metasploit-framework/modules/auxiliary/scanner/http/verb_auth_bypass.rb

96 lines
2.7 KiB
Ruby
Raw Normal View History

##
2017-07-24 13:26:21 +00:00
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Auxiliary
2013-08-30 21:28:54 +00:00
# Exploit mixins should be called first
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::WmapScanDir
include Msf::Auxiliary::WmapScanFile
# Scanner mixin should be near last
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report
def initialize(info = {})
super(update_info(info,
'Name' => 'HTTP Verb Authentication Bypass Scanner',
'Description' => %q{
This module test for authentication bypass using different HTTP verbs.
},
'Author' => ['et [at] metasploit.com'],
2013-08-30 21:28:54 +00:00
'License' => BSD_LICENSE))
register_options(
[
OptString.new('TARGETURI', [true, "The path to test", '/'])
])
2013-08-30 21:28:54 +00:00
end
def run_host(ip)
begin
test_verbs(ip)
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
rescue ::Timeout::Error, ::Errno::EPIPE
end
end
def test_verbs(ip)
verbs = [ 'HEAD', 'TRACE', 'TRACK', 'Wmap', 'get', 'trace' ]
res = send_request_raw({
'uri' => normalize_uri(target_uri.path),
2013-08-30 21:28:54 +00:00
'method' => 'GET'
}, 10)
return if not res
if not res.headers['WWW-Authenticate']
print_status("#{full_uri} - Authentication not required [#{res.code}]")
2013-08-30 21:28:54 +00:00
return
end
auth_code = res.code
print_status("#{full_uri} - Authentication required: #{res.headers['WWW-Authenticate']} [#{auth_code}]")
2013-08-30 21:28:54 +00:00
report_note(
:host => ip,
:proto => 'tcp',
:sname => (ssl ? 'https' : 'http'),
:port => rport,
:type => 'WWW_AUTHENTICATE',
:data => "#{target_uri.path} Realm: #{res.headers['WWW-Authenticate']}",
2013-08-30 21:28:54 +00:00
:update => :unique_data
)
verbs.each do |tv|
resauth = send_request_raw({
'uri' => normalize_uri(target_uri.path),
2013-08-30 21:28:54 +00:00
'method' => tv
}, 10)
next if not resauth
print_status("#{full_uri} - Testing verb #{tv} [#{resauth.code}]")
2013-08-30 21:28:54 +00:00
if resauth.code != auth_code and resauth.code <= 302
print_good("#{full_uri} - Possible authentication bypass with verb #{tv} [#{resauth.code}]")
2013-08-30 21:28:54 +00:00
# Unable to use report_web_vuln as method is not in list of allowed methods.
report_note(
:host => ip,
:proto => 'tcp',
:sname => (ssl ? 'https' : 'http'),
:port => rport,
:type => 'AUTH_BYPASS_VERB',
:data => "#{target_uri.path} Verb: #{tv}",
2013-08-30 21:28:54 +00:00
:update => :unique_data
)
end
end
end
end