{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4679","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4679/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4679/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4679/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/4679","id":56070778,"number":4679,"title":"Add an NTFS parser and a post module to dump files","user":{"login":"danilbaz","id":10693088,"avatar_url":"https://avatars.githubusercontent.com/u/10693088?v=3","gravatar_id":"","url":"https://api.github.com/users/danilbaz","html_url":"https://github.com/danilbaz","followers_url":"https://api.github.com/users/danilbaz/followers","following_url":"https://api.github.com/users/danilbaz/following{/other_user}","gists_url":"https://api.github.com/users/danilbaz/gists{/gist_id}","starred_url":"https://api.github.com/users/danilbaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danilbaz/subscriptions","organizations_url":"https://api.github.com/users/danilbaz/orgs","repos_url":"https://api.github.com/users/danilbaz/repos","events_url":"https://api.github.com/users/danilbaz/events{/privacy}","received_events_url":"https://api.github.com/users/danilbaz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/library","name":"library","color":"fad8c7"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-01-30T18:58:59Z","updated_at":"2015-01-30T23:36:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4679","html_url":"https://github.com/rapid7/metasploit-framework/pull/4679","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4679.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4679.patch"},"body":"This commit add a draft of an NTFS Parser and a post module\r\nto gather files using the raw NTFS device (\\\\\\\\.\\\\C:)\r\nbypassing restriction like already open file with lock\r\nCan be used to retreive files like NTDS.DIT without volume shadow copy\r\n\r\n```\r\nmsf exploit(handler) > use post/windows/gather/file_in_raw_ntfs\r\nmsf post(file_in_raw_ntfs) > set FILE C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\r\nFILE => C:\\Windows\\System32\\drivers\\etc\\hosts\r\nmsf post(file_in_raw_ntfs) > set SESSION 1\r\nSESSION => 1\r\nmsf post(file_in_raw_ntfs) > run\r\n\r\n[*] Successfuly opened C:\r\n[*] Saving file hosts\r\n[*] Post Successfuly\r\n[*] Post module execution completed\r\nmsf post(file_in_raw_ntfs) > cat hosts\r\n[*] exec: cat hosts\r\n\r\n# Copyright (c) 1993-2009 Microsoft Corp.\r\n#\r\n# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.\r\n#\r\n# This file contains the mappings of IP addresses to host names. Each\r\n# entry should be kept on an individual line. The IP address should\r\n# be placed in the first column followed by the corresponding host name.\r\n# The IP address and the host name should be separated by at least one\r\n# space.\r\n#\r\n# Additionally, comments (such as these) may be inserted on individual\r\n# lines or following the machine name denoted by a '#' symbol.\r\n#\r\n# For example:\r\n#\r\n#      102.54.94.97     rhino.acme.com          # source server\r\n#       38.25.63.10     x.acme.com              # x client host\r\n\r\n# localhost name resolution is handled within DNS itself.\r\n#\t127.0.0.1       localhost\r\n#\t::1             localhost\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/72289558","html_url":"https://github.com/rapid7/metasploit-framework/pull/4679#issuecomment-72289558","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4679","id":72289558,"user":{"login":"Meatballs1","id":1854557,"avatar_url":"https://avatars.githubusercontent.com/u/1854557?v=3","gravatar_id":"","url":"https://api.github.com/users/Meatballs1","html_url":"https://github.com/Meatballs1","followers_url":"https://api.github.com/users/Meatballs1/followers","following_url":"https://api.github.com/users/Meatballs1/following{/other_user}","gists_url":"https://api.github.com/users/Meatballs1/gists{/gist_id}","starred_url":"https://api.github.com/users/Meatballs1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Meatballs1/subscriptions","organizations_url":"https://api.github.com/users/Meatballs1/orgs","repos_url":"https://api.github.com/users/Meatballs1/repos","events_url":"https://api.github.com/users/Meatballs1/events{/privacy}","received_events_url":"https://api.github.com/users/Meatballs1/received_events","type":"User","site_admin":false},"created_at":"2015-01-30T23:36:11Z","updated_at":"2015-01-30T23:36:11Z","body":"My main concern with this module would be the performance on large files, or over non-local connections. I fear it might be better suited implemented as a native meterpreter plugin."}}