I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs.

I am confused to whether this is illegal or not as there are hundreds of modules like this, however there is no ethical use for it other than for educational purposes or in a penetration test.

An example is this module here http://www.metasploit.com/modules/post/multi/gather/firefox_creds

*EDIT* My question is related only to development of a tool, not using it.

  • 1
    I think there's some confusion about your question here. Are you asking if your use of the tool is illegal, or if your participation in developing the tool is illegal? Ethically speaking, as long as you're not putting the tool to use (or deliberately and intentionally facilitating its distribution and use ) for unauthorized system penetration, then you should be in the clear. Laws are not always exactly aligned with reasonable ethics, though. – Iszi Apr 4 '12 at 17:44
  • I mean from the development side of things. – h00j Apr 4 '12 at 17:57
  • In Germany we have a hacker-tools law, that might outlaw this. But the interpretation of the law is still a bit unclear, and courts so far seem to have erred on the side of caution. – CodesInChaos Apr 4 '12 at 19:02

You gain unauthorized shell access, and THEN you wonder if gathering chat logs is legal? :) I guess I'm not sure what you are asking. You should already have permission to attempt to breach a computer before you even fire up Metasploit, so legality is determined long before your post modules.

From a penetration test perspective, if the client is looking for certain files or proofs from a host, then those file target are within scope. If the files you are scooping up contain clues that help you penetrate further, then they could also be in scope (as long as not specifically out-of-scope).

|improve this answer|||||
  • Purely from a development point of view. – h00j Apr 4 '12 at 17:56
  • My answer was for a development perspective. From a development point of view, performing the equivalent of a 'locate' and 'cat' on a system that you already have access to can't be considered illegal. In other words, I don't think that post modules are the sticky legal areas. They work when you already have unauthorized access. – schroeder Apr 4 '12 at 18:09

The tools themselves are not illegal to possess. What is illegal is attacking a computer system without authorization. For instance, it would be illegal to use these exploit toolkits to attack a system that you do not have permission to attack. However, it is legal to use these tools to attack your own system.

(This answer is based upon US law, but I would expect the law in many other countries to be similar.)

Developing tools that would only be of use to bad guys, and are of limited or no use to good guys, is of dubious ethics, at best. It may be legal, but you need to consider carefully whether it comports with your own personal ethics. Ask yourself: am I making myself part of the problem, or part of the solution?

|improve this answer|||||

And of course, as ever, if you have a legal question you should consult a lawyer qualified in the appropriate jurisdiction who specializes in the appropriate area of the law.

(If you can't find such a lawyer, pick any lawyer and ask them to find such a lawyer for you.)

|improve this answer|||||

If you are in the us dev is ok. No need to reinvent the wheel what you are describing can be cobbled together from other modules. Sounds very gray hat I would watch out because whatever you build then share you are now helping others with less ethical intents than yourself intentional or not. Also unless you are being paid and the stuff is staying in house, the way judges are handling this stuff now is the more knowledge the more responsible. Look on lexis-nexus in the past five years the lawyers are getting more for less technical cases, so the cases are dragged out in the gray areas and you will end up broke and serving ridiculous time just because you did module chain a versus b and they argue it was for a specific intent. Do not mean to sound negative but like that guy in Austin doing SMS spoofing to pump ads got his visa yanked he was making around 75K two years out of school keeping amajority of it compared to the rest of us taxpayers but no screwed up plus deep legal crap because of tools from prior jobs on his system.
Anyway be careful. Hope that helps, iceberg

|improve this answer|||||

Since your question regards the developer's point of view, then the answer is probably simple: it is legal. If you have a computer, you can create what you want with it, the problems could arise, as the other users explained, the moment you decide to put these tools to use. You could also create something and decide never to use it, nobody stops you from doing that :)

Of course, being no lawer, I warmly suggest you to contact one whenever you have such questions.

|improve this answer|||||
  • Perhaps the OP is wondering about the newer laws in the EU that talk about owning 'hacking tools'. I do not think that a post module would be classified as a 'hacking tool', but all governments are trying to wrap their collective heads around this topic. – schroeder Apr 4 '12 at 19:17
  • @schroeder I must admit that I haven't heard of this before... – user1301428 Apr 5 '12 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.