diff --git a/lib/metasploit/framework/login_scanner/ssh.rb b/lib/metasploit/framework/login_scanner/ssh.rb index 85dd86de96..266e62e56d 100644 --- a/lib/metasploit/framework/login_scanner/ssh.rb +++ b/lib/metasploit/framework/login_scanner/ssh.rb @@ -120,9 +120,14 @@ module Metasploit # We're in the SSH shell for a Juniper JunOS, we can pull the version from the cli # line 2 is hostname, 3 is model, 4 is the Base OS version proof = ssh_socket.exec!("cli show version\n").split("\n")[2..4].join(", ").to_s + elsif (proof =~ /Linux USG /) + # Ubiquiti Unifi USG + proof << ssh_socket.exec!("cat /etc/version\n").to_s end - proof << ssh_socket.exec!("grep unifi.version /tmp/system.cfg\n").to_s - if (proof =~ /unifi.version/) + temp_proof << ssh_socket.exec!("grep unifi.version /tmp/system.cfg\n").to_s + if (temp_proof =~ /unifi.version/) + proof << temp_proof + # Ubiquiti Unifi device (non-USG), possibly a switch. Tested on US-24 # The /tmp/*.cfg files don't give us device info, however the info command does # we dont call it originally since it doesnt say unifi/ubiquiti in it and info # is a linux command as well @@ -158,7 +163,7 @@ module Metasploit def get_platform(proof) case proof - when /unifi\.version/ #Ubiquiti Unifi. uname -a is left in, so we got to pull before Linux + when /unifi\.version|UniFiSecurityGateway/ #Ubiquiti Unifi. uname -a is left in, so we got to pull before Linux 'unifi' when /Linux/ 'linux'