Added module to enumerate through chocolatey applications #16381

rad10 · 2022-03-25T17:14:46Z

Tell us what this change does. If you're fixing a bug, please mention
the github issue number.

Please ensure you are submitting from a unique branch in your repository to master in Rapid7's.

Verification

List the steps needed to make sure this thing works

Start msfconsole
Get shell or meterpreter session on target
use post/windows/gather/enum_chocolatey_applications
set SESSION [ID]
run
Verify That it displays the version of chocolatey on the target
Verify that it displays a table of applications installed by chocolatey including their versions.
(https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/multi/gather/aws_keys.md))

This simply enters the machine and prints out all applications installed on the machine through chocolatey. Since not all applications installed through chocolatey show up in windows settings, it may be a good way to view other avenues for backdoors.

github-actions · 2022-03-25T17:38:21Z

Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools.

We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit:

rubocop <directory or file>
tools/dev/msftidy.rb <directory or file>

You can automate most of these changes with the -a flag:

rubocop -a <directory or file>

Please update your branch after these have been made, and reach out if you have any problems.

github-actions · 2022-03-25T17:38:22Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

sempervictus

This is handy, thankfully stumbled across it before i embarked on a duplicate effort.
I think it needs a tiny bit of fine-tuning, but definitely going to see some use once merged. Thanks @rad10

modules/post/windows/gather/enum_chocolatey_applications.rb

…ersions

sjanusz-r7 · 2022-03-28T10:28:51Z

After running a quick test:

payload/python/meterpreter/reverse_tcp (Windows)

msf6 post(windows/gather/enum_chocolatey_applications) > sessions

Active sessions
===============

  Id  Name  Type                       Information  Connection
  --  ----  ----                       -----------  ----------
  1         meterpreter python/python               192.168.129.1:4444 -> 192.168.129.131:49696  (192.168.129.131)

msf6 post(windows/gather/enum_chocolatey_applications) > run

[!] SESSION may not be compatible with this module:
[!]  * incompatible session platform: python
[*] Enumerating applications installed on DESKTOP-T5PBUMF
[*] Targets Chocolatey version: 0.12.1
[*] Getting chocolatey applications.
[+] Successfully grabbed all items
Installed Chocolatey Applications
=================================

 Name                       Version
 ----                       -------
 DotNet4.5.2                4.5.2.20140902
 chocolatey                 0.12.1
 chocolatey-core.extension  1.3.5.1
 vscode                     1.64.0
 vscode.install             1.64.0

[+] Results stored in: /Users/sjanusz/.msf4/loot/20220328111814_default_192.168.129.131_host.application_822234.txt
[*] Post module execution completed

payload/windows/x64/meterpreter/reverse_tcp

msf6 post(windows/gather/enum_chocolatey_applications) > sessions

Active sessions
===============

  Id  Name  Type                     Information                              Connection
  --  ----  ----                     -----------                              ----------
  3         meterpreter x64/windows  DESKTOP-T5PBUMF\simon @ DESKTOP-T5PBUMF  192.168.129.1:4444 -> 192.168.129.131:49723  (192.168.129.131)

msf6 post(windows/gather/enum_chocolatey_applications) > run

[*] Enumerating applications installed on DESKTOP-T5PBUMF
[*] Targets Chocolatey version: 0.12.1
[*] Getting chocolatey applications.
[+] Successfully grabbed all items
Installed Chocolatey Applications
=================================

 Name                       Version
 ----                       -------
 DotNet4.5.2                4.5.2.20140902
 chocolatey                 0.12.1
 chocolatey-core.extension  1.3.5.1
 vscode                     1.64.0
 vscode.install             1.64.0

[+] Results stored in: /Users/sjanusz/.msf4/loot/20220328152732_default_192.168.129.131_host.application_329130.txt
[*] Post module execution completed

modules/post/windows/gather/enum_chocolatey_applications.rb

space-r7

Hey @rad10, thank you for the module! I made a few suggestions based on some things I ran into while testing.

modules/post/windows/gather/enum_chocolatey_applications.rb

Added spelling corrections to descriptions Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

Changed at symbol in author Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

…ploit-framework into enum_chocolatey_applications

space-r7 · 2022-03-31T16:01:53Z

Hey @rad10, thanks for the updates! The changes look good to me. There was some discussion about consolidating the chocolatey? and chocopath methods amongst the team, but I can do that since it's a small change.

Edit: Going to keep the chocolatey? method after all. For some reason, cmd_exec() is throwing the error even when chocolatey is installed for me, so catching that in the chocolatey? method for each cmd_exec() call makes more sense.

space-r7 · 2022-03-31T17:03:08Z

Currently getting these results with the module:

Installed Chocolatey Applications
=================================

 Name                       Version
 ----                       -------
 Firefox                    98.0.2
 KB2919355                  1.0.20160915
 KB2919442                  1.0.20160915
 adobereader                2022.001.20085
 and                        0
 chocolatey                 1.1.0
 chocolatey-core.extension  1.3.5.1
 performed.                 1
 success(es),               1

It looks like the regex is capturing some extraneous data from the command. Here's the actual output from the chocolatey command that's run:

C:\Users\space>choco.exe list -lo
Chocolatey v1.1.0
2 validations performed. 1 success(es), 1 warning(s), and 0 error(s).

Validation Warnings:
 - A pending system reboot request has been detected, however, this is
   being ignored due to the current command being used 'list'.
   It is recommended that you reboot at your earliest convenience.

adobereader 2022.001.20085
chocolatey 1.1.0
chocolatey-core.extension 1.3.5.1
Firefox 98.0.2
KB2919355 1.0.20160915
KB2919442 1.0.20160915
6 packages installed.

space-r7 · 2022-03-31T19:29:12Z

modules/post/windows/gather/enum_chocolatey_applications.rb

+    )
+
+    # collecting all lines that match and placing them into table.
+    items = data.scan(/(\S+)\s(\d+(?:\.\d+)*)/m)


Per my earlier comment, it looks like this regex is grabbing data that's not related to the program name / version. I didn't test this extensively, but it seemed to work with the output I'm getting from chocolatey.

Suggested change

items = data.scan(/(\S+)\s(\d+(?:\.\d+)*)/m)

items = data.scan(/([\w\-\.]+)\s(v?\d+(?:\.\d+)*)\r?\n/)

Pry Output

[1] pry(#<Msf::Modules::Post__Windows__Gather__Enum_chocolatey_applications::MetasploitModule>)> data = cmd_exec(choco_path, 'list -lo') => "Chocolatey v1.1.0\r\n2 validations performed. 1 success(es), 1 warning(s), and 0 error(s).\r\n\r\nValidation Warnings:\r\n - A pending system reboot request has been detected, however, this is\r\n being ignored due to the current command being used 'list'.\r\n It is recommended that you reboot at your earliest convenience.\r\n\r\nadobereader 2022.001.20085\r\nchocolatey 1.1.0\r\nchocolatey-core.extension 1.3.5.1\r\nFirefox 98.0.2\r\nKB2919355 1.0.20160915\r\nKB2919442 1.0.20160915\r\n6 packages installed." [2] pry(#<Msf::Modules::Post__Windows__Gather__Enum_chocolatey_applications::MetasploitModule>)> items = data.scan(/([\w\-\.]+)\s(v?\d+(?:\.\d+)*)\r?\n/) => [["Chocolatey", "v1.1.0"], ["adobereader", "2022.001.20085"], ["chocolatey", "1.1.0"], ["chocolatey-core.extension", "1.3.5.1"], ["Firefox", "98.0.2"], ["KB2919355", "1.0.20160915"], ["KB2919442", "1.0.20160915"]]

Results table

Installed Chocolatey Applications ================================= Name Version ---- ------- Chocolatey v1.1.0 Firefox 98.0.2 KB2919355 1.0.20160915 KB2919442 1.0.20160915 adobereader 2022.001.20085 chocolatey 1.1.0 chocolatey-core.extension 1.3.5.1

I added a fix to the regex. I didnt invlude the v into the version because I notices that only chocolatey includes the v in the version for itself. Since theres no point in including chocolatey twice, I decided to not include it. I tested it on a sample of 300 packages, and this line managed to grab all of them and ignore the rest

Makes sense to me! Thanks!

space-r7 · 2022-04-01T16:15:40Z

Changes look good to me and confirmed that we get the program names and versions:

Target with Chocolatey applications

msf6 exploit(multi/handler) > use post/windows/gather/enum_chocolatey_applications 
msf6 post(windows/gather/enum_chocolatey_applications) > set session 1
session => 1
msf6 post(windows/gather/enum_chocolatey_applications) > run

[*] Enumerating applications installed on DESKTOP-P1UHERT
[*] Targets Chocolatey version: 1.1.0
[*] Getting chocolatey applications.
[+] Successfully grabbed all items
Installed Chocolatey Applications
=================================

 Name                       Version
 ----                       -------
 Firefox                    98.0.2
 KB2919355                  1.0.20160915
 KB2919442                  1.0.20160915
 adobereader                2022.001.20085
 chocolatey                 1.1.0
 chocolatey-core.extension  1.3.5.1

[*] Post module execution completed

Target without Chocolatey

msf6 post(**windows/gather/enum_chocolatey_applications**) > set session 2
session => 2
msf6 post(**windows/gather/enum_chocolatey_applications**) > run
  
**[-]** Post aborted due to failure: not-found: Chocolatey path not found
**[*]** Post module execution completed

space-r7 · 2022-04-01T16:19:01Z

I ended up adding an additional commit (79df619) that makes sure that chocopath() is only called once and returns nil if no path is found.

space-r7 · 2022-04-01T16:20:15Z

Release Notes

This adds a post module that enumerates applications installed with Chocolatey on Windows systems.

adfoster-r7 · 2022-04-01T19:32:54Z

Thanks for the module @rad10 🎉

rad10 · 2022-04-01T22:41:22Z

Glad to have contributed!

Added module to enumerate through chocolatey applications

840d26a

adfoster-r7 added needs-linting The module needs additional work to pass our automated linting rules needs-docs labels Mar 25, 2022

sempervictus suggested changes Mar 26, 2022

View reviewed changes

modules/post/windows/gather/enum_chocolatey_applications.rb Outdated Show resolved Hide resolved

modules/post/windows/gather/enum_chocolatey_applications.rb Outdated Show resolved Hide resolved

modules/post/windows/gather/enum_chocolatey_applications.rb Outdated Show resolved Hide resolved

rad10 added 9 commits March 26, 2022 13:26

Formatted document with rubocop

8248c1d

Renamed havechocolatey

2ae6d1f

Added notes on stability

0489655

Added option to change chocolatey path location in case its not on path

9cc6944

Removed use of powershell since its unnecessary

d65a2fd

Updated info values to allow info to work

86266ad

Added side effects back in since descriptions want them

8607fd7

Added better separation between chocolatey 1.0 and newer chocolatey v…

6ef3cf7

…ersions

Added documentation for module in docs folder

d3d9acf

adfoster-r7 reviewed Mar 28, 2022

View reviewed changes

modules/post/windows/gather/enum_chocolatey_applications.rb Show resolved Hide resolved

rad10 added 2 commits March 28, 2022 13:23

Made module not executable

ec3a5b9

Replaced loot with notes

447a3d4

rad10 marked this pull request as ready for review March 28, 2022 17:41

rad10 added 2 commits March 28, 2022 13:44

Cleaned with rubocop

dcec540

Added unique data to notes

ddf96d4

rad10 requested a review from adfoster-r7 March 28, 2022 18:45

Updated module documentation using msftidy

e8d18a6

space-r7 reviewed Mar 29, 2022

View reviewed changes

space-r7 self-assigned this Mar 29, 2022

space-r7 added module docs and removed needs-docs needs-linting The module needs additional work to pass our automated linting rules labels Mar 30, 2022

rad10 and others added 7 commits March 31, 2022 10:56

Update modules/post/windows/gather/enum_chocolatey_applications.rb

d361ce9

Added spelling corrections to descriptions Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

Apply suggestions from code review

6c92509

Changed at symbol in author Co-authored-by: Shelby Pace <40177151+space-r7@users.noreply.github.com>

Make chocolatey? act like correct bool function

f9156ac

Made chocopath correctly get choco based on where results

8177b10

Used fail statements where exit should fail

2ed4a4a

Merge branch 'enum_chocolatey_applications' of github.com:rad10/metas…

c6c77b9

…ploit-framework into enum_chocolatey_applications

Made chocopath give false if all other alternatives dont work

6f93329

rad10 requested a review from space-r7 March 31, 2022 15:37

space-r7 reviewed Mar 31, 2022

View reviewed changes

Made table regex properly only grab lines that are start lines

eb54081

rad10 requested a review from space-r7 April 1, 2022 15:34

space-r7 added a commit that referenced this pull request Apr 1, 2022

Land #16381, add chocolatey enumerator module

fc18093

space-r7 merged commit eb54081 into rapid7:master Apr 1, 2022

space-r7 added the rn-modules release notes for new or majorly enhanced modules label Apr 1, 2022

rad10 deleted the enum_chocolatey_applications branch April 1, 2022 22:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added module to enumerate through chocolatey applications #16381

Added module to enumerate through chocolatey applications #16381

rad10 commented Mar 25, 2022 •

edited

Loading

github-actions bot commented Mar 25, 2022

github-actions bot commented Mar 25, 2022

sempervictus left a comment

sjanusz-r7 commented Mar 28, 2022 •

edited

Loading

space-r7 left a comment

space-r7 commented Mar 31, 2022 •

edited

Loading

space-r7 commented Mar 31, 2022

space-r7 Mar 31, 2022

rad10 Apr 1, 2022

space-r7 Apr 1, 2022

space-r7 commented Apr 1, 2022

space-r7 commented Apr 1, 2022

space-r7 commented Apr 1, 2022

adfoster-r7 commented Apr 1, 2022

rad10 commented Apr 1, 2022

	items = data.scan(/(\S+)\s(\d+(?:\.\d+)*)/m)
	items = data.scan(/([\w\-\.]+)\s(v?\d+(?:\.\d+)*)\r?\n/)

Added module to enumerate through chocolatey applications #16381

Added module to enumerate through chocolatey applications #16381

Conversation

rad10 commented Mar 25, 2022 • edited Loading

Verification

github-actions bot commented Mar 25, 2022

github-actions bot commented Mar 25, 2022

sempervictus left a comment

Choose a reason for hiding this comment

sjanusz-r7 commented Mar 28, 2022 • edited Loading

payload/python/meterpreter/reverse_tcp (Windows)

payload/windows/x64/meterpreter/reverse_tcp

space-r7 left a comment

Choose a reason for hiding this comment

space-r7 commented Mar 31, 2022 • edited Loading

space-r7 commented Mar 31, 2022

space-r7 Mar 31, 2022

Choose a reason for hiding this comment

rad10 Apr 1, 2022

Choose a reason for hiding this comment

space-r7 Apr 1, 2022

Choose a reason for hiding this comment

space-r7 commented Apr 1, 2022

space-r7 commented Apr 1, 2022

space-r7 commented Apr 1, 2022

Release Notes

adfoster-r7 commented Apr 1, 2022

rad10 commented Apr 1, 2022

rad10 commented Mar 25, 2022 •

edited

Loading

sjanusz-r7 commented Mar 28, 2022 •

edited

Loading

space-r7 commented Mar 31, 2022 •

edited

Loading