f8fce7b7f6
Further tidying up of code, adding descriptions etc
2015-05-19 14:29:56 +01:00
811c45ab90
new
2015-05-19 14:06:41 +01:00
ea4d3415ec
Continued to tidy up code, added verbose mode to assist in debugging
2015-05-19 12:21:00 +01:00
d704e95890
Tidying up
2015-05-19 11:34:25 +01:00
0c0758bf03
Added socketpath
2015-05-19 10:56:04 +01:00
e152ceb05d
Tidied up code, added MWR labs logo
2015-05-19 10:33:32 +01:00
a4fc8aefd5
Working, tested & cleans up after itself
2015-05-19 10:21:08 +01:00
b749d44c6a
Tidied up working version, logic has now moved to a POST module
2015-05-19 10:00:50 +01:00
a37714379d
Working version
2015-05-19 09:55:38 +01:00
3d4490cafd
Trying to do this as a POST module instead of through command dispatcher
2015-05-19 09:49:27 +01:00
79db696c15
fix EOL character
2015-05-18 15:46:55 -05:00
e1eed6e9d9
single quotes and slashes..
2015-05-18 16:33:57 +02:00
8b8ed04a73
Rubocop
2015-05-18 11:56:12 +01:00
cf05e69536
Removed database storage for now (need to convert keys to OpenSSH format and resolve IP addresses first)
2015-05-18 11:51:27 +01:00
7f16b7164f
Added database writing code
2015-05-18 11:43:08 +01:00
77cf2ec60e
Added basic private key detection and parsing
2015-05-18 11:20:53 +01:00
7d65095472
fix quotes
2015-05-18 12:20:42 +02:00
30f7c651c9
use REGISTRY_VIEW_32_BIT
2015-05-18 10:19:32 +02:00
f1955cb15d
Rubocopped the file
2015-05-17 16:09:19 +01:00
5e4566712a
Added more detailed description
2015-05-17 16:00:44 +01:00
a4f67bce6f
Tidied up code
2015-05-17 15:48:05 +01:00
b12db7b633
Retrieves saved session lists etc to loot and exports information in CSV format
2015-05-17 14:59:26 +01:00
1177f42263
Renamed module to remain consistent with other enum modules
2015-05-17 14:38:25 +01:00
18a9dfd6da
Added PAGEANT_REGISTRY_KEY variable to enhance readability
2015-05-17 14:37:59 +01:00
4a416bba3c
Fixed notes using :unique_data
2015-05-17 13:24:38 +01:00
8aa27eee94
report_note only appears to allow one note per host/type combo...
2015-05-17 13:06:17 +01:00
53311fda2e
Fixed logic & added notes storage
2015-05-17 13:02:58 +01:00
5d273d53b4
Fixed module logic so that the key fingerprints now get displayed properly:
2015-05-15 22:02:12 +01:00
fd1a24d6f9
some more minor cleanup noise
...
apparently we standardized on using get_env
instead of expand_path in these cases. Not sure
on the effective difference here but no big deal
MSP-12358
2015-05-15 13:33:48 -05:00
4a88790c8c
Added SSH host keys
2015-05-15 17:57:15 +01:00
631dfc0a0e
increase timeout on ntdsutil
...
default timeout is 15 seconds. we'll give it 90
seconds for now. This may still be too short for
really really large domains, but too long of a timeout
can create other issues
MSP-12358
2015-05-15 11:19:35 -05:00
a3d91dff0b
clean up ntds.dit file when done
...
delete the ntds.dit file we copied when
we are done
MSP-12358
2015-05-15 11:13:19 -05:00
ac04b8d1e7
a little bit of cleanup
...
constantise some of the magic numbers in
the NTDS Account class
MSP-12358
2015-05-15 10:47:31 -05:00
14035a46b1
Fixed description
2015-05-15 16:28:51 +01:00
f65207ac40
Initial version, working
...
Needs tidying up.
Current version:
* Searches for PuTTY registry keys
* Downloades the Hostname, port, private key filename, username to log in as and any port forwarding instructions
* If the private keys are accessible on the box, download them to loot
To do:
* Detect whether pageant is running or not and report back
* Tidy up code (used another plugin as a template)
2015-05-15 16:23:39 +01:00
2721be946a
also check Wow6432Node keys
2015-05-15 14:28:12 +02:00
724b7c6f16
save the ntlm hases as creds
...
the last step is now complete. the current and historical
hashes are all saved to the database for cracking and/or
replay
MSP-12358
2015-05-14 13:52:11 -05:00
452fc6b149
Merge branch 'feature/MSP-12357/meterp-ntds' into feature/MSP-12358/ntds-dump-module
2015-05-14 10:31:28 -05:00
0e666d5732
gaurd against arch mismatch
...
this will not work from an x86 proc
on an x64 machine, so guard against that.
MSP-12358
2015-05-13 15:28:11 -05:00
9308da7956
2003 code path working
...
using VSS directly on server 2003 and repairing
the database with esentutl is now working
MSP-12358
2015-05-13 12:25:44 -05:00
21004046c1
begin parsing of the database
...
clean up and begin aprsing the database
after we have copied it
MSP-12358
2015-05-11 14:48:12 -05:00
028f9dd43b
Tidy and rubocop
2015-05-09 10:48:07 +01:00
e9dc93f345
Use cmd_exec
2015-05-09 10:44:02 +01:00
8c3a97667a
use get_env instead of client.sys.config.getenv
2015-05-08 15:25:20 -04:00
b2ce2ddb05
determine the domain using env vars instead of parsing net.exe output
2015-05-08 14:17:49 -04:00
3c9c578a3d
ntdsutil method in place
...
ntdsutil method built out to make a copy
of ntds.dit on later version of Winbdows Server
MSP-12358
2015-05-04 15:35:36 -05:00
e0c64038a7
start new ddomain hashdump post module
...
module checks for all preconditions so far
including that Domain Services are running,
that we are Admin, that we have bypassed uac
and that it is a supported version of windows.
MSP-12358
2015-05-04 15:07:27 -05:00
eb8fdcc2f2
Typo
2015-04-29 10:45:49 +01:00
4072cbd4d3
Bitlocker -> BitLocker
2015-04-29 10:02:21 +01:00
7e5b03c44e
Tidyup and update for new ADSI format
2015-04-29 09:48:44 +01:00
Stuart Morgan