Missed the HTTPUSERNAME fix
parent
61f9cc360b
commit
14adcce8bf
|
@ -27,7 +27,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
['URL', 'http://nto.github.io/AirPlay.html']
|
['URL', 'http://nto.github.io/AirPlay.html']
|
||||||
],
|
],
|
||||||
'DefaultOptions' => { 'HTTPUSERNAME' => 'AirPlay' },
|
'DefaultOptions' => { 'HttpUsername' => 'AirPlay' },
|
||||||
'License' => MSF_LICENSE
|
'License' => MSF_LICENSE
|
||||||
))
|
))
|
||||||
|
|
||||||
|
|
|
@ -53,7 +53,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
users = send_request_raw({
|
users = send_request_raw({
|
||||||
'method' => 'GET',
|
'method' => 'GET',
|
||||||
'uri' => normalize_uri(datastore['TARGETURI'], "/ws/dal/#{datastore["ENDPOINT"]}"),
|
'uri' => normalize_uri(datastore['TARGETURI'], "/ws/dal/#{datastore["ENDPOINT"]}"),
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword'])
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])
|
||||||
}, 60)
|
}, 60)
|
||||||
|
|
||||||
if !users or users.code != 200
|
if !users or users.code != 200
|
||||||
|
|
|
@ -47,7 +47,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 10,
|
connection_timeout: 10,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -39,7 +39,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
# caidao does not have an username, there's only password
|
# caidao does not have an username, there's only password
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword', 'USERNAME', 'USER_AS_PASS', 'USERPASS_FILE', 'USER_FILE', 'DB_ALL_USERS')
|
deregister_options('HttpUsername', 'HttpPassword', 'USERNAME', 'USER_AS_PASS', 'USERPASS_FILE', 'USER_FILE', 'DB_ALL_USERS')
|
||||||
end
|
end
|
||||||
|
|
||||||
def scanner(ip)
|
def scanner(ip)
|
||||||
|
@ -62,7 +62,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
))
|
))
|
||||||
}.call
|
}.call
|
||||||
|
|
|
@ -152,7 +152,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -40,7 +40,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt") ]),
|
File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt") ]),
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
def target_url
|
def target_url
|
||||||
|
|
|
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt") ]),
|
File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt") ]),
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
def target_url
|
def target_url
|
||||||
|
|
|
@ -25,7 +25,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'License' => MSF_LICENSE
|
'License' => MSF_LICENSE
|
||||||
))
|
))
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
|
|
|
@ -28,7 +28,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(80),
|
Opt::RPORT(80),
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'The username to test', 'root' ]),
|
OptString.new('HttpUsername', [ true, 'The username to test', 'root' ]),
|
||||||
OptString.new('HttpPassword', [ true, 'The password to test', '5iveL!fe' ]),
|
OptString.new('HttpPassword', [ true, 'The password to test', '5iveL!fe' ]),
|
||||||
OptString.new('TARGETURI', [true, 'The path to GitLab', '/'])
|
OptString.new('TARGETURI', [true, 'The path to GitLab', '/'])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
@ -61,7 +61,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
password: datastore['HttpPassword'],
|
password: datastore['HttpPassword'],
|
||||||
user_file: datastore['USER_FILE'],
|
user_file: datastore['USER_FILE'],
|
||||||
userpass_file: datastore['USERPASS_FILE'],
|
userpass_file: datastore['USERPASS_FILE'],
|
||||||
username: datastore['HTTPUSERNAME'],
|
username: datastore['HttpUsername'],
|
||||||
user_as_pass: datastore['USER_AS_PASS']
|
user_as_pass: datastore['USER_AS_PASS']
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
|
@ -93,7 +93,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -77,7 +77,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
password: datastore['HttpPassword'],
|
password: datastore['HttpPassword'],
|
||||||
user_file: datastore['USER_FILE'],
|
user_file: datastore['USER_FILE'],
|
||||||
userpass_file: datastore['USERPASS_FILE'],
|
userpass_file: datastore['USERPASS_FILE'],
|
||||||
username: datastore['HTTPUSERNAME'],
|
username: datastore['HttpUsername'],
|
||||||
user_as_pass: datastore['USER_AS_PASS']
|
user_as_pass: datastore['USER_AS_PASS']
|
||||||
)
|
)
|
||||||
|
|
||||||
|
@ -88,7 +88,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -151,7 +151,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
password: datastore['HttpPassword'],
|
password: datastore['HttpPassword'],
|
||||||
user_file: datastore['USER_FILE'],
|
user_file: datastore['USER_FILE'],
|
||||||
userpass_file: datastore['USERPASS_FILE'],
|
userpass_file: datastore['USERPASS_FILE'],
|
||||||
username: datastore['HTTPUSERNAME'],
|
username: datastore['HttpUsername'],
|
||||||
user_as_pass: datastore['USER_AS_PASS'],
|
user_as_pass: datastore['USER_AS_PASS'],
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
|
@ -166,7 +166,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
req['uri'] = this_path
|
req['uri'] = this_path
|
||||||
req['headers'] = {'Cookie'=>datastore['COOKIE']} if not datastore['COOKIE'].empty?
|
req['headers'] = {'Cookie'=>datastore['COOKIE']} if not datastore['COOKIE'].empty?
|
||||||
req['data'] = data if not data.empty?
|
req['data'] = data if not data.empty?
|
||||||
req['authorization'] = basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword'])
|
req['authorization'] = basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])
|
||||||
|
|
||||||
return req
|
return req
|
||||||
end
|
end
|
||||||
|
|
|
@ -44,7 +44,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -52,7 +52,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 10,
|
connection_timeout: 10,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -33,7 +33,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
OptPath.new('SENSITIVE_FILES', [ true, "File containing senstive files, one per line",
|
OptPath.new('SENSITIVE_FILES', [ true, "File containing senstive files, one per line",
|
||||||
File.join(Msf::Config.data_directory, "wordlists", "sensitive_files.txt") ]),
|
File.join(Msf::Config.data_directory, "wordlists", "sensitive_files.txt") ]),
|
||||||
OptString.new('HTTPUSERNAME',[ true, 'User to login with', 'admin']),
|
OptString.new('HttpUsername',[ true, 'User to login with', 'admin']),
|
||||||
OptString.new('HttpPassword',[ true, 'Password to login with', 'password']),
|
OptString.new('HttpPassword',[ true, 'Password to login with', 'password']),
|
||||||
|
|
||||||
], self.class)
|
], self.class)
|
||||||
|
@ -91,7 +91,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
|
|
||||||
vprint_status("#{rhost}:#{rport} - Trying to login with #{user} / #{pass}")
|
vprint_status("#{rhost}:#{rport} - Trying to login with #{user} / #{pass}")
|
||||||
|
|
|
@ -47,7 +47,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -60,7 +60,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 10,
|
connection_timeout: 10,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -31,7 +31,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
OptPath.new('FILELIST', [ true, "File containing sensitive files, one per line",
|
OptPath.new('FILELIST', [ true, "File containing sensitive files, one per line",
|
||||||
File.join(Msf::Config.data_directory, "wordlists", "sensitive_files.txt") ]),
|
File.join(Msf::Config.data_directory, "wordlists", "sensitive_files.txt") ]),
|
||||||
OptString.new('HTTPUSERNAME',[ true, 'User to login with', 'service']),
|
OptString.new('HttpUsername',[ true, 'User to login with', 'service']),
|
||||||
OptString.new('HttpPassword',[ true, 'Password to login with', 'service'])
|
OptString.new('HttpPassword',[ true, 'Password to login with', 'service'])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -82,7 +82,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
|
|
||||||
vprint_status("Trying to login with #{user} / #{pass}")
|
vprint_status("Trying to login with #{user} / #{pass}")
|
||||||
|
|
|
@ -26,7 +26,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'License' => MSF_LICENSE
|
'License' => MSF_LICENSE
|
||||||
))
|
))
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
|
|
|
@ -39,7 +39,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
OptString.new('PASSWORD', [true, "A specific password to authenticate with, deault 'radware'", "radware"])
|
OptString.new('PASSWORD', [true, "A specific password to authenticate with, deault 'radware'", "radware"])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
|
|
|
@ -57,7 +57,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
))
|
))
|
||||||
}.call
|
}.call
|
||||||
|
|
|
@ -113,7 +113,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 10,
|
connection_timeout: 10,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -116,7 +116,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -70,7 +70,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -153,7 +153,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
stop_on_success: datastore['STOP_ON_SUCCESS'],
|
||||||
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -33,7 +33,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
OptString.new('TARGETURI', [ true, 'The path to the Nessus server login API', '/session']),
|
OptString.new('TARGETURI', [ true, 'The path to the Nessus server login API', '/session']),
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -40,7 +40,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
], self.class)
|
], self.class)
|
||||||
register_autofilter_ports([ 50013 ])
|
register_autofilter_ports([ 50013 ])
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(rhost)
|
def run_host(rhost)
|
||||||
|
|
|
@ -53,7 +53,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
register_options([
|
register_options([
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [false, 'Username (Ex SAP*)']),
|
OptString.new('HttpUsername', [false, 'Username (Ex SAP*)']),
|
||||||
OptString.new('HttpPassword', [false, 'Password (Ex 06071992)']),
|
OptString.new('HttpPassword', [false, 'Password (Ex 06071992)']),
|
||||||
OptAddress.new('LHOST', [true, 'Server IP or hostname of the SMB Capture system']),
|
OptAddress.new('LHOST', [true, 'Server IP or hostname of the SMB Capture system']),
|
||||||
OptEnum.new('ABUSE', [true, 'SMB Relay abuse to use', "MMR",
|
OptEnum.new('ABUSE', [true, 'SMB Relay abuse to use', "MMR",
|
||||||
|
@ -69,7 +69,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
def valid_credentials?
|
def valid_credentials?
|
||||||
if datastore['HTTPUSERNAME'].blank?
|
if datastore['HttpUsername'].blank?
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -98,7 +98,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
res = send_request_raw({
|
res = send_request_raw({
|
||||||
'uri' => '/sap/bw/xml/soap/xmla?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
|
'uri' => '/sap/bw/xml/soap/xmla?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT']
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT']
|
||||||
|
@ -118,7 +118,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
begin
|
begin
|
||||||
smb_uri = "\\\\#{datastore['LHOST']}\\#{Rex::Text.rand_text_alpha_lower(7)}.#{Rex::Text.rand_text_alpha_lower(3)}"
|
smb_uri = "\\\\#{datastore['LHOST']}\\#{Rex::Text.rand_text_alpha_lower(7)}.#{Rex::Text.rand_text_alpha_lower(3)}"
|
||||||
|
|
||||||
if datastore['HTTPUSERNAME'].empty?
|
if datastore['HttpUsername'].empty?
|
||||||
vprint_status("#{rhost}:#{rport} - Sending unauthenticated request for #{smb_uri}")
|
vprint_status("#{rhost}:#{rport} - Sending unauthenticated request for #{smb_uri}")
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'uri' => '/mmr/MMR',
|
'uri' => '/mmr/MMR',
|
||||||
|
@ -137,7 +137,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
res = send_request_cgi({
|
res = send_request_cgi({
|
||||||
'uri' => '/mmr/MMR',
|
'uri' => '/mmr/MMR',
|
||||||
'method' => 'GET',
|
'method' => 'GET',
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'vars_get' => {
|
'vars_get' => {
|
||||||
|
@ -169,7 +169,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'uri' => '/sap/bc/soap/rfc',
|
'uri' => '/sap/bc/soap/rfc',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'headers' => {
|
'headers' => {
|
||||||
|
|
|
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
register_options([
|
register_options([
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('BAPI_FIRST',[true,'First name','John']),
|
OptString.new('BAPI_FIRST',[true,'First name','John']),
|
||||||
OptString.new('BAPI_LAST',[true,'Last name','Doe']),
|
OptString.new('BAPI_LAST',[true,'Last name','Doe']),
|
||||||
|
@ -103,7 +103,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' => {
|
'headers' => {
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
||||||
},
|
},
|
||||||
|
|
|
@ -50,7 +50,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
File.join(Msf::Config.data_directory, "wordlists", "sap_default.txt") ])
|
File.join(Msf::Config.data_directory, "wordlists", "sap_default.txt") ])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
deregister_options('HTTPUSERNAME', 'HttpPassword')
|
deregister_options('HttpUsername', 'HttpPassword')
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(rhost)
|
def run_host(rhost)
|
||||||
|
|
|
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptEnum.new('OS', [true, 'Target OS', "linux", ['linux','windows']]),
|
OptEnum.new('OS', [true, 'Target OS', "linux", ['linux','windows']]),
|
||||||
OptString.new('CMD', [true, 'Command to run', "id"])
|
OptString.new('CMD', [true, 'Command to run', "id"])
|
||||||
|
@ -98,7 +98,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' => {
|
'headers' => {
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
||||||
},
|
},
|
||||||
|
|
|
@ -44,7 +44,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptEnum.new('OS', [true, 'Target OS', "linux", ['linux','windows']]),
|
OptEnum.new('OS', [true, 'Target OS', "linux", ['linux','windows']]),
|
||||||
OptString.new('CMD', [true, 'Command to run', "id"])
|
OptString.new('CMD', [true, 'Command to run', "id"])
|
||||||
|
@ -99,7 +99,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' => {
|
'headers' => {
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
||||||
},
|
},
|
||||||
|
|
|
@ -50,7 +50,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
register_options([
|
register_options([
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('DIR',[true,'Directory path (e.g. /etc)','/etc'])
|
OptString.new('DIR',[true,'Directory path (e.g. /etc)','/etc'])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
@ -75,7 +75,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'uri' => '/sap/bc/soap/rfc',
|
'uri' => '/sap/bc/soap/rfc',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'headers' => {
|
'headers' => {
|
||||||
|
|
|
@ -52,7 +52,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
register_options([
|
register_options([
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('FILEPATH',[true,'File Path to check for (e.g. /etc)','/etc/passwd'])
|
OptString.new('FILEPATH',[true,'File Path to check for (e.g. /etc)','/etc/passwd'])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
@ -77,7 +77,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'uri' => '/sap/bc/soap/rfc',
|
'uri' => '/sap/bc/soap/rfc',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'headers' => {
|
'headers' => {
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'Client', '001']),
|
OptString.new('CLIENT', [true, 'Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username ', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username ', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password ', '06071992'])
|
OptString.new('HttpPassword', [true, 'Password ', '06071992'])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -66,7 +66,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{client}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{client}",
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'headers' => {
|
'headers' => {
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions'
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions'
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('TABLE', [true, 'Table to read', 'USR02']),
|
OptString.new('TABLE', [true, 'Table to read', 'USR02']),
|
||||||
OptString.new('FIELDS', [true, 'Fields to read', 'BNAME,BCODE'])
|
OptString.new('FIELDS', [true, 'Fields to read', 'BNAME,BCODE'])
|
||||||
|
@ -87,7 +87,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'encode_params' => false,
|
'encode_params' => false,
|
||||||
'headers' => {
|
'headers' => {
|
||||||
|
|
|
@ -51,7 +51,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
register_options([
|
register_options([
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('DIR',[true,'Directory path (e.g. /etc)','/etc'])
|
OptString.new('DIR',[true,'Directory path (e.g. /etc)','/etc'])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
@ -99,7 +99,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'uri' => '/sap/bc/soap/rfc',
|
'uri' => '/sap/bc/soap/rfc',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'headers' => {
|
'headers' => {
|
||||||
|
|
|
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
OptString.new('CLIENT', [true, 'SAP client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('ABAP_PASSWORD',[false,'Password for the account (Default is msf1234)','msf1234']),
|
OptString.new('ABAP_PASSWORD',[false,'Password for the account (Default is msf1234)','msf1234']),
|
||||||
OptString.new('ABAP_USER',[false,'Username for the account (Username in upper case only. Default is MSF)', 'MSF'])
|
OptString.new('ABAP_USER',[false,'Username for the account (Username in upper case only. Default is MSF)', 'MSF'])
|
||||||
|
@ -76,7 +76,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'encode_params' => false,
|
'encode_params' => false,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' => {
|
'headers' => {
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions'
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions'
|
||||||
},
|
},
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('CMD', [true, 'SM69 command to be executed', 'PING']),
|
OptString.new('CMD', [true, 'SM69 command to be executed', 'PING']),
|
||||||
OptString.new('PARAM', [false, 'Additional parameters for the SM69 command', nil]),
|
OptString.new('PARAM', [false, 'Additional parameters for the SM69 command', nil]),
|
||||||
|
@ -79,7 +79,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'encode_params' => false,
|
'encode_params' => false,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' => {
|
'headers' => {
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
||||||
},
|
},
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
OptString.new('CMD', [true, 'SM69 command to be executed', 'PING']),
|
OptString.new('CMD', [true, 'SM69 command to be executed', 'PING']),
|
||||||
OptString.new('PARAM', [false, 'Additional parameters for the SM69 command', nil]),
|
OptString.new('PARAM', [false, 'Additional parameters for the SM69 command', nil]),
|
||||||
|
@ -79,7 +79,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'encode_params' => false,
|
'encode_params' => false,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' =>{
|
'headers' =>{
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
||||||
},
|
},
|
||||||
|
|
|
@ -47,7 +47,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client ', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client ', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
OptString.new('HttpPassword', [true, 'Password', '06071992']),
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -95,7 +95,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'encode_params' => false,
|
'encode_params' => false,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' =>{
|
'headers' =>{
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
||||||
},
|
},
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992'])
|
OptString.new('HttpPassword', [true, 'Password', '06071992'])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -70,7 +70,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
'cookie' => "sap-usercontext=sap-language=EN&sap-client=#{datastore['CLIENT']}",
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'encode_params' => false,
|
'encode_params' => false,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'headers' => {
|
'headers' => {
|
||||||
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
|
||||||
},
|
},
|
||||||
|
|
|
@ -60,7 +60,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Camera username', 'admin']),
|
OptString.new('HttpUsername', [true, 'Camera username', 'admin']),
|
||||||
OptString.new('HttpPassword', [false, 'Camera password (default: blank)', ''])
|
OptString.new('HttpPassword', [false, 'Camera password (default: blank)', ''])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -68,7 +68,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
def check
|
def check
|
||||||
res = send_request_cgi(
|
res = send_request_cgi(
|
||||||
'uri' => normalize_uri('uploadfile.htm'),
|
'uri' => normalize_uri('uploadfile.htm'),
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword'])
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])
|
||||||
)
|
)
|
||||||
|
|
||||||
unless res
|
unless res
|
||||||
|
@ -126,7 +126,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
res = send_request_cgi(
|
res = send_request_cgi(
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'uri' => normalize_uri('setSystemAdmin'),
|
'uri' => normalize_uri('setSystemAdmin'),
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'vars_post' => Hash[{
|
'vars_post' => Hash[{
|
||||||
'ReplySuccessPage' => 'advanced.htm',
|
'ReplySuccessPage' => 'advanced.htm',
|
||||||
'ReplyErrorPage' => 'errradv.htm',
|
'ReplyErrorPage' => 'errradv.htm',
|
||||||
|
@ -203,7 +203,7 @@ EOF
|
||||||
send_request_cgi(
|
send_request_cgi(
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'uri' => normalize_uri('setFileUpload'),
|
'uri' => normalize_uri('setFileUpload'),
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'ctype' => "multipart/form-data; boundary=#{boundary}",
|
'ctype' => "multipart/form-data; boundary=#{boundary}",
|
||||||
'data' => post_data)
|
'data' => post_data)
|
||||||
end
|
end
|
||||||
|
|
|
@ -46,7 +46,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'User to login with', 'admin']),
|
OptString.new('HttpUsername', [ true, 'User to login with', 'admin']),
|
||||||
OptString.new('HttpPassword', [ false, 'Password to login with', ''])
|
OptString.new('HttpPassword', [ false, 'Password to login with', ''])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
|
@ -66,7 +66,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
end
|
end
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword'] || ''
|
pass = datastore['HttpPassword'] || ''
|
||||||
|
|
||||||
test_login(user, pass)
|
test_login(user, pass)
|
||||||
|
|
|
@ -55,7 +55,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
Opt::RPORT(443),
|
Opt::RPORT(443),
|
||||||
OptBool.new('SSL', [true, 'Use SSL', true]),
|
OptBool.new('SSL', [true, 'Use SSL', true]),
|
||||||
OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/iControl/iControlPortal.cgi']),
|
OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/iControl/iControlPortal.cgi']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'The username to authenticate with', 'admin']),
|
OptString.new('HttpUsername', [true, 'The username to authenticate with', 'admin']),
|
||||||
OptString.new('HttpPassword', [true, 'The password to authenticate with', 'admin'])
|
OptString.new('HttpPassword', [true, 'The password to authenticate with', 'admin'])
|
||||||
])
|
])
|
||||||
register_advanced_options(
|
register_advanced_options(
|
||||||
|
@ -103,7 +103,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => normalize_uri(target_uri.path),
|
'uri' => normalize_uri(target_uri.path),
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => pay,
|
'data' => pay,
|
||||||
'username' => datastore['HTTPUSERNAME'],
|
'username' => datastore['HttpUsername'],
|
||||||
'password' => datastore['HttpPassword']
|
'password' => datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
if res
|
if res
|
||||||
|
|
|
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
Opt::RPORT(443),
|
Opt::RPORT(443),
|
||||||
OptBool.new('SSL', [true, 'Use SSL', true]),
|
OptBool.new('SSL', [true, 'Use SSL', true]),
|
||||||
OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/']),
|
OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'The username to authenticate with', 'admin']),
|
OptString.new('HttpUsername', [true, 'The username to authenticate with', 'admin']),
|
||||||
OptString.new('HttpPassword', [true, 'The password to authenticate with', 'admin'])
|
OptString.new('HttpPassword', [true, 'The password to authenticate with', 'admin'])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -61,7 +61,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => get_hostname,
|
'data' => get_hostname,
|
||||||
'username' => datastore['HTTPUSERNAME'],
|
'username' => datastore['HttpUsername'],
|
||||||
'password' => datastore['HttpPassword']
|
'password' => datastore['HttpPassword']
|
||||||
})
|
})
|
||||||
|
|
||||||
|
@ -73,7 +73,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => get_hostname,
|
'data' => get_hostname,
|
||||||
'username' => datastore['HTTPUSERNAME'],
|
'username' => datastore['HttpUsername'],
|
||||||
'password' => datastore['HttpPassword']
|
'password' => datastore['HttpPassword']
|
||||||
})
|
})
|
||||||
|
|
||||||
|
@ -95,7 +95,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => pay,
|
'data' => pay,
|
||||||
'username' => datastore['HTTPUSERNAME'],
|
'username' => datastore['HttpUsername'],
|
||||||
'password' => datastore['HttpPassword']
|
'password' => datastore['HttpPassword']
|
||||||
})
|
})
|
||||||
|
|
||||||
|
@ -120,7 +120,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => pay,
|
'data' => pay,
|
||||||
'username' => datastore['HTTPUSERNAME'],
|
'username' => datastore['HttpUsername'],
|
||||||
'password' => datastore['HttpPassword']
|
'password' => datastore['HttpPassword']
|
||||||
})
|
})
|
||||||
end
|
end
|
||||||
|
|
|
@ -63,7 +63,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'The username to authenticate as', 'admin' ]),
|
OptString.new('HttpUsername', [ true, 'The username to authenticate as', 'admin' ]),
|
||||||
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]),
|
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]),
|
||||||
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
||||||
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
||||||
|
@ -100,7 +100,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
def exploit
|
def exploit
|
||||||
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
||||||
uri = '/apply.cgi'
|
uri = '/apply.cgi'
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
rhost = datastore['RHOST']
|
rhost = datastore['RHOST']
|
||||||
rport = datastore['RPORT']
|
rport = datastore['RPORT']
|
||||||
|
|
|
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
))
|
))
|
||||||
|
|
||||||
register_options([
|
register_options([
|
||||||
OptString.new('HTTPUSERNAME', [ false, 'Valid router administrator username', 'admin']),
|
OptString.new('HttpUsername', [ false, 'Valid router administrator username', 'admin']),
|
||||||
OptString.new('HttpPassword', [ false, 'Password to login with', 'admin']),
|
OptString.new('HttpPassword', [ false, 'Password to login with', 'admin']),
|
||||||
OptAddress.new('RHOST', [true, 'The address of the router', '192.168.1.1']),
|
OptAddress.new('RHOST', [true, 'The address of the router', '192.168.1.1']),
|
||||||
OptInt.new('TIMEOUT', [false, 'The timeout to use in every request', 20])
|
OptInt.new('TIMEOUT', [false, 'The timeout to use in every request', 20])
|
||||||
|
@ -106,7 +106,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
# Helper methods
|
# Helper methods
|
||||||
def user
|
def user
|
||||||
datastore['HTTPUSERNAME']
|
datastore['HttpUsername']
|
||||||
end
|
end
|
||||||
|
|
||||||
def pass
|
def pass
|
||||||
|
|
|
@ -65,7 +65,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'The username to authenticate as', 'admin' ]),
|
OptString.new('HttpUsername', [ true, 'The username to authenticate as', 'admin' ]),
|
||||||
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]),
|
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]),
|
||||||
OptAddress.new('LHOST', [ true, 'The listen IP address from where the victim downloads the MIPS payload' ]),
|
OptAddress.new('LHOST', [ true, 'The listen IP address from where the victim downloads the MIPS payload' ]),
|
||||||
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
||||||
|
@ -102,7 +102,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
def exploit
|
def exploit
|
||||||
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(4))
|
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(4))
|
||||||
uri = '/apply.cgi'
|
uri = '/apply.cgi'
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
lhost = datastore['LHOST']
|
lhost = datastore['LHOST']
|
||||||
|
|
||||||
|
|
|
@ -65,7 +65,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'The username to authenticate as', 'admin' ]),
|
OptString.new('HttpUsername', [ true, 'The username to authenticate as', 'admin' ]),
|
||||||
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]),
|
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'admin' ]),
|
||||||
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
||||||
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
||||||
|
@ -243,7 +243,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
def exploit
|
def exploit
|
||||||
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
||||||
uri = '/apply.cgi'
|
uri = '/apply.cgi'
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
rhost = datastore['RHOST']
|
rhost = datastore['RHOST']
|
||||||
rport = datastore['RPORT']
|
rport = datastore['RPORT']
|
||||||
|
|
|
@ -65,7 +65,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'The username to authenticate as', 'admin' ]),
|
OptString.new('HttpUsername', [ true, 'The username to authenticate as', 'admin' ]),
|
||||||
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'password' ]),
|
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'password' ]),
|
||||||
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
||||||
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
||||||
|
@ -104,7 +104,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
def exploit
|
def exploit
|
||||||
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
||||||
uri = '/setup.cgi'
|
uri = '/setup.cgi'
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
rhost = datastore['RHOST']
|
rhost = datastore['RHOST']
|
||||||
rport = datastore['RPORT']
|
rport = datastore['RPORT']
|
||||||
|
|
|
@ -65,7 +65,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'The username to authenticate as', 'admin' ]),
|
OptString.new('HttpUsername', [ true, 'The username to authenticate as', 'admin' ]),
|
||||||
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'password' ]),
|
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'password' ]),
|
||||||
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
OptAddress.new('DOWNHOST', [ false, 'An alternative host to request the MIPS payload from' ]),
|
||||||
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
OptString.new('DOWNFILE', [ false, 'Filename to download, (default: random)' ]),
|
||||||
|
@ -217,7 +217,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
def exploit
|
def exploit
|
||||||
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
downfile = datastore['DOWNFILE'] || rand_text_alpha(8+rand(8))
|
||||||
uri = '/pppoe.cgi'
|
uri = '/pppoe.cgi'
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
@timeout = datastore['RELOAD_CONF_DELAY']
|
@timeout = datastore['RELOAD_CONF_DELAY']
|
||||||
|
|
||||||
|
|
|
@ -70,7 +70,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [true, 'The HTTP username to specify for basic authentication', 'piranha']),
|
OptString.new('HttpUsername', [true, 'The HTTP username to specify for basic authentication', 'piranha']),
|
||||||
OptString.new('HttpPassword', [true, 'The HTTP password to specify for basic authentication', 'q'])
|
OptString.new('HttpPassword', [true, 'The HTTP password to specify for basic authentication', 'q'])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'User to login with', 'admin']),
|
OptString.new('HttpUsername', [ true, 'User to login with', 'admin']),
|
||||||
OptString.new('HttpPassword', [ true, 'Password to login with', 'admin'])
|
OptString.new('HttpPassword', [ true, 'Password to login with', 'admin'])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
|
@ -66,7 +66,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
print_status('Exploiting')
|
print_status('Exploiting')
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
test_login(user, pass)
|
test_login(user, pass)
|
||||||
exploit_telnet
|
exploit_telnet
|
||||||
|
|
|
@ -59,7 +59,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
[
|
[
|
||||||
Opt::RPORT(444),
|
Opt::RPORT(444),
|
||||||
OptBool.new('SSL', [true, 'Use SSL', true]),
|
OptBool.new('SSL', [true, 'Use SSL', true]),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'The username for the application', 'admin']),
|
OptString.new('HttpUsername', [true, 'The username for the application', 'admin']),
|
||||||
OptString.new('HttpPassword', [true, 'The password for the application', 'admin'])
|
OptString.new('HttpPassword', [true, 'The password for the application', 'admin'])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -86,7 +86,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
end
|
end
|
||||||
|
|
||||||
def exploit
|
def exploit
|
||||||
user = datastore['HTTPUSERNAME']
|
user = datastore['HttpUsername']
|
||||||
pass = datastore['HttpPassword']
|
pass = datastore['HttpPassword']
|
||||||
cmd = Rex::Text.uri_encode(";#{payload.encoded}&")
|
cmd = Rex::Text.uri_encode(";#{payload.encoded}&")
|
||||||
lines = rand(100) + 1
|
lines = rand(100) + 1
|
||||||
|
|
|
@ -59,7 +59,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
register_options([
|
register_options([
|
||||||
Opt::RPORT(631),
|
Opt::RPORT(631),
|
||||||
OptBool.new('SSL', [ true, 'Use SSL', true ]),
|
OptBool.new('SSL', [ true, 'Use SSL', true ]),
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'CUPS username', 'root']),
|
OptString.new('HttpUsername', [ true, 'CUPS username', 'root']),
|
||||||
OptString.new('HttpPassword', [ true, 'CUPS user password', '']),
|
OptString.new('HttpPassword', [ true, 'CUPS user password', '']),
|
||||||
OptEnum.new('CVE', [ true, 'CVE to exploit', 'CVE-2014-6271', ['CVE-2014-6271', 'CVE-2014-6278'] ]),
|
OptEnum.new('CVE', [ true, 'CVE to exploit', 'CVE-2014-6271', ['CVE-2014-6271', 'CVE-2014-6278'] ]),
|
||||||
OptString.new('RPATH', [ true, 'Target PATH for binaries', '/bin' ])
|
OptString.new('RPATH', [ true, 'Target PATH for binaries', '/bin' ])
|
||||||
|
@ -233,7 +233,7 @@ EOF
|
||||||
'ctype' => "multipart/form-data; boundary=#{pd.bound}",
|
'ctype' => "multipart/form-data; boundary=#{pd.bound}",
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'cookie' => "org.cups.sid=#{@cookie};",
|
'cookie' => "org.cups.sid=#{@cookie};",
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword'])
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword'])
|
||||||
)
|
)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -245,7 +245,7 @@ EOF
|
||||||
send_request_cgi(
|
send_request_cgi(
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'uri' => normalize_uri(target_uri.path, 'printers', printer_name),
|
'uri' => normalize_uri(target_uri.path, 'printers', printer_name),
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => "org.cups.sid=#{@cookie}",
|
'cookie' => "org.cups.sid=#{@cookie}",
|
||||||
'vars_post' => {
|
'vars_post' => {
|
||||||
'org.cups.sid' => @cookie,
|
'org.cups.sid' => @cookie,
|
||||||
|
@ -262,7 +262,7 @@ EOF
|
||||||
send_request_cgi(
|
send_request_cgi(
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'uri' => normalize_uri(target_uri.path, 'admin'),
|
'uri' => normalize_uri(target_uri.path, 'admin'),
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => "org.cups.sid=#{@cookie}",
|
'cookie' => "org.cups.sid=#{@cookie}",
|
||||||
'vars_post' => {
|
'vars_post' => {
|
||||||
'org.cups.sid' => @cookie,
|
'org.cups.sid' => @cookie,
|
||||||
|
|
|
@ -46,13 +46,13 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('TARGETURI', [true, 'URI', '/gestioip/']),
|
OptString.new('TARGETURI', [true, 'URI', '/gestioip/']),
|
||||||
OptString.new('HTTPUSERNAME', [false, 'The username to auth as', 'gipadmin']),
|
OptString.new('HttpUsername', [false, 'The username to auth as', 'gipadmin']),
|
||||||
OptString.new('HttpPassword', [false, 'The password to auth with', nil])
|
OptString.new('HttpPassword', [false, 'The password to auth with', nil])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
||||||
def user
|
def user
|
||||||
datastore['HTTPUSERNAME']
|
datastore['HttpUsername']
|
||||||
end
|
end
|
||||||
|
|
||||||
def pass
|
def pass
|
||||||
|
|
|
@ -640,7 +640,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
configure_http_login_scanner(
|
configure_http_login_scanner(
|
||||||
cred_details: @cred_collection,
|
cred_details: @cred_collection,
|
||||||
connection_timeout: 5,
|
connection_timeout: 5,
|
||||||
http_username: datastore['HTTPUSERNAME'],
|
http_username: datastore['HttpUsername'],
|
||||||
http_password: datastore['HttpPassword']
|
http_password: datastore['HttpPassword']
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
|
|
@ -82,7 +82,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(8080),
|
Opt::RPORT(8080),
|
||||||
OptString.new('HTTPUSERNAME', [ false, 'The username to authenticate as' ]),
|
OptString.new('HttpUsername', [ false, 'The username to authenticate as' ]),
|
||||||
OptString.new('HttpPassword', [ false, 'The password for the specified username' ]),
|
OptString.new('HttpPassword', [ false, 'The password for the specified username' ]),
|
||||||
OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
|
OptString.new('JSP', [ false, 'JSP name to use without .jsp extension (default: random)', nil ]),
|
||||||
OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
|
OptString.new('APPBASE', [ false, 'Application base name, (default: random)', nil ]),
|
||||||
|
|
|
@ -41,7 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(7021),
|
Opt::RPORT(7021),
|
||||||
OptString.new('HTTPUSERNAME', [ true, 'The username with admin role to authenticate as', 'admin' ]),
|
OptString.new('HttpUsername', [ true, 'The username with admin role to authenticate as', 'admin' ]),
|
||||||
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'password' ])
|
OptString.new('HttpPassword', [ true, 'The password for the specified username', 'password' ])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -64,7 +64,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
{
|
{
|
||||||
'uri' => '/cgi/surgeftpmgr.cgi',
|
'uri' => '/cgi/surgeftpmgr.cgi',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'vars_post' =>
|
'vars_post' =>
|
||||||
{
|
{
|
||||||
'global_smtp' => "",
|
'global_smtp' => "",
|
||||||
|
|
|
@ -102,7 +102,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [ false, 'The username to authenticate as' ]),
|
OptString.new('HttpUsername', [ false, 'The username to authenticate as' ]),
|
||||||
OptString.new('HttpPassword', [ false, 'The password for the specified username' ]),
|
OptString.new('HttpPassword', [ false, 'The password for the specified username' ]),
|
||||||
# /cognos_express/manager/ for Cognos Express (19300)
|
# /cognos_express/manager/ for Cognos Express (19300)
|
||||||
OptString.new('PATH', [ true, "The URI path of the manager app (/deploy and /undeploy will be used)", '/manager'])
|
OptString.new('PATH', [ true, "The URI path of the manager app (/deploy and /undeploy will be used)", '/manager'])
|
||||||
|
@ -313,7 +313,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
module_fullname: self.fullname,
|
module_fullname: self.fullname,
|
||||||
private_type: :password,
|
private_type: :password,
|
||||||
private_data: datastore['HttpPassword'].downcase,
|
private_data: datastore['HttpPassword'].downcase,
|
||||||
username: datastore['HTTPUSERNAME']
|
username: datastore['HttpUsername']
|
||||||
}
|
}
|
||||||
|
|
||||||
credential_data.merge!(service_data)
|
credential_data.merge!(service_data)
|
||||||
|
|
|
@ -95,7 +95,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptString.new('HTTPUSERNAME', [false, 'The username to authenticate as']),
|
OptString.new('HttpUsername', [false, 'The username to authenticate as']),
|
||||||
OptString.new('HttpPassword', [false, 'The password for the specified username']),
|
OptString.new('HttpPassword', [false, 'The password for the specified username']),
|
||||||
# /cognos_express/manager/ for Cognos Express (19300)
|
# /cognos_express/manager/ for Cognos Express (19300)
|
||||||
OptString.new('TARGETURI', [true, "The URI path of the manager app (/html/upload and /undeploy will be used)", '/manager'])
|
OptString.new('TARGETURI', [true, "The URI path of the manager app (/html/upload and /undeploy will be used)", '/manager'])
|
||||||
|
@ -309,7 +309,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => url,
|
'uri' => url,
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'ctype' => 'multipart/form-data; boundary=---------------------------' + boundary_identifier,
|
'ctype' => 'multipart/form-data; boundary=---------------------------' + boundary_identifier,
|
||||||
'user' => datastore['HTTPUSERNAME'],
|
'user' => datastore['HttpUsername'],
|
||||||
'password' => datastore['HttpPassword'],
|
'password' => datastore['HttpPassword'],
|
||||||
'cookie' => @session_id,
|
'cookie' => @session_id,
|
||||||
'vars_get' => vars_get,
|
'vars_get' => vars_get,
|
||||||
|
@ -324,7 +324,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => url,
|
'uri' => url,
|
||||||
'vars_get' => vars_get,
|
'vars_get' => vars_get,
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'user' => datastore['HTTPUSERNAME'],
|
'user' => datastore['HttpUsername'],
|
||||||
'password' => datastore['HttpPassword'],
|
'password' => datastore['HttpPassword'],
|
||||||
'cookie' => @session_id
|
'cookie' => @session_id
|
||||||
})
|
})
|
||||||
|
@ -418,7 +418,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
module_fullname: self.fullname,
|
module_fullname: self.fullname,
|
||||||
private_type: :password,
|
private_type: :password,
|
||||||
private_data: datastore['HttpPassword'].downcase,
|
private_data: datastore['HttpPassword'].downcase,
|
||||||
username: datastore['HTTPUSERNAME']
|
username: datastore['HttpUsername']
|
||||||
}
|
}
|
||||||
|
|
||||||
credential_data.merge!(service_data)
|
credential_data.merge!(service_data)
|
||||||
|
|
|
@ -53,7 +53,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(8001),
|
Opt::RPORT(8001),
|
||||||
OptString.new('HTTPUSERNAME', [false, "The username to authenticate with"]),
|
OptString.new('HttpUsername', [false, "The username to authenticate with"]),
|
||||||
OptString.new('HttpPassword', [false, "The password to authenticate with"])
|
OptString.new('HttpPassword', [false, "The password to authenticate with"])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
@ -123,7 +123,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
end
|
end
|
||||||
|
|
||||||
def username
|
def username
|
||||||
datastore['HTTPUSERNAME'].blank? ? DEFAULT_USERNAME : datastore['HTTPUSERNAME']
|
datastore['HttpUsername'].blank? ? DEFAULT_USERNAME : datastore['HttpUsername']
|
||||||
end
|
end
|
||||||
|
|
||||||
def password
|
def password
|
||||||
|
|
|
@ -83,7 +83,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992'])
|
OptString.new('HttpPassword', [true, 'Password', '06071992'])
|
||||||
], self.class)
|
], self.class)
|
||||||
register_advanced_options(
|
register_advanced_options(
|
||||||
|
@ -97,7 +97,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => '/sap/bc/soap/rfc',
|
'uri' => '/sap/bc/soap/rfc',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'headers' => {
|
'headers' => {
|
||||||
|
|
|
@ -84,7 +84,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
[
|
[
|
||||||
Opt::RPORT(8000),
|
Opt::RPORT(8000),
|
||||||
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
OptString.new('CLIENT', [true, 'SAP Client', '001']),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'Username', 'SAP*']),
|
OptString.new('HttpUsername', [true, 'Username', 'SAP*']),
|
||||||
OptString.new('HttpPassword', [true, 'Password', '06071992'])
|
OptString.new('HttpPassword', [true, 'Password', '06071992'])
|
||||||
], self.class)
|
], self.class)
|
||||||
register_advanced_options(
|
register_advanced_options(
|
||||||
|
@ -98,7 +98,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
'uri' => '/sap/bc/soap/rfc',
|
'uri' => '/sap/bc/soap/rfc',
|
||||||
'method' => 'POST',
|
'method' => 'POST',
|
||||||
'data' => data,
|
'data' => data,
|
||||||
'authorization' => basic_auth(datastore['HTTPUSERNAME'], datastore['HttpPassword']),
|
'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
|
||||||
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
|
||||||
'ctype' => 'text/xml; charset=UTF-8',
|
'ctype' => 'text/xml; charset=UTF-8',
|
||||||
'headers' => {
|
'headers' => {
|
||||||
|
|
|
@ -54,7 +54,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
Opt::RPORT(8899),
|
Opt::RPORT(8899),
|
||||||
OptBool.new('SSL', [ true, 'Use SSL', true ]),
|
OptBool.new('SSL', [ true, 'Use SSL', true ]),
|
||||||
OptString.new('CMD', [ false, "A single command to execute instead of the payload" ]),
|
OptString.new('CMD', [ false, "A single command to execute instead of the payload" ]),
|
||||||
OptString.new('HTTPUSERNAME', [ true, "The user to authenticate as", 'oracle']),
|
OptString.new('HttpUsername', [ true, "The user to authenticate as", 'oracle']),
|
||||||
OptString.new('HttpPassword', [ true, "The password to authenticate with" ])
|
OptString.new('HttpPassword', [ true, "The password to authenticate with" ])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
|
|
|
@ -70,7 +70,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(8080),
|
Opt::RPORT(8080),
|
||||||
OptString.new('HTTPUSERNAME', [true, 'The HTTP username to specify for basic authentication', 'anonymous']),
|
OptString.new('HttpUsername', [true, 'The HTTP username to specify for basic authentication', 'anonymous']),
|
||||||
OptString.new('HttpPassword', [true, 'The HTTP password to specify for basic authentication', 'mozilla@example.com'])
|
OptString.new('HttpPassword', [true, 'The HTTP password to specify for basic authentication', 'mozilla@example.com'])
|
||||||
], self.class)
|
], self.class)
|
||||||
end
|
end
|
||||||
|
|
|
@ -42,7 +42,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||||
[
|
[
|
||||||
# The USERNAME and PASSWORD are registered again to make them more obvious they're
|
# The USERNAME and PASSWORD are registered again to make them more obvious they're
|
||||||
# configurable.
|
# configurable.
|
||||||
OptString.new('HTTPUSERNAME',
|
OptString.new('HttpUsername',
|
||||||
[false, 'The HTTP username to specify for authentication', '']),
|
[false, 'The HTTP username to specify for authentication', '']),
|
||||||
OptString.new('HttpPassword',
|
OptString.new('HttpPassword',
|
||||||
[false, 'The HTTP password to specify for authentication', '']),
|
[false, 'The HTTP password to specify for authentication', '']),
|
||||||
|
|
Loading…
Reference in New Issue