Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
#
2
# $Id$
3
# $Revision$
4
#
5

6
module Msf
7
  class Plugin::TokenHunter < Msf::Plugin
8

9
    class TokenCommandDispatcher
10
      include Msf::Ui::Console::CommandDispatcher
11

12
      def name
13
        'Token Hunter'
14
      end
15

16
      def commands
17
        {
18
          'token_hunt_user' => 'Scan all connected Meterpreter sessions for active tokens corresponding to one or more users'
19
        }
20
      end
21

22
      def cmd_token_hunt_user(*args)
23
        opts = Rex::Parser::Arguments.new(
24
          '-h' => [ false, 'This help menu'],
25
          '-f' => [ true, 'A file containing a list of users to search for (one per line)']
26
        )
27

28
        opt_userfile = nil
29
        opt_users = []
30

31
        opts.parse(args) do |opt, _idx, val|
32
          case opt
33
          when '-h'
34
            print_line('Usage: token_hunt_user [options] <username> [username] .. [username]')
35
            print_line(opts.usage)
36
            return
37
          when '-f'
38
            opt_userfile = val
39
          else
40
            opt_users << val
41
          end
42
        end
43

44
        if opt_userfile
45
          ::File.open(opt_userfile, 'rb') do |fd|
46
            fd.each_line do |line|
47
              line.strip!
48
              next if line.empty?
49
              next if line =~ /^#/
50

51
              opt_users << line
52
            end
53
          end
54
        end
55

56
        opt_users.uniq!
57

58
        tokens_del = {}
59
        tokens_imp = {}
60

61
        framework.sessions.each_key do |sid|
62
          session = framework.sessions[sid]
63
          next if session.type != 'meterpreter'
64

65
          print_status(">> Scanning session #{session.sid} / #{session.session_host}")
66

67
          if !session.incognito
68
            session.core.use('incognito')
69
          end
70

71
          if !session.incognito
72
            print_status("!! Failed to load incognito on #{session.sid} / #{session.session_host}")
73
            next
74
          end
75

76
          res = session.incognito.incognito_list_tokens(0)
77
          next unless res
78

79
          res['delegation'].split("\n").each do |user|
80
            opt_users.each do |needle|
81
              ndom, nusr = needle.split('\\')
82
              if !nusr
83
                nusr = ndom
84
                ndom = nil
85
              end
86

87
              if (!user.nil? && ndom && (user.strip.downcase == needle.strip.downcase))
88
                print_status("FOUND: #{session.sid} - #{session.session_host} - #{user} (delegation)")
89
                next
90
              end
91

92
              _fdom, fusr = user.split('\\')
93

94
              if (!fusr.nil? && !ndom && (fusr.strip.downcase == nusr.strip.downcase))
95
                print_status("FOUND: #{session.sid} - #{session.session_host} - #{user} (delegation)")
96
              end
97
            end
98

99
            tokens_del[user] ||= []
100
            tokens_del[user] << session.sid
101
          end
102

103
          res['impersonation'].split("\n").each do |user|
104
            opt_users.each do |needle|
105
              ndom, nusr = needle.split('\\')
106
              if !nusr
107
                nusr = ndom
108
                ndom = nil
109
              end
110

111
              if (!user.nil? && ndom && (user.strip.downcase == needle.strip.downcase))
112
                print_status(">> Found #{session.sid} - #{session.session_host} - #{user} (impersonation)")
113
                next
114
              end
115

116
              _fdom, fusr = user.split('\\')
117
              if (!fusr.nil? && !ndom && (fusr.strip.downcase == nusr.strip.downcase))
118
                print_status(">> Found #{session.sid} - #{session.session_host} - #{user} (impersonation)")
119
              end
120
            end
121

122
            tokens_imp[user] ||= []
123
            tokens_imp[user] << session.sid
124
          end
125
        end
126
      end
127
    end
128

129
    def initialize(framework, opts)
130
      super
131
      add_console_dispatcher(TokenCommandDispatcher)
132
    end
133

134
    def cleanup
135
      remove_console_dispatcher('Token Hunter')
136
    end
137

138
    def name
139
      'token_hunter'
140
    end
141

142
    def desc
143
      'Search all active Meterpreter sessions for specific tokens'
144
    end
145
  end
146
end
147

148