martinvigo/metasploit-framework — pull request #1 by jhart-r7 (2014-10-17 18:57:23+00:00)
Title: Refactoring of LastPass post module

There were two primary goals with this refactoring:

* Clean up the code a bit
* Store the browser from which the LastPass creds were looted

Tested it on Linux w/ Chrome and Firefox:

```
msf post(lastpass_creds) > run

[*] Searching for LastPass databases...
[*] Found user: jhart
[*] Checking in Chrome...
[+] Found 1 database/s in Chrome
[*] Checking in Firefox...
[+] Found 1 profile files in Firefox
[*] Looking for credentials in all databases found...
[*] Decrypting password for user jon_hart@rapid7.com from Chrome...
[*] Decrypting password for user jon_hart@rapid7.com from Firefox...
[+] LastPass credentials
====================

Username Password Browser
-------- -------- -------
jon_hart@rapid7.com blah1 Chrome
jon_hart@rapid7.com blah2 Firefox
```

On Windows with Chrome, Firefox, Safari and Opera:

```
msf post(lastpass_creds) > run

[*] Searching for LastPass databases...
[*] Found user: user
[*] Found user: cyg_server
[*] Found user: Administrator
[*] Checking in Chrome...
[+] Found 1 database/s in Chrome
[*] Checking in Firefox...
[+] Found 1 profile files in Firefox
[*] Checking in Opera...
[+] Found 1 database/s in Opera
[*] Checking in Safari...
[+] Found 1 database/s in Safari
[*] Looking for credentials in all databases found...
[*] Decrypting password for user jon_hart@rapid7.com from Chrome...
[*] Decrypting password for user jon_hart@rapid7.com from Opera...
[*] Decrypting password for user jon_hart@rapid7.com from Safari...
[+] LastPass credentials
====================

Username Password Browser
-------- -------- -------
jon_hart@rapid7.com blah Chrome
jon_hart@rapid7.com blah Opera
jon_hart@rapid7.com blah Safari
```
(No, blah is not my password -- I changed it)

I don't yet know why Firefox on Windows isn't working, but it doesn't appear to have worked in the original PR either (it is also hard to tell because the creds in the original didn't retain the browser from which they were obtained)