You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This module has a generic name (enum_psk). A more appropriate name would be enum_wifi_psk; although it is generally expected that PSK relates to WiFi pre-shared keys.
This module retrieves WiFi PSKs stored by NetworkManager only:
OptString.new('DIR',[true,'The path for NetworkManager configuration files','/etc/NetworkManager/system-connections/'])
This module has seen no major updates since it was added in 2014.
There are other WiFi management software for Linux which may store WiFi passwords in different formats in different places on the file system.
Unfortunately, as the default hard-coded path for the DIR option is specific to NetworkManager, updates to this module to support other software may break backwards compatibility for existing workflows.
Note also that the existing PSK parsing logic contains a flaw which will truncate all characters after the first = character in a PSK:
Get a session on any WiFi-connected host which does not use NetworkManager to store WiFi credentials
use post/linux/gather/enum_psk
set session <session>
run
Observe no PSKs are identified
Example Configuration Files
Copilot also offers the following common WiFi configuration file locations:
Red Hat / RHEL / CentOS / Fedora: /etc/sysconfig/network-scripts/ifcfg-wlan0 or /etc/sysconfig/network-scripts/ifcfg-ethX
Debian / Ubuntu: /etc/network/interfaces
Arch Linux: /etc/netctl or /etc/wpa_supplicant/wpa_supplicant.conf
openSUSE: /etc/sysconfig/network/ifcfg-wlan0
Here is an example netplan configuration file from an Armbian Linux system:
# cat /etc/netplan/30-wifis-dhcp.yaml # Created by Armbian firstlogin scriptnetwork:
wifis:
wlan0:
dhcp4: yesdhcp6: yesaccess-points:
"my_ssid":
password: "my_password"
Note that the PSK is stored in YAML format. The existing file parsing logic performs a lowercase match for lines beginning with psk= and would not identify the PSK if the user specified the correct DIR.
Note that the PSK is stored on a line beginning with PSK=. The existing file parsing logic performs a lowercase match for lines beginning with psk= and would not identify the PSK if the user specified the correct DIR.
Note that the PSK is stored on a line beginning with whitespace followed by psk=. The existing file parsing logic performs a lowercase match for lines beginning with psk= and would not identify the PSK if the user specified the correct DIR.
Note that the PSK is stored on a line beginning with Key=. The existing file parsing logic performs a lowercase match for lines beginning with psk= and would not identify the PSK if the user specified the correct DIR.
This issue has been left open with no activity for a while now.
We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.
bcoles
added
not-stale
Label to stop an issue from being auto closed
and removed
Stale
Marks an issue as stale, to be closed if no action is taken
labels
Dec 13, 2024
The post/linux/gather/enum_psk module file name and module name do not match and are misleading.
This module has a generic name (
enum_psk
). A more appropriate name would beenum_wifi_psk
; although it is generally expected that PSK relates to WiFi pre-shared keys.This module retrieves WiFi PSKs stored by NetworkManager only:
metasploit-framework/modules/post/linux/gather/enum_psk.rb
Line 16 in 1a6cf9d
metasploit-framework/modules/post/linux/gather/enum_psk.rb
Line 35 in 1a6cf9d
This module has seen no major updates since it was added in 2014.
There are other WiFi management software for Linux which may store WiFi passwords in different formats in different places on the file system.
Unfortunately, as the default hard-coded path for the
DIR
option is specific to NetworkManager, updates to this module to support other software may break backwards compatibility for existing workflows.Note also that the existing PSK parsing logic contains a flaw which will truncate all characters after the first
=
character in a PSK:metasploit-framework/modules/post/linux/gather/enum_psk.rb
Line 54 in 1a6cf9d
Steps to reproduce
use post/linux/gather/enum_psk
set session <session>
run
Example Configuration Files
Copilot also offers the following common WiFi configuration file locations:
Here is an example netplan configuration file from an Armbian Linux system:
Note that the PSK is stored in YAML format. The existing file parsing logic performs a lowercase match for lines beginning with
psk=
and would not identify the PSK if the user specified the correctDIR
.metasploit-framework/modules/post/linux/gather/enum_psk.rb
Line 52 in 1a6cf9d
Copilot offers the following example
/etc/sysconfig/network-scripts/ifcfg-wlan0
file:Note that the PSK is stored on a line beginning with
PSK=
. The existing file parsing logic performs a lowercase match for lines beginning withpsk=
and would not identify the PSK if the user specified the correctDIR
.metasploit-framework/modules/post/linux/gather/enum_psk.rb
Line 52 in 1a6cf9d
Copilot offers the following example
/etc/wpa_supplicant/wpa_supplicant.conf
file:Note that the PSK is stored on a line beginning with whitespace followed by
psk=
. The existing file parsing logic performs a lowercase match for lines beginning withpsk=
and would not identify the PSK if the user specified the correctDIR
.metasploit-framework/modules/post/linux/gather/enum_psk.rb
Line 52 in 1a6cf9d
Copilot offers the following example
/etc/netctl
file:Note that the PSK is stored on a line beginning with
Key=
. The existing file parsing logic performs a lowercase match for lines beginning withpsk=
and would not identify the PSK if the user specified the correctDIR
.metasploit-framework/modules/post/linux/gather/enum_psk.rb
Line 52 in 1a6cf9d
The text was updated successfully, but these errors were encountered: