GitHub PullRequestEvent at 2014-08-31 19:08:12
Repository: metasploit-framework
Actor: TomSellers
Payload: {"action":"opened","number":3730,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3730","id":20548476,"html_url":"https://github.com/rapid7/metasploit-framework/pull/3730","diff_url":"https://github.com/rapid7/metasploit-framework/pull/3730.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/3730.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/3730","number":3730,"state":"open","locked":false,"title":"Module: Credentials - Remote Desktop Connection Manager","user":{"login":"TomSellers","id":6500426,"avatar_url":"https://avatars.githubusercontent.com/u/6500426?v=2","gravatar_id":"18b60361b6ef2bc65e123159a8ab8e76","url":"https://api.github.com/users/TomSellers","html_url":"https://github.com/TomSellers","followers_url":"https://api.github.com/users/TomSellers/followers","following_url":"https://api.github.com/users/TomSellers/following{/other_user}","gists_url":"https://api.github.com/users/TomSellers/gists{/gist_id}","starred_url":"https://api.github.com/users/TomSellers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TomSellers/subscriptions","organizations_url":"https://api.github.com/users/TomSellers/orgs","repos_url":"https://api.github.com/users/TomSellers/repos","events_url":"https://api.github.com/users/TomSellers/events{/privacy}","received_events_url":"https://api.github.com/users/TomSellers/received_events","type":"User","site_admin":false},"body":"**Description**\r\n\r\nThis is a new post module that extracts and decrypts saved Microsoft Remote Desktop Connection Manager (RDCMan) [1] passwords the .RDG files of users.  The module will attempt to find the files configured for all users on the target system. Passwords for managed hosts are encrypted by default.  In order for decryption of these passwords to be successful, this module must be executed under the same account as the user which originally encrypted the password.  Passwords that have been stored in plain text will be captured and documented irrespective of the context of the Meterpreter session.\r\n\r\nThe module will also document any configured RDP gateways or custom port numbers.\r\n\r\n**Verification**\r\n\r\n- [ ] Install and configure MS Remote Desktop Connection Manager [1][2]\r\n- [ ] Configure/mockup test connections in various configurations [3]\r\n- [ ] Launch msfconsole\r\n- [ ] Verify that the database is connected\r\n- [ ] Establish Meterpreter on Windows target running in context your test user, migrate if needed\r\n- [ ] ```use post/windows/gather/credentials/rdcmanager_creds````\r\n- [ ] ````set SESSION <session_id_of_meterp_above>````\r\n- [ ] ````run````\r\n     - [ ]  Results including passwords should be printed to console\r\n- [ ]  ````creds````\r\n- [ ]  __VERIFY__ that information in the module's console output is listed correctly in the output of ````creds````\r\n- [ ]  __VERIFY__ that the configuration of the test RDC Manager is listed correctly in the output of ````creds````\r\n\r\n\r\nMy testing was performed using 'exploit/windows/smb/psexec' with 'payload windows/meterpreter/reverse_tcp' against Windows 2008 R2 using MS Remote Desktop Connection Manager 2.2.  Testing was performed as SYSTEM, as a user that created the file, and as a user who could read the .RDG files but did not create them.\r\n\r\n\r\nReferences:\r\n1. Installer - http://www.microsoft.com/en-us/download/details.aspx?id=21101\r\n\r\n2. Setup Instructions: http://blogs.msdn.com/b/stuartleeks/archive/2014/01/15/using-remote-desktop-connection-manager-rdc-man-with-windows-azure-virtual-machines.aspx\r\n\r\n3. Sample complex .RDG file - https://gist.github.com/TomSellers/64c9624c59ea5951130e \r\n     - [ ]  Download the contents of the link above and save to 'RDCMan_test.rdg'.  \r\n     - [ ]  Open with RDC Manager and view settings. \r\n     - [ ]  Close RDC Manager.","created_at":"2014-08-31T19:08:10Z","updated_at":"2014-08-31T19:08:10Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3730/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3730/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/3730/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/20a02a9d29b0f896966e53b84373ddda7111c945","head":{"label":"TomSellers:module/post/windows/gather/credentials/rdcmanager","ref":"module/post/windows/gather/credentials/rdcmanager","sha":"20a02a9d29b0f896966e53b84373ddda7111c945","user":{"login":"TomSellers","id":6500426,"avatar_url":"https://avatars.githubusercontent.com/u/6500426?v=2","gravatar_id":"18b60361b6ef2bc65e123159a8ab8e76","url":"https://api.github.com/users/TomSellers","html_url":"https://github.com/TomSellers","followers_url":"https://api.github.com/users/TomSellers/followers","following_url":"https://api.github.com/users/TomSellers/following{/other_user}","gists_url":"https://api.github.com/users/TomSellers/gists{/gist_id}","starred_url":"https://api.github.com/users/TomSellers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TomSellers/subscriptions","organizations_url":"https://api.github.com/users/TomSellers/orgs","repos_url":"https://api.github.com/users/TomSellers/repos","events_url":"https://api.github.com/users/TomSellers/events{/privacy}","received_events_url":"https://api.github.com/users/TomSellers/received_events","type":"User","site_admin":false},"repo":{"id":18952350,"name":"metasploit-framework","full_name":"TomSellers/metasploit-framework","owner":{"login":"TomSellers","id":6500426,"avatar_url":"https://avatars.githubusercontent.com/u/6500426?v=2","gravatar_id":"18b60361b6ef2bc65e123159a8ab8e76","url":"https://api.github.com/users/TomSellers","html_url":"https://github.com/TomSellers","followers_url":"https://api.github.com/users/TomSellers/followers","following_url":"https://api.github.com/users/TomSellers/following{/other_user}","gists_url":"https://api.github.com/users/TomSellers/gists{/gist_id}","starred_url":"https://api.github.com/users/TomSellers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TomSellers/subscriptions","organizations_url":"https://api.github.com/users/TomSellers/orgs","repos_url":"https://api.github.com/users/TomSellers/repos","events_url":"https://api.github.com/users/TomSellers/events{/privacy}","received_events_url":"https://api.github.com/users/TomSellers/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/TomSellers/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/TomSellers/metasploit-framework","forks_url":"https://api.github.com/repos/TomSellers/metasploit-framework/forks","keys_url":"https://api.github.com/repos/TomSellers/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/TomSellers/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/TomSellers/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/TomSellers/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/TomSellers/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/TomSellers/metasploit-framework/events","assignees_url":"https://api.github.com/repos/TomSellers/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/TomSellers/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/TomSellers/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/TomSellers/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/TomSellers/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/TomSellers/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/TomSellers/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/TomSellers/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/TomSellers/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/TomSellers/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/TomSellers/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/TomSellers/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/TomSellers/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/TomSellers/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/TomSellers/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/TomSellers/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/TomSellers/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/TomSellers/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/TomSellers/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/TomSellers/metasploit-framework/merges","archive_url":"https://api.github.com/repos/TomSellers/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/TomSellers/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/TomSellers/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/TomSellers/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/TomSellers/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/TomSellers/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/TomSellers/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/TomSellers/metasploit-framework/releases{/id}","created_at":"2014-04-19T22:25:17Z","updated_at":"2014-08-03T23:44:22Z","pushed_at":"2014-08-31T19:02:21Z","git_url":"git://github.com/TomSellers/metasploit-framework.git","ssh_url":"git@github.com:TomSellers/metasploit-framework.git","clone_url":"https://github.com/TomSellers/metasploit-framework.git","svn_url":"https://github.com/TomSellers/metasploit-framework","homepage":"","size":244039,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"1cdf1c2c6efd3606977553f7eadaca6648791e61","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=2","gravatar_id":"5d198df57a51ac06525bfa48c3ff9f6c","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=2","gravatar_id":"5d198df57a51ac06525bfa48c3ff9f6c","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2014-08-30T13:57:57Z","pushed_at":"2014-08-29T17:46:14Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":963025,"stargazers_count":2473,"watchers_count":2473,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"forks_count":2232,"mirror_url":null,"open_issues_count":91,"forks":2232,"open_issues":91,"watchers":2473,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3730"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/3730"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/3730"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/3730/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3730/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3730/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/20a02a9d29b0f896966e53b84373ddda7111c945"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":2,"additions":230,"deletions":0,"changed_files":1}}