rapid7/metasploit-framework — pull request #3599 by jhart-r7 (2014-08-01 01:02:45+00:00)
Title: Add Remmina RDP/SSH/VNC password gathering

The other day I had to use Remmina, a utility on Linux that (among other things) supports Network Layer Authentication (NLA) for RDP. The system in question was configured to only allow RDP with NLA so I had no choice but to use this client. I was surprised to find that it saved my credentials and didn't use a keyring/etc. As it turns out, this is on purpose -- http://remmina.sourceforge.net/faq.shtml. So I tossed together a module to rip out my creds, because the though of having to use a client that puts my credentials at risk just to connect to a *more* secure host just feels wrong.

Validation:

1) Install Remmina (available for (at least) Ubuntu 12.04, OS X)
2) Start Remmina, add a few saved connections of different types
3) Run this module. In non-verbose mode:
```
msf post(remmina_creds) > ) > SESSION 1
SESSION => 1
msf post(remmina_creds) > run

[+] Collected 6 sets of Remmina credentials
[*] Post module execution completed
msf post(remmina_creds) > creds

Credentials
===========

host port user pass type proof active?
---- ---- ---- ---- ---- ----- -------
10.0.1.10 3389 rdpuser1 rdppass1 password true
10.0.1.10 3389 rdpuser2 rdppass2 password true
10.0.1.10 3389 rdpuser3 rdppass3 password true
10.0.1.10 5900 vncuser1 vncpass1 password true
10.0.1.10 22 sftpuser1 password true
10.0.1.10 22 sshuser1 password true
```
Verbose:
```
msf post(remmina_creds) > run

[*] Searching for Remmina creds in 40 user directories
[*] Extracted secret Y8jO4HRbVjdSL7XugAHiI0nujS7PjJf4jUj1qtueFD4= from /home/jhart/.remmina/remmina.pref
[+] Collected 6 sets of Remmina credentials
[*] Post module execution completed
msf post(remmina_creds) > creds
...
```

I am not sure what host value I should be using for report_auth_info, though. When it encounters 'localhost' it blows up and when I use the value obtained from the configuration, it also complains:

```
[-] Post failed: ArgumentError Invalid address or object for :host ("sshhost1")
[-] Call stack:
[-] /home/jhart/labs/git/metasploit-framework/lib/msf/core/db.rb:1513:in `report_auth_info'
[-] /home/jhart/labs/git/metasploit-framework/lib/msf/core/auxiliary/report.rb:119:in `report_auth_info'
[-] /home/jhart/labs/git/metasploit-framework/modules/post/multi/gather/remmina_creds.rb:36:in `block in run'
```

I checked a few other similar modules and I'm not yet sure what is wrong with this.

Enjoy!