Add Recall module for dumping all users Microsoft Recall DBs & screenshots

[Marshall-Hallenbeck]

• Gets all users Recall folders and dumps them, then renames screenshots to include .jpg (unnecessary but helpful).
• Parses the DB files and saves the window names and content, and then another file with window name and content separated by a comma, so you can see which application name the content was saved from.
• Parses out the App names and paths and saves them to a file
• Parses out the Web URIs and saves them to a file
• You can specify to only dump specific users via USERS option
• Can silence the spammy file download information by setting the SILENT option

I cherry-picked the download_folder functionality from #320 and then improved it due to STATUS_SHARING_VIOLATION which occurs when a file has a handle by another process open with READ|WRITE (by default we attempt to get the file with only READ).

Screenshots:
Silent run:

Loud run:

Showing downloaded screenshots:

[julianwieg]

Nice one 👍

[oatzs]

kek

[bsmartt13]

Pardon my ignorance, what are you showing in the screenshot exactly? Is that a DomainAdmin account (Recall) authenticating to a box on the network he runs collecting the recall databases of users on that system? Assuming I’ve understood this correctly this feels very misleading as domain admin has full control if your domain admin is spying on you (there’s better ways to do it) instead of pushing out GPO disabling recall, you’ve got bigger problems.

Edit: @Marshall-Hallenbeck just want to be clear, netexec is a clutch util that I love. Maybe a recall feature is apt here. I’ve just been skeptical about the risks posed by recall which led me to your screenshots being passed around on twitter with some ridiculous claims attached. That’s why I ask.

[Marshall-Hallenbeck]

@bsmartt13 In this instance it's just a standalone VM in Azure, so no domain. It's a local admin to the box, but being an admin isn't even necessary apparently, since you can icacls the folder and have access (see TotalRecall code for that).

This may be irrelevant now that Microsoft has announced some new updates, but we'll have to see how it works in practice.