7d65095472
fix quotes
2015-05-18 12:20:42 +02:00
30f7c651c9
use REGISTRY_VIEW_32_BIT
2015-05-18 10:19:32 +02:00
f1955cb15d
Rubocopped the file
2015-05-17 16:09:19 +01:00
5e4566712a
Added more detailed description
2015-05-17 16:00:44 +01:00
a4f67bce6f
Tidied up code
2015-05-17 15:48:05 +01:00
b12db7b633
Retrieves saved session lists etc to loot and exports information in CSV format
2015-05-17 14:59:26 +01:00
1177f42263
Renamed module to remain consistent with other enum modules
2015-05-17 14:38:25 +01:00
18a9dfd6da
Added PAGEANT_REGISTRY_KEY variable to enhance readability
2015-05-17 14:37:59 +01:00
4a416bba3c
Fixed notes using :unique_data
2015-05-17 13:24:38 +01:00
8aa27eee94
report_note only appears to allow one note per host/type combo...
2015-05-17 13:06:17 +01:00
53311fda2e
Fixed logic & added notes storage
2015-05-17 13:02:58 +01:00
5d273d53b4
Fixed module logic so that the key fingerprints now get displayed properly:
2015-05-15 22:02:12 +01:00
fd1a24d6f9
some more minor cleanup noise
...
apparently we standardized on using get_env
instead of expand_path in these cases. Not sure
on the effective difference here but no big deal
MSP-12358
2015-05-15 13:33:48 -05:00
4a88790c8c
Added SSH host keys
2015-05-15 17:57:15 +01:00
631dfc0a0e
increase timeout on ntdsutil
...
default timeout is 15 seconds. we'll give it 90
seconds for now. This may still be too short for
really really large domains, but too long of a timeout
can create other issues
MSP-12358
2015-05-15 11:19:35 -05:00
a3d91dff0b
clean up ntds.dit file when done
...
delete the ntds.dit file we copied when
we are done
MSP-12358
2015-05-15 11:13:19 -05:00
ac04b8d1e7
a little bit of cleanup
...
constantise some of the magic numbers in
the NTDS Account class
MSP-12358
2015-05-15 10:47:31 -05:00
14035a46b1
Fixed description
2015-05-15 16:28:51 +01:00
f65207ac40
Initial version, working
...
Needs tidying up.
Current version:
* Searches for PuTTY registry keys
* Downloades the Hostname, port, private key filename, username to log in as and any port forwarding instructions
* If the private keys are accessible on the box, download them to loot
To do:
* Detect whether pageant is running or not and report back
* Tidy up code (used another plugin as a template)
2015-05-15 16:23:39 +01:00
2721be946a
also check Wow6432Node keys
2015-05-15 14:28:12 +02:00
724b7c6f16
save the ntlm hases as creds
...
the last step is now complete. the current and historical
hashes are all saved to the database for cracking and/or
replay
MSP-12358
2015-05-14 13:52:11 -05:00
452fc6b149
Merge branch 'feature/MSP-12357/meterp-ntds' into feature/MSP-12358/ntds-dump-module
2015-05-14 10:31:28 -05:00
0e666d5732
gaurd against arch mismatch
...
this will not work from an x86 proc
on an x64 machine, so guard against that.
MSP-12358
2015-05-13 15:28:11 -05:00
9308da7956
2003 code path working
...
using VSS directly on server 2003 and repairing
the database with esentutl is now working
MSP-12358
2015-05-13 12:25:44 -05:00
21004046c1
begin parsing of the database
...
clean up and begin aprsing the database
after we have copied it
MSP-12358
2015-05-11 14:48:12 -05:00
028f9dd43b
Tidy and rubocop
2015-05-09 10:48:07 +01:00
e9dc93f345
Use cmd_exec
2015-05-09 10:44:02 +01:00
8c3a97667a
use get_env instead of client.sys.config.getenv
2015-05-08 15:25:20 -04:00
b2ce2ddb05
determine the domain using env vars instead of parsing net.exe output
2015-05-08 14:17:49 -04:00
3c9c578a3d
ntdsutil method in place
...
ntdsutil method built out to make a copy
of ntds.dit on later version of Winbdows Server
MSP-12358
2015-05-04 15:35:36 -05:00
e0c64038a7
start new ddomain hashdump post module
...
module checks for all preconditions so far
including that Domain Services are running,
that we are Admin, that we have bypassed uac
and that it is a supported version of windows.
MSP-12358
2015-05-04 15:07:27 -05:00
eb8fdcc2f2
Typo
2015-04-29 10:45:49 +01:00
4072cbd4d3
Bitlocker -> BitLocker
2015-04-29 10:02:21 +01:00
7e5b03c44e
Tidyup and update for new ADSI format
2015-04-29 09:48:44 +01:00
0d81ad4db4
Remove max search
2015-04-29 09:40:53 +01:00
96a9313e7e
Initial commit
2015-04-29 09:40:53 +01:00
4ffffa59fe
Land #5184 , restore store_loot for ssh_creds gatherer
2015-04-24 13:55:06 -05:00
ab94f15a60
Take care of modules using the 'DEBUG' option
2015-04-21 12:13:40 -05:00
4224008709
Delete print_debug/vprint_debug
2015-04-21 11:14:03 -05:00
a3b0f2e424
Land #5175 , Update mcafee_vse_hashdump description
2015-04-20 21:49:24 -05:00
43e9244b4c
Fix #5134 , Put store_loot back
...
Fix #5134
store_loot was used at one point, but we ended up removing it.
Turns out store_loot is handy in some cases so we're brining it back.
2015-04-17 16:33:51 -05:00
e3ce4eb88e
Update mcafee_vse_hashdump.rb
2015-04-17 09:47:02 -04:00
3422501d91
Land #5174 , deprecated module cleanup
2015-04-16 17:43:28 -05:00
2b9fd93729
remove deprecated modules
2015-04-16 22:49:22 +02:00
cb2e8f4949
Update mcafee_vse_hashdump description
...
The description of this module has been added upon to include cracking details.
2015-04-16 16:09:43 -04:00
352e170624
more failure reasons
2015-04-16 22:04:11 +02:00
8c12361bda
remove fail_with defs
2015-04-16 21:49:31 +02:00
ba6548db75
be consistent about naming
2015-04-16 21:44:56 +02:00
b4b8ac0849
moar fail_with's
2015-04-16 21:26:37 +02:00
0e186fa617
first fail_with fixes
2015-04-16 21:08:33 +02:00
Donny Maasland (Fox-IT)