Haha, well, my next module was going to be generating a keyword list
similar to 'strings'.  So if you've already started on this, it would save
this ruby idiot from hacking his way through the basics.


On Wed, Nov 27, 2013 at 11:47 AM, Josh <notifications@github.com> wrote:

> In modules/post/windows/gather/forensics/gather_browser_history.rb:
>
> > +class Metasploit3 < Msf::Post
> > +
> > +  include Msf::Post::File
> > +  include Msf::Post::Windows::UserProfiles
> > +  include Msf::Post::Windows::Registry
> > +
> > +  def initialize(info={})
> > +    super( update_info( info,
> > +        'Name' => 'Windows Gather Skype, Firefox, and Chrome Artifacts',
> > +        'Description' => %q{'Gathers Skype chat logs, Firefox history, and Chrome history data from the victim machine.'},
> > +        'License' => MSF_LICENSE,
> > +        'Author' => [ 'Joshua Harper (@JonValt) <josh at radixtx dot com>'],
> > +        'Platform' => %w{ win },
> > +        'SessionTypes' => [ 'meterpreter' ]
> > +      ))
> > +    register_advanced_options([], self.class)
>
> yeah, that's the one ;) I'm trying to find the code now... it's eluded me
> so far. It was based on a tool, the name of which is also escaping me, but
> it skims the disk & mem when possible to look for interesting strings. It's
> not so much for incident forensics as it is for intelligence gathering, but
> it's interesting nonetheless. It's equivalent to doing dd | strings | grep
> on entire partitions. Matter of fact, the post module did exactly that, but
> tried to be as smart as possible about it. The actual tool I mentioned
> doesn't do that, it's a native app instead.
> … <#1429aac4be508594_>
> -Josh (ks)
> On Nov 27, 2013, at 11:34 AM, Joshua Harper PI GCFE GCFA GSEC <
> notifications@github.com> wrote: In
> modules/post/windows/gather/forensics/gather_browser_history.rb: > +class
> Metasploit3 < Msf::Post > + > + include Msf::Post::File > + include
> Msf::Post::Windows::UserProfiles > + include Msf::Post::Windows::Registry >
> + > + def initialize(info={}) > + super( update_info( info, > + 'Name' =>
> 'Windows Gather Skype, Firefox, and Chrome Artifacts', > + 'Description' =>
> %q{'Gathers Skype chat logs, Firefox history, and Chrome history data from
> the victim machine.'}, > + 'License' => MSF_LICENSE, > + 'Author' => [
> 'Joshua Harper (@JonValt <https://github.com/JonValt>) <josh at radixtx
> dot com>'], > + 'Platform' => %w{ win }, > + 'SessionTypes' => [
> 'meterpreter' ] > + )) > + register_advanced_options([], self.class) Ah,
> kernelsmith. In my email client, it came from "notifications @ github" and
> was signed "josh." Makes sense now. :-P — Reply to this email directly or
> view it on GitHub.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/rapid7/metasploit-framework/pull/2675/files#r7964443>
> .
>



-- 
Joshua Harper GCFE GCFA GSEC PI
Digital Forensic Analyst, Radix Forensics LLC
Austin, TX

http://www.RadixForensics.com
http://www.facebook.com/RadixForensics