Importing credentials from Empire and Metasploit

Importing credentials from Empire and Metasploit

CME is very much meant to be the 'glue' between Exploit/Post-Exploitation frameworks. With this in mind a lot of features have been added to make it as easy as possible to import credentials and information from Empire and Metasploit.

Importing credentials from Empire

The cmedb command line script can directly import credentials stored in Empire's database using it's RESTful API, making re-playing dumped credentials from Empire seamless. More information about the cmedb script and CME's database can be found here:

First start up Empire's RESTful API server:

#~ python empire --rest --user empireadmin --pass Password123!

[*] Loading modules from: /home/byt3bl33d3r/Tools/Empire/lib/modules/
 * Starting Empire RESTful API on port: 1337
 * RESTful API token: l5l051eqiqe70c75dis68qjheg7b19di7n8auzml
 * Running on https://0.0.0.0:1337/ (Press CTRL+C to quit)

The username and password that CME uses to authenticate to Empire's RESTful API are stored in the cme.conf file located at ~/.cme/cme.conf:

[Empire]
api_host=127.0.0.1
api_port=1337
username=empireadmin
password=Password123!

[Metasploit]
rpc_host=127.0.0.1
rpc_port=55552
password=abc123

To import Empire's credentials simply startup the cmedb script and run the import empire command:

#~ cmedb
cmedb > creds

Credentials:

  CredID  Admin On     CredType    Domain           UserName             Password
  ------  --------     --------    ------           --------             --------

cmedb > import empire
[+] Empire credential import successful
cmedb > creds

Credentials:

  CredID  Admin On     CredType    Domain           UserName             Password
  ------  --------     --------    ------           --------             --------
  1       0 Host(s)    hash        lab.local        yomama               e19ccf75ee54e06b06a5907af13cef42
  2       0 Host(s)    plaintext   lab.local        yomama               P@ssw0rd         

cmedb > 

Importing credentials from Metasploit

Coming Soon