Add OpenSSH password search module for Windows #18597
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jvoisin
reviewed
Dec 6, 2023
| ) | ||
| ) | ||
| register_options([ | ||
| OptInt.new('PID', [true, 'Process ID of OpenSSH to search through', nil]), |
There was a problem hiding this comment.
Couldn't this be automatically set?
jheysel-r7
reviewed
Dec 7, 2023
sjanusz-r7
force-pushed
the
add-windows-openssh-password-search
branch
from
e5cf39b to
2b770a7
Compare
sjanusz-r7
force-pushed
the
add-windows-openssh-password-search
branch
from
2b770a7 to
176e2a2
Compare
adfoster-r7
reviewed
Jan 5, 2024
adfoster-r7
reviewed
Jan 5, 2024
|
This seems to hang indefinitely for me; logs: Eventually the Meterpreter call gets marked as timed out on msfconsole, but then the process seems to spin endlessly behind the scenes still |
|
After retesting, it looks like the previous bug is fixed in 2.0.164 now 👍 I ran into another issue were I psexec'd a 32 bit meterpreter, and tried to dump ssh.exe - but I wasn't able to. I think this is might just be normal windows behavior, and we might not be able to tell the user that this has happened - but it'd be good if we could do something better there. We were thinking that this functionality is pretty dope, and isn't limited to just
Maybe to remove the boilerplate: class MemorySearchModule
# or maybe platforms could be passed in instead of the `update_info` pattern :shrug:
def initialize_memory_search_module(info = {}) # /*, platforms: [] */)
# ....
register_options([
])
info
end
end
class MetasploitModule
include MemorySearchModule
def initialize(options)
super(
update_info(
initialize_memory_search_module(options) # /*, platforms: [...] */),
# ...
'Platform' => ['...'],
)
)
end
end |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a module that can be used to extract passwords from active OpenSSH connections on Windows where a password has been used. Private keys do not seem to be getting leaked in the same way, if at all. The affected version was
OpenSSH_9.4p1, OpenSSL 3.1.2 1 Aug 2023, with 9.5 not being affected.This PR depends on changes made here: rapid7/metasploit-payloads#686
Similar to Mettle's memory search implementation, you can modify the needle and PID to search other programs for potentially sensitive information being stored near needles.
Verification
msfconsoleuse post/windows/gather/openssh_password_searchset SESSION <Session ID>set PID <Process ID>runWindows 10 - OpenSSH_9.4p1, OpenSSL 3.1.2 1 Aug 2023
In this scenario, the Windows target is connected to a different host using
ssh.exeusing the passwordmyverysecretpassword.Getting Connection Info
You can also see what the username and potentially the private key used to connect is. In the below examples, I've used a user called
putty-memsearch-testwith a private key present on the target machine's desktop.Connecting with username + password
Connecting with username + private key