Added support for importing Metasploit credentials (closes issue #89)

cme/cmedb.py

@@ -11,7 +11,9 @@ import sqlite3
 import sys
 import os
 import argparse
+from time import sleep
 from ConfigParser import ConfigParser
+from cme.msfrpc import Msfrpc
 from cme.database import CMEDatabase
 from cme.helpers import validate_ntlm
 
@@ -127,10 +129,49 @@ class CMEDatabaseNavigator(cmd.Cmd):
             except ConnectionError as e:
                 print "[-] Unable to connect to Empire's RESTful API server: {}".format(e)
 
+        elif line == 'metasploit':
+            msf = Msfrpc({'host': self.config.get('Metasploit', 'rpc_host'), 
+                          'port': self.config.get('Metasploit', 'rpc_port')})
+
+            try:
+                msf.login('msf', self.config.get('Metasploit', 'password'))
+            except MsfAuthError:
+                print "[-] Error authenticating to Metasploit's MSGRPC server!"
+                return
+
+            console_id = str(msf.call('console.create')['id'])
+
+            msf.call('console.write', [console_id, 'creds\n'])
+
+            sleep(2)
+
+            creds = msf.call('console.read', [console_id])
+
+            for entry in creds['data'].split('\n'):
+                cred = entry.split()
+                try:
+                    host = cred[0]
+                    port = cred[2]
+                    proto = cred[3]
+                    username = cred[4]
+                    password = cred[5]
+                    cred_type = cred[6]
+
+                    if port == '445/tcp' and proto == '(smb)':
+                        if cred_type == 'Password':
+                            self.db.add_credential('plaintext', '', username, password)
+                
+                except IndexError:
+                    continue
+
+            msf.call('console.destroy', [console_id])
+
+            print "[+] Metasploit credential import successful"
+
     def complete_import(self, text, line, begidx, endidx):
         "Tab-complete 'import' commands."
         
-        commands = ["empire"]
+        commands = ["empire", "metasploit"]
 
         mline = line.partition(' ')[2]
         offs = len(mline) - len(text)

cme/msfrpc.py

@@ -0,0 +1,83 @@
+#! /usr/bin/env python2.7
+
+# MSF-RPC - A  Python library to facilitate MSG-RPC communication with Metasploit
+
+# Copyright (c) 2014-2016 Ryan Linn  - RLinn@trustwave.com, Marcello Salvati - byt3bl33d3r@gmail.com
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+# USA
+#
+
+import msgpack
+import logging
+import requests
+
+class Msfrpc:
+
+    class MsfError(Exception):
+        def __init__(self,msg):
+            self.msg = msg
+        def __str__(self):
+            return repr(self.msg)
+
+    class MsfAuthError(MsfError):
+        def __init__(self,msg):
+            self.msg = msg
+    
+    def __init__(self,opts=[]):
+        self.host = opts.get('host') or "127.0.0.1"
+        self.port = opts.get('port') or "55552"
+        self.uri = opts.get('uri') or "/api/"
+        self.ssl = opts.get('ssl') or False
+        self.token = None
+        self.headers = {"Content-type" : "binary/message-pack"}
+
+    def encode(self, data):
+        return msgpack.packb(data)
+
+    def decode(self, data):
+        return msgpack.unpackb(data)
+
+    def call(self, method, opts=[]):
+        if method != 'auth.login':
+            if self.token == None:
+                raise self.MsfAuthError("MsfRPC: Not Authenticated")
+
+        if method != "auth.login":
+            opts.insert(0, self.token)
+
+        if self.ssl == True:
+            url = "https://%s:%s%s" % (self.host, self.port, self.uri)
+        else:
+            url = "http://%s:%s%s" % (self.host, self.port, self.uri)
+    
+
+        opts.insert(0, method)
+        payload = self.encode(opts)
+
+        r = requests.post(url, data=payload, headers=self.headers)
+
+        opts[:] = [] #Clear opts list
+        
+        return self.decode(r.content)
+
+    def login(self, user, password):
+        auth = self.call("auth.login", [user, password])
+        try:
+            if auth['result'] == 'success':
+                self.token = auth['token']
+                return True
+        except:
+            raise self.MsfAuthError("MsfRPC: Authentication failed")

requirements.txt

@@ -5,4 +5,5 @@ pycrypto
 pyasn1
 termcolor
 requests
-pyOpenSSL
+pyOpenSSL
+msgpack-python