored information about the installed products to the loot file at #{file}")
170
    end
171
  end
172
end
173

174