{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4773","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4773/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4773/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4773/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/4773","id":57853135,"number":4773,"title":"Cannot retrieve credentials with Firefox post module","user":{"login":"DrDinosaur","id":4646697,"avatar_url":"https://avatars.githubusercontent.com/u/4646697?v=3","gravatar_id":"","url":"https://api.github.com/users/DrDinosaur","html_url":"https://github.com/DrDinosaur","followers_url":"https://api.github.com/users/DrDinosaur/followers","following_url":"https://api.github.com/users/DrDinosaur/following{/other_user}","gists_url":"https://api.github.com/users/DrDinosaur/gists{/gist_id}","starred_url":"https://api.github.com/users/DrDinosaur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DrDinosaur/subscriptions","organizations_url":"https://api.github.com/users/DrDinosaur/orgs","repos_url":"https://api.github.com/users/DrDinosaur/repos","events_url":"https://api.github.com/users/DrDinosaur/events{/privacy}","received_events_url":"https://api.github.com/users/DrDinosaur/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-16T21:28:07Z","updated_at":"2015-02-17T17:03:50Z","closed_at":null,"body":"Hi, I'm having errors with the following module:\r\n\r\nName: Multi Gather Firefox Signon Credential Collection\r\nModule: post/multi/gather/firefox_creds\r\n\r\n```\r\nmsf post(firefox_creds) > exploit\r\n[*] Determining session platform and type...\r\n[-] Error loading USER S-1-5-21-1235416723-3835986592-711878957-1000: Profile doesn't exist or cannot be accessed\r\n[-] Error loading USER S-1-5-21-1235416723-3835986592-711878957-500: Profile doesn't exist or cannot be accessed\r\n[-] Unexpected windows error 1332\r\n[-] Post failed: NoMethodError undefined method `[]' for nil:NilClass\r\n[-] Call stack:\r\n[-]   /usr/share/metasploit-framework/lib/msf/core/post/windows/user_profiles.rb:53:in `parse_profile'\r\n[-]   /usr/share/metasploit-framework/lib/msf/core/post/windows/user_profiles.rb:41:in `block in parse_profiles'\r\n[-]   /usr/share/metasploit-framework/lib/msf/core/post/windows/user_profiles.rb:40:in `each'\r\n[-]   /usr/share/metasploit-framework/lib/msf/core/post/windows/user_profiles.rb:40:in `parse_profiles'\r\n[-]   /usr/share/metasploit-framework/lib/msf/core/post/windows/user_profiles.rb:20:in `grab_user_profiles'\r\n[-]   /usr/share/metasploit-framework/modules/post/multi/gather/firefox_creds.rb:149:in `run'\r\n[*] Post module execution completed\r\n```\r\n```\r\nmeterpreter > sysinfo\r\nComputer        : WORKSTATION1\r\nOS              : Windows 7 (Build 7601, Service Pack 1).\r\nArchitecture    : x64\r\nSystem Language : en_US\r\nMeterpreter     : x64/win64\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/74704900","html_url":"https://github.com/rapid7/metasploit-framework/issues/4773#issuecomment-74704900","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4773","id":74704900,"user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"created_at":"2015-02-17T17:03:50Z","updated_at":"2015-02-17T17:03:50Z","body":"The issue looks legit. He's hitting this code path:\r\nhttps://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/post/windows/accounts.rb#L167\r\n\r\n```resolve_sid``` may return nil, but ```parse_profile``` doesn't check this:\r\nhttps://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/post/windows/user_profiles.rb#L53\r\n\r\nLine 53 is where the backtrace reports.\r\n\r\nI think ```parse_profile``` should check nil for resolve_sid. If it's nil, return an empty hash, and then the firefox_creds module already knows how to properly handle an empty hash."}}