print_status -> print_good. [When it is successful, show it!]
parent
424522147e
commit
67310fa96c
|
@ -221,7 +221,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
@credentials.each do |k,v|
|
@credentials.each do |k,v|
|
||||||
next unless v[:user] and v[:password]
|
next unless v[:user] and v[:password]
|
||||||
print_status("#{k}: User: #{v[:user]} Pass: #{v[:password]}")
|
print_good("#{k}: User: #{v[:user]} Pass: #{v[:password]}")
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: rhost,
|
ip: rhost,
|
||||||
port: rport,
|
port: rport,
|
||||||
|
|
|
@ -110,7 +110,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if res and res.size > 0
|
if res and res.size > 0
|
||||||
print_status("\tList of Accounts with Password Hashes:")
|
print_status("\tList of Accounts with Password Hashes:")
|
||||||
res.each do |row|
|
res.each do |row|
|
||||||
print_status("\t\tUser: #{row[0]} Host: #{row[1]} Password Hash: #{row[2]}")
|
print_good("\t\tUser: #{row[0]} Host: #{row[1]} Password Hash: #{row[2]}")
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: rhost,
|
ip: rhost,
|
||||||
port: rport,
|
port: rport,
|
||||||
|
|
|
@ -119,7 +119,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
vprint_status "#{ip}:#{rport} - FTP - Connecting"
|
vprint_status "#{ip}:#{rport} - FTP - Connecting"
|
||||||
conn = connect_login
|
conn = connect_login
|
||||||
if conn
|
if conn
|
||||||
print_status("#{ip}:#{rport} - FTP - Login succeeded")
|
print_good("#{ip}:#{rport} - FTP - Login succeeded")
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: ip,
|
ip: ip,
|
||||||
port: rport,
|
port: rport,
|
||||||
|
|
|
@ -95,7 +95,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
# Required to prevent the server from spinning a loop
|
# Required to prevent the server from spinning a loop
|
||||||
sock.put(trojan_command(:nop))
|
sock.put(trojan_command(:nop))
|
||||||
|
|
||||||
print_status("#{ip}:#{rport} FOUND: #{files.inspect}")
|
print_good("#{ip}:#{rport} FOUND: #{files.inspect}")
|
||||||
# Add Vulnerability and Report
|
# Add Vulnerability and Report
|
||||||
report_vuln({
|
report_vuln({
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -54,7 +54,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if (data)
|
if (data)
|
||||||
parsed_data = parse_call(data)
|
parsed_data = parse_call(data)
|
||||||
parsed_data['time'] = Time.now
|
parsed_data['time'] = Time.now
|
||||||
print_status("Found active call on: #{parsed_data['rfpi']}")
|
print_good("Found active call on: #{parsed_data['rfpi']}")
|
||||||
@calls[parsed_data['time']] = parsed_data
|
@calls[parsed_data['time']] = parsed_data
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if (data)
|
if (data)
|
||||||
parsed_data = parse_station(data)
|
parsed_data = parse_station(data)
|
||||||
if (not @base_stations.key?(parsed_data['rfpi']))
|
if (not @base_stations.key?(parsed_data['rfpi']))
|
||||||
print_status("Found New RFPI: #{parsed_data['rfpi']}")
|
print_good("Found New RFPI: #{parsed_data['rfpi']}")
|
||||||
@base_stations[parsed_data['rfpi']] = parsed_data
|
@base_stations[parsed_data['rfpi']] = parsed_data
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -63,7 +63,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
while(reply = getreply())
|
while(reply = getreply())
|
||||||
next unless reply.is_arp?
|
next unless reply.is_arp?
|
||||||
company = OUI_LIST::lookup_oui_company_name(reply.arp_saddr_mac)
|
company = OUI_LIST::lookup_oui_company_name(reply.arp_saddr_mac)
|
||||||
print_status("#{reply.arp_saddr_ip} appears to be up (#{company}).")
|
print_good("#{reply.arp_saddr_ip} appears to be up (#{company}).")
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
report_note(:host => reply.arp_saddr_ip, :type => "mac_oui", :data => company)
|
report_note(:host => reply.arp_saddr_ip, :type => "mac_oui", :data => company)
|
||||||
end
|
end
|
||||||
|
@ -76,7 +76,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
while(reply = getreply())
|
while(reply = getreply())
|
||||||
next unless reply.is_arp?
|
next unless reply.is_arp?
|
||||||
company = OUI_LIST::lookup_oui_company_name(reply.arp_saddr_mac)
|
company = OUI_LIST::lookup_oui_company_name(reply.arp_saddr_mac)
|
||||||
print_status("#{reply.arp_saddr_ip} appears to be up (#{company}).")
|
print_good("#{reply.arp_saddr_ip} appears to be up (#{company}).")
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
report_note(:host => reply.arp_saddr_ip, :type => "mac_oui", :data => company)
|
report_note(:host => reply.arp_saddr_ip, :type => "mac_oui", :data => company)
|
||||||
end
|
end
|
||||||
|
|
|
@ -67,7 +67,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
while(reply = getreply())
|
while(reply = getreply())
|
||||||
next unless reply.is_arp?
|
next unless reply.is_arp?
|
||||||
if not found[reply.arp_saddr_ip]
|
if not found[reply.arp_saddr_ip]
|
||||||
print_status(sprintf(" %16s ALIVE",reply.arp_saddr_ip))
|
print_good(sprintf(" %16s ALIVE",reply.arp_saddr_ip))
|
||||||
addrs << [reply.arp_saddr_ip, reply.arp_saddr_mac]
|
addrs << [reply.arp_saddr_ip, reply.arp_saddr_mac]
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
found[reply.arp_saddr_ip] = true
|
found[reply.arp_saddr_ip] = true
|
||||||
|
@ -81,7 +81,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
while(reply = getreply())
|
while(reply = getreply())
|
||||||
next unless reply.is_arp?
|
next unless reply.is_arp?
|
||||||
if not found[reply.arp_saddr_ip]
|
if not found[reply.arp_saddr_ip]
|
||||||
print_status(sprintf(" %16s ALIVE",reply.arp_saddr_ip))
|
print_good(sprintf(" %16s ALIVE",reply.arp_saddr_ip))
|
||||||
addrs << [reply.arp_saddr_ip, reply.arp_saddr_mac]
|
addrs << [reply.arp_saddr_ip, reply.arp_saddr_mac]
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
found[reply.arp_saddr_ip] = true
|
found[reply.arp_saddr_ip] = true
|
||||||
|
|
|
@ -36,7 +36,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
data = sock.get_once
|
data = sock.get_once
|
||||||
|
|
||||||
if ( data and data =~ /rrobotd:rrobotd/ )
|
if ( data and data =~ /rrobotd:rrobotd/ )
|
||||||
print_status("Host #{ip} is running the EMC AlphaStor Device Manager.")
|
print_good("Host #{ip} is running the EMC AlphaStor Device Manager.")
|
||||||
report_service(:host => rhost, :port => rport, :name => "emc-manager", :info => data)
|
report_service(:host => rhost, :port => rport, :name => "emc-manager", :info => data)
|
||||||
else
|
else
|
||||||
print_error("Host #{ip} is not running the service...")
|
print_error("Host #{ip} is not running the service...")
|
||||||
|
|
|
@ -36,7 +36,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
data = sock.get_once
|
data = sock.get_once
|
||||||
|
|
||||||
if ( data and data =~ /robotd~robotd~CLIENT/ )
|
if ( data and data =~ /robotd~robotd~CLIENT/ )
|
||||||
print_status("Host #{ip} is running the EMC AlphaStor Library Manager.")
|
print_good("Host #{ip} is running the EMC AlphaStor Library Manager.")
|
||||||
report_service(:host => rhost, :port => rport, :name => "emc-library", :info => data)
|
report_service(:host => rhost, :port => rport, :name => "emc-library", :info => data)
|
||||||
else
|
else
|
||||||
print_error("Host #{ip} is not running the service...")
|
print_error("Host #{ip} is not running the service...")
|
||||||
|
|
|
@ -31,7 +31,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
if(banner)
|
if(banner)
|
||||||
banner_sanitized = Rex::Text.to_hex_ascii(self.banner.to_s)
|
banner_sanitized = Rex::Text.to_hex_ascii(self.banner.to_s)
|
||||||
print_status("FTP Banner: '#{banner_sanitized}'")
|
print_good("FTP Banner: '#{banner_sanitized}'")
|
||||||
report_service(:host => rhost, :port => rport, :name => "ftp", :info => banner_sanitized)
|
report_service(:host => rhost, :port => rport, :name => "ftp", :info => banner_sanitized)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -134,7 +134,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
banner << "DisplayName: #{ remote_display }"
|
banner << "DisplayName: #{ remote_display }"
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status("#{rhost}:#{rport} #{banner}")
|
print_good("#{rhost}:#{rport} #{banner}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "h323", :info => banner)
|
report_service(:host => rhost, :port => rport, :name => "h323", :info => banner)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -61,7 +61,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
if (res and res.code >= 200 and res.code < 300)
|
if (res and res.code >= 200 and res.code < 300)
|
||||||
print_status("Found #{wmap_base_url}#{file}")
|
print_good("Found #{wmap_base_url}#{file}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -160,7 +160,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if res.code.to_i == 400 and ecode != 400
|
if res.code.to_i == 400 and ecode != 400
|
||||||
print_error("Server returned an error code. #{wmap_base_url}#{teststr} #{res.code.to_i}")
|
print_error("Server returned an error code. #{wmap_base_url}#{teststr} #{res.code.to_i}")
|
||||||
else
|
else
|
||||||
print_status("Found #{wmap_base_url}#{teststr} #{res.code.to_i}")
|
print_good("Found #{wmap_base_url}#{teststr} #{res.code.to_i}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -132,7 +132,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if ecode != 400 and res.code.to_i == 400
|
if ecode != 400 and res.code.to_i == 400
|
||||||
print_error("[#{wmap_target_host}] Server returned a 400 error on #{wmap_base_url}#{filec} [#{res.code.to_i}]")
|
print_error("[#{wmap_target_host}] Server returned a 400 error on #{wmap_base_url}#{filec} [#{res.code.to_i}]")
|
||||||
else
|
else
|
||||||
print_status("[#{wmap_target_host}] Found #{wmap_base_url}#{filec} [#{res.code.to_i}]")
|
print_good("[#{wmap_target_host}] Found #{wmap_base_url}#{filec} [#{res.code.to_i}]")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
if (res and res.code >= 200 and res.code < 300)
|
if (res and res.code >= 200 and res.code < 300)
|
||||||
if res.to_s.include? "<title>Index of /" and res.to_s.include? "<h1>Index of /"
|
if res.to_s.include? "<title>Index of /" and res.to_s.include? "<h1>Index of /"
|
||||||
print_status("Found Directory Listing #{wmap_base_url}#{tpath}")
|
print_good("Found Directory Listing #{wmap_base_url}#{tpath}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
@ -66,7 +66,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
if res.to_s.include? "[To Parent Directory]</A>" and res.to_s.include? "#{tpath}</H1><hr>"
|
if res.to_s.include? "[To Parent Directory]</A>" and res.to_s.include? "#{tpath}</H1><hr>"
|
||||||
print_status("Found Directory Listing #{wmap_base_url}#{tpath}")
|
print_good("Found Directory Listing #{wmap_base_url}#{tpath}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -156,7 +156,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
:name => 'directory'
|
:name => 'directory'
|
||||||
)
|
)
|
||||||
|
|
||||||
print_status("Found #{wmap_base_url}#{tpath}#{testfdir} #{res.code} (#{wmap_target_host})")
|
print_good("Found #{wmap_base_url}#{tpath}#{testfdir} #{res.code} (#{wmap_target_host})")
|
||||||
|
|
||||||
if res.code.to_i == 401
|
if res.code.to_i == 401
|
||||||
print_status("#{wmap_base_url}#{tpath}#{testfdir} requires authentication: #{res.headers['WWW-Authenticate']}")
|
print_status("#{wmap_base_url}#{tpath}#{testfdir} requires authentication: #{res.headers['WWW-Authenticate']}")
|
||||||
|
|
|
@ -161,7 +161,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
if (res and res.code.to_i == 207)
|
if (res and res.code.to_i == 207)
|
||||||
print_status("\tFound vulnerable WebDAV Unicode bypass target #{wmap_base_url}#{tpath}%c0%af#{testfdir} #{res.code} (#{wmap_target_host})")
|
print_good("\tFound vulnerable WebDAV Unicode bypass target #{wmap_base_url}#{tpath}%c0%af#{testfdir} #{res.code} (#{wmap_target_host})")
|
||||||
|
|
||||||
# Unable to use report_web_vuln as method is PROPFIND and is not part of allowed
|
# Unable to use report_web_vuln as method is PROPFIND and is not part of allowed
|
||||||
# list in db.rb
|
# list in db.rb
|
||||||
|
|
|
@ -87,7 +87,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
if (res and res.code >= 200 and res.code < 300)
|
if (res and res.code >= 200 and res.code < 300)
|
||||||
print_status("Found #{wmap_base_url}#{tpath}#{testfext}")
|
print_good("Found #{wmap_base_url}#{tpath}#{testfext}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -161,7 +161,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if res.code.to_i == 400 and ecode != 400
|
if res.code.to_i == 400 and ecode != 400
|
||||||
print_error("Server returned an error code. #{wmap_base_url}#{tpath}#{testfext} #{res.code.to_i}")
|
print_error("Server returned an error code. #{wmap_base_url}#{tpath}#{testfext} #{res.code.to_i}")
|
||||||
else
|
else
|
||||||
print_status("Found #{wmap_base_url}#{tpath}#{testfext} #{res.code.to_i}")
|
print_good("Found #{wmap_base_url}#{tpath}#{testfext} #{res.code.to_i}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -117,7 +117,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
case retcode
|
case retcode
|
||||||
when /^200/
|
when /^200/
|
||||||
print_status("#{info} FrontPage ACCESS ALLOWED [#{retcode}]")
|
print_good("#{info} FrontPage ACCESS ALLOWED [#{retcode}]")
|
||||||
# Report a note or vulnerability or something
|
# Report a note or vulnerability or something
|
||||||
# Not really this one, but close
|
# Not really this one, but close
|
||||||
report_vuln(
|
report_vuln(
|
||||||
|
|
|
@ -182,7 +182,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
sys_name = get_system_name(res)
|
sys_name = get_system_name(res)
|
||||||
unless sys_name.blank?
|
unless sys_name.blank?
|
||||||
print_status("System name detected: #{sys_name}")
|
print_good("System name detected: #{sys_name}")
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
:type => "system.name",
|
:type => "system.name",
|
||||||
|
|
|
@ -72,7 +72,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
counter = 0;
|
counter = 0;
|
||||||
headers_uppercase.each do |h|
|
headers_uppercase.each do |h|
|
||||||
header_string = "#{h[0]}: #{h[1]}"
|
header_string = "#{h[0]}: #{h[1]}"
|
||||||
print_status "#{peer}: #{header_string}"
|
print_good "#{peer}: #{header_string}"
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:type => "http.header.#{rport}.#{counter}",
|
:type => "http.header.#{rport}.#{counter}",
|
||||||
|
|
|
@ -33,7 +33,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
connect
|
connect
|
||||||
res = send_request_raw({ 'uri' => '/', 'method' => 'GET' })
|
res = send_request_raw({ 'uri' => '/', 'method' => 'GET' })
|
||||||
fp = http_fingerprint(:response => res)
|
fp = http_fingerprint(:response => res)
|
||||||
print_status("#{ip}:#{rport} #{fp}") if fp
|
print_good("#{ip}:#{rport} #{fp}") if fp
|
||||||
report_service(:host => rhost, :port => rport, :sname => (ssl ? 'https' : 'http'), :info => fp)
|
report_service(:host => rhost, :port => rport, :sname => (ssl ? 'https' : 'http'), :info => fp)
|
||||||
rescue ::Timeout::Error, ::Errno::EPIPE
|
rescue ::Timeout::Error, ::Errno::EPIPE
|
||||||
ensure
|
ensure
|
||||||
|
|
|
@ -52,7 +52,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
version = res.headers['X-Jenkins']
|
version = res.headers['X-Jenkins']
|
||||||
print_status("Jenkins Version - #{version}")
|
print_good("Jenkins Version - #{version}")
|
||||||
report_service(
|
report_service(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
:port => rport,
|
:port => rport,
|
||||||
|
|
|
@ -54,7 +54,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
if version
|
if version
|
||||||
print_status("Joomla version: #{version}")
|
print_good("Joomla version: #{version}")
|
||||||
report_note(
|
report_note(
|
||||||
host: ip,
|
host: ip,
|
||||||
port: datastore['RPORT'],
|
port: datastore['RPORT'],
|
||||||
|
|
|
@ -120,7 +120,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
cred_table << [user, pass, hash, role, mail, salt]
|
cred_table << [user, pass, hash, role, mail, salt]
|
||||||
|
|
||||||
if pass
|
if pass
|
||||||
print_status("Found weak credentials (#{user}:#{pass})")
|
print_good("Found weak credentials (#{user}:#{pass})")
|
||||||
credential_data = {
|
credential_data = {
|
||||||
origin_type: :service,
|
origin_type: :service,
|
||||||
module_fullname: self.fullname,
|
module_fullname: self.fullname,
|
||||||
|
|
|
@ -90,7 +90,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
if (res.code.to_i == 207)
|
if (res.code.to_i == 207)
|
||||||
print_status("#{rhost}:#{rport} \tFound vulnerable WebDAV Unicode bypass. #{wmap_base_url}#{tpath}#{bogus}/ #{res.code} (#{wmap_target_host})")
|
print_good("#{rhost}:#{rport} \tFound vulnerable WebDAV Unicode bypass. #{wmap_base_url}#{tpath}#{bogus}/ #{res.code} (#{wmap_target_host})")
|
||||||
|
|
||||||
|
|
||||||
report_vuln(
|
report_vuln(
|
||||||
|
|
|
@ -40,7 +40,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
}, 10)
|
}, 10)
|
||||||
|
|
||||||
if (res and res.headers['Allow'])
|
if (res and res.headers['Allow'])
|
||||||
print_status("#{target_host} allows #{res.headers['Allow']} methods")
|
print_good("#{target_host} allows #{res.headers['Allow']} methods")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => target_host,
|
:host => target_host,
|
||||||
|
@ -52,7 +52,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
)
|
)
|
||||||
|
|
||||||
if(res.headers['Allow'].index('TRACE'))
|
if(res.headers['Allow'].index('TRACE'))
|
||||||
print_status "#{target_host}:#{rport} - TRACE method allowed."
|
print_good "#{target_host}:#{rport} - TRACE method allowed."
|
||||||
report_vuln(
|
report_vuln(
|
||||||
:host => target_host,
|
:host => target_host,
|
||||||
:port => rport,
|
:port => rport,
|
||||||
|
|
|
@ -83,7 +83,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
}, 20)
|
}, 20)
|
||||||
|
|
||||||
if (res and res.code >= 200 and res.code < 300)
|
if (res and res.code >= 200 and res.code < 300)
|
||||||
print_status("Found #{wmap_base_url}#{testf}")
|
print_good("Found #{wmap_base_url}#{testf}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -150,7 +150,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if res.code.to_i == 400 and ecode != 400
|
if res.code.to_i == 400 and ecode != 400
|
||||||
print_error("Server returned an error code. #{wmap_base_url}#{tpath} #{res.code.to_i}")
|
print_error("Server returned an error code. #{wmap_base_url}#{tpath} #{res.code.to_i}")
|
||||||
else
|
else
|
||||||
print_status("Found #{wmap_base_url}#{tpath}")
|
print_good("Found #{wmap_base_url}#{tpath}")
|
||||||
|
|
||||||
report_web_vuln(
|
report_web_vuln(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -56,7 +56,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
result = res.body.scan(datastore['PATTERN']).flatten.map{ |s| s.strip }.uniq
|
result = res.body.scan(datastore['PATTERN']).flatten.map{ |s| s.strip }.uniq
|
||||||
|
|
||||||
result.each do |u|
|
result.each do |u|
|
||||||
print_status("[#{target_host}] #{tpath} [#{u}]")
|
print_good("[#{target_host}] #{tpath} [#{u}]")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => target_host,
|
:host => target_host,
|
||||||
|
|
|
@ -172,7 +172,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
print_status("Server #{wmap_target_host}:#{datastore['RPORT']} returned HTTP 404 for #{datastore['PATH']}. Use a different one.")
|
print_status("Server #{wmap_target_host}:#{datastore['RPORT']} returned HTTP 404 for #{datastore['PATH']}. Use a different one.")
|
||||||
return false
|
return false
|
||||||
else
|
else
|
||||||
print_status("Server #{wmap_target_host}:#{datastore['RPORT']} responded to SOAPAction: #{v}#{n} with HTTP: #{res.code} #{res.message}.")
|
print_good("Server #{wmap_target_host}:#{datastore['RPORT']} responded to SOAPAction: #{v}#{n} with HTTP: #{res.code} #{res.message}.")
|
||||||
# Add Report
|
# Add Report
|
||||||
report_note(
|
report_note(
|
||||||
host: ip,
|
host: ip,
|
||||||
|
|
|
@ -49,7 +49,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
|
|
||||||
if res and res.body.include?("<td><h1>Application Trace</h1></td>")
|
if res and res.body.include?("<td><h1>Application Trace</h1></td>")
|
||||||
print_status("[#{target_host}] #{tpath}trace.axd FOUND.")
|
print_good("[#{target_host}] #{tpath}trace.axd FOUND.")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => target_host,
|
:host => target_host,
|
||||||
|
|
|
@ -118,7 +118,7 @@ require 'cgi'
|
||||||
if res and noexistsres
|
if res and noexistsres
|
||||||
|
|
||||||
if res.body != noexistsres.body
|
if res.body != noexistsres.body
|
||||||
print_status("[#{ip}] Vhost found #{thost} ")
|
print_good("[#{ip}] Vhost found #{thost} ")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -146,7 +146,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if res.code.to_i == 400 and ecode != 400
|
if res.code.to_i == 400 and ecode != 400
|
||||||
print_error("Server returned an error code. #{wmap_base_url}#{tpath}#{testfvuln} #{res.code.to_i}")
|
print_error("Server returned an error code. #{wmap_base_url}#{tpath}#{testfvuln} #{res.code.to_i}")
|
||||||
else
|
else
|
||||||
print_status("FOUND #{wmap_base_url}#{tpath}#{testfvuln} [#{res.code.to_i}] #{testnote}")
|
print_good("FOUND #{wmap_base_url}#{tpath}#{testfvuln} [#{res.code.to_i}] #{testnote}")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
@ -160,7 +160,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
else
|
else
|
||||||
if res and res.body.include?(testmesg)
|
if res and res.body.include?(testmesg)
|
||||||
print_status("FOUND #{wmap_base_url}#{tpath}#{testfvuln} [#{res.code.to_i}] #{testnote}")
|
print_good("FOUND #{wmap_base_url}#{tpath}#{testfvuln} [#{res.code.to_i}] #{testnote}")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -51,7 +51,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
|
|
||||||
result.each do |addr|
|
result.each do |addr|
|
||||||
print_status("Found internal IP in WebDAV response (#{target_host}) #{addr}")
|
print_good("Found internal IP in WebDAV response (#{target_host}) #{addr}")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => target_host,
|
:host => target_host,
|
||||||
|
|
|
@ -50,7 +50,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
result = res.body.scan(urlregex).uniq
|
result = res.body.scan(urlregex).uniq
|
||||||
|
|
||||||
result.each do |u|
|
result.each do |u|
|
||||||
print_status("Found file or directory in WebDAV response (#{target_host}) #{u}")
|
print_good("Found file or directory in WebDAV response (#{target_host}) #{u}")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => target_host,
|
:host => target_host,
|
||||||
|
|
|
@ -69,7 +69,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
def check_setup
|
def check_setup
|
||||||
version = wordpress_version
|
version = wordpress_version
|
||||||
vprint_status("Found Wordpress version: #{version}")
|
vprint_good("Found Wordpress version: #{version}")
|
||||||
|
|
||||||
if !wordpress_and_online?
|
if !wordpress_and_online?
|
||||||
print_error("#{peer}:#{rport}#{target_uri} does not appear to be running Wordpress or you got blocked! (Do Manual Check)")
|
print_error("#{peer}:#{rport}#{target_uri} does not appear to be running Wordpress or you got blocked! (Do Manual Check)")
|
||||||
|
|
|
@ -18,7 +18,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
def run_host(target_host)
|
def run_host(target_host)
|
||||||
print_status("Trying ip #{target_host}")
|
print_status("Trying #{target_host}")
|
||||||
if wordpress_and_online?
|
if wordpress_and_online?
|
||||||
version = wordpress_version
|
version = wordpress_version
|
||||||
version_string = version ? version : '(no version detected)'
|
version_string = version ? version : '(no version detected)'
|
||||||
|
|
|
@ -22,7 +22,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
begin
|
begin
|
||||||
connect
|
connect
|
||||||
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
||||||
print_status("#{ip}:#{rport} IMAP #{banner_sanitized}")
|
print_good("#{ip}:#{rport} IMAP #{banner_sanitized}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "imap", :info => banner)
|
report_service(:host => rhost, :port => rport, :name => "imap", :info => banner)
|
||||||
rescue ::Rex::ConnectionError
|
rescue ::Rex::ConnectionError
|
||||||
rescue ::EOFError
|
rescue ::EOFError
|
||||||
|
|
|
@ -49,7 +49,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
# if a version was identified, then out and store to DB
|
# if a version was identified, then out and store to DB
|
||||||
if ver
|
if ver
|
||||||
print_status("#{pkt[1]} - Found Jenkins Server #{ver} Version")
|
print_good("#{pkt[1]} - Found Jenkins Server #{ver} Version")
|
||||||
report_host(
|
report_host(
|
||||||
host: pkt[1],
|
host: pkt[1],
|
||||||
info: "Jenkins v.#{ver} (port typically 8080)"
|
info: "Jenkins v.#{ver} (port typically 8080)"
|
||||||
|
|
|
@ -91,7 +91,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if currentversion.length == 0 then
|
if currentversion.length == 0 then
|
||||||
''
|
''
|
||||||
else
|
else
|
||||||
print_status("#{ip}:#{rport} Lotus Domino Current Version: #{currentversion}")
|
print_good("#{ip}:#{rport} Lotus Domino Current Version: #{currentversion}")
|
||||||
end
|
end
|
||||||
|
|
||||||
check2.each do | check |
|
check2.each do | check |
|
||||||
|
@ -107,7 +107,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
# string we are regexing: <title>IBM Lotus Notes/Domino 6.5.6 Release Notes</title>
|
# string we are regexing: <title>IBM Lotus Notes/Domino 6.5.6 Release Notes</title>
|
||||||
if match = res.body.match(/\<title\>(.*)Lotus Notes\/Domino (.*) Release Notes\<\/title\>/);
|
if match = res.body.match(/\<title\>(.*)Lotus Notes\/Domino (.*) Release Notes\<\/title\>/);
|
||||||
server2 = $2
|
server2 = $2
|
||||||
print_status("#{ip}:#{rport} Lotus Domino Release Notes Version: " + $2)
|
print_good("#{ip}:#{rport} Lotus Domino Release Notes Version: " + $2)
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
:proto => 'tcp',
|
:proto => 'tcp',
|
||||||
|
@ -175,7 +175,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if baseversion.length == 0 then
|
if baseversion.length == 0 then
|
||||||
''
|
''
|
||||||
else
|
else
|
||||||
print_status("#{ip}:#{rport} Lotus Domino Base Install Version: #{baseversion}")
|
print_good("#{ip}:#{rport} Lotus Domino Base Install Version: #{baseversion}")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||||
|
|
|
@ -107,7 +107,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
uri = "http://#{rhost}:#{datastore['HTTP_PORT']}"
|
uri = "http://#{rhost}:#{datastore['HTTP_PORT']}"
|
||||||
print_status("Confirmed IE ActiveX HTTP interface (#{v}): #{uri}")
|
print_good("Confirmed IE ActiveX HTTP interface (#{v}): #{uri}")
|
||||||
|
|
||||||
report_service(
|
report_service(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
|
|
|
@ -80,7 +80,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
return_value = recv_return
|
return_value = recv_return
|
||||||
|
|
||||||
if return_value.nil?
|
if return_value.nil?
|
||||||
print_error("Failed to send RMI Call, anyway JAVA RMI Endpoint detected")
|
print_good("Failed to send RMI Call, anyway JAVA RMI Endpoint detected")
|
||||||
report_service(:host => rhost, :port => rport, :name => "java-rmi", :info => "")
|
report_service(:host => rhost, :port => rport, :name => "java-rmi", :info => "")
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
|
@ -71,7 +71,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
#Store the password if the parser returns something
|
#Store the password if the parser returns something
|
||||||
if password
|
if password
|
||||||
print_status("Password retrieved: #{password.to_s}")
|
print_good("Password retrieved: #{password.to_s}")
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: rhost,
|
ip: rhost,
|
||||||
port: rport,
|
port: rport,
|
||||||
|
|
|
@ -68,7 +68,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
else
|
else
|
||||||
offset += 1
|
offset += 1
|
||||||
version = data[offset..-1].unpack('Z*')[0]
|
version = data[offset..-1].unpack('Z*')[0]
|
||||||
print_status("#{rhost}:#{rport} is running MySQL #{version} (protocol #{proto})")
|
print_good("#{rhost}:#{rport} is running MySQL #{version} (protocol #{proto})")
|
||||||
report_service(
|
report_service(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
:port => rport,
|
:port => rport,
|
||||||
|
|
|
@ -126,7 +126,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status("#{ip} [#{host[:name]}] OS:#{os}#{user}#{names} #{addrs} Mac:#{host[:mac]} #{extra}")
|
print_good("#{ip} [#{host[:name]}] OS:#{os}#{user}#{names} #{addrs} Mac:#{host[:mac]} #{extra}")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -195,7 +195,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
@oracle_reported = true
|
@oracle_reported = true
|
||||||
end
|
end
|
||||||
user = extract_creds(oline)[0]
|
user = extract_creds(oline)[0]
|
||||||
print_status "#{msg} Locked: #{user} (SID: #{sid}) -- account valid but locked"
|
print_good "#{msg} Locked: #{user} (SID: #{sid}) -- account valid but locked"
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: addr,
|
ip: addr,
|
||||||
port: port,
|
port: port,
|
||||||
|
|
|
@ -26,7 +26,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
connect
|
connect
|
||||||
banner = sock.get_once(-1, 30)
|
banner = sock.get_once(-1, 30)
|
||||||
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
||||||
print_status("#{ip}:#{rport} POP3 #{banner_sanitized}")
|
print_good("#{ip}:#{rport} POP3 #{banner_sanitized}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "pop3", :info => banner)
|
report_service(:host => rhost, :port => rport, :name => "pop3", :info => banner)
|
||||||
rescue ::Rex::ConnectionError
|
rescue ::Rex::ConnectionError
|
||||||
rescue ::EOFError
|
rescue ::EOFError
|
||||||
|
|
|
@ -90,7 +90,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
resp = send_cmd(["LIST"])
|
resp = send_cmd(["LIST"])
|
||||||
|
|
||||||
if resp =~ /^[12]/
|
if resp =~ /^[12]/
|
||||||
print_status(" TCP OPEN #{ip}:#{port}")
|
print_good(" TCP OPEN #{ip}:#{port}")
|
||||||
report_service(:host => ip, :port => port)
|
report_service(:host => ip, :port => port)
|
||||||
end
|
end
|
||||||
rescue ::Exception
|
rescue ::Exception
|
||||||
|
|
|
@ -86,7 +86,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
next if not reply
|
next if not reply
|
||||||
|
|
||||||
if (reply.is_tcp? and reply.tcp_flags.syn == 1 and reply.tcp_flags.ack == 1)
|
if (reply.is_tcp? and reply.tcp_flags.syn == 1 and reply.tcp_flags.ack == 1)
|
||||||
print_status(" TCP OPEN #{dhost}:#{dport}")
|
print_good(" TCP OPEN #{dhost}:#{dport}")
|
||||||
report_service(:host => dhost, :port => dport)
|
report_service(:host => dhost, :port => dport)
|
||||||
end
|
end
|
||||||
rescue ::Exception
|
rescue ::Exception
|
||||||
|
|
|
@ -88,7 +88,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
vprint_good "#{rhost}:#{rport} Postgres - Logged in to '#{database}' with '#{user}':'#{password}'"
|
vprint_good "#{rhost}:#{rport} Postgres - Logged in to '#{database}' with '#{user}':'#{password}'"
|
||||||
print_status "#{rhost}:#{rport} Postgres - Version #{result[:auth]} (Post-Auth)"
|
print_status "#{rhost}:#{rport} Postgres - Version #{result[:auth]} (Post-Auth)"
|
||||||
elsif result[:preauth]
|
elsif result[:preauth]
|
||||||
print_status "#{rhost}:#{rport} Postgres - Version #{result[:preauth]} (Pre-Auth)"
|
print_good "#{rhost}:#{rport} Postgres - Version #{result[:preauth]} (Pre-Auth)"
|
||||||
else # It's something we don't know yet
|
else # It's something we don't know yet
|
||||||
vprint_status "#{rhost}:#{rport} Postgres - Authentication Error Fingerprint: #{result[:unknown]}"
|
vprint_status "#{rhost}:#{rport} Postgres - Authentication Error Fingerprint: #{result[:unknown]}"
|
||||||
print_status "#{rhost}:#{rport} Postgres - Version Unknown (Pre-Auth)"
|
print_status "#{rhost}:#{rport} Postgres - Version Unknown (Pre-Auth)"
|
||||||
|
|
|
@ -48,7 +48,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
res[:banner] = Rex::Proto::ADDP.reply_to_string( res )
|
res[:banner] = Rex::Proto::ADDP.reply_to_string( res )
|
||||||
|
|
||||||
unless @results[shost]
|
unless @results[shost]
|
||||||
print_status("#{shost}:#{datastore['RPORT']} ADDP #{res[:banner]}")
|
print_good("#{shost}:#{datastore['RPORT']} ADDP #{res[:banner]}")
|
||||||
report_service(
|
report_service(
|
||||||
:host => shost,
|
:host => shost,
|
||||||
:mac => res[:mac],
|
:mac => res[:mac],
|
||||||
|
|
|
@ -50,7 +50,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
return unless realport_connect
|
return unless realport_connect
|
||||||
|
|
||||||
info = "#{@realport_name} ( ports: #{@realport_port_count} )"
|
info = "#{@realport_name} ( ports: #{@realport_port_count} )"
|
||||||
vprint_status("#{target_host}:#{rport} is running #{info}")
|
vprint_good("#{target_host}:#{rport} is running #{info}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "realport", :info => info)
|
report_service(:host => rhost, :port => rport, :name => "realport", :info => info)
|
||||||
|
|
||||||
1.upto(@realport_port_count) do |pnum|
|
1.upto(@realport_port_count) do |pnum|
|
||||||
|
|
|
@ -29,7 +29,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
def run_host(target_host)
|
def run_host(target_host)
|
||||||
if realport_connect
|
if realport_connect
|
||||||
info = "#{@realport_name} ( ports: #{@realport_port_count} )"
|
info = "#{@realport_name} ( ports: #{@realport_port_count} )"
|
||||||
print_status("#{target_host}:#{rport} #{info}")
|
print_good("#{target_host}:#{rport} #{info}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "realport", :info => info)
|
report_service(:host => rhost, :port => rport, :name => "realport", :info => info)
|
||||||
end
|
end
|
||||||
realport_disconnect
|
realport_disconnect
|
||||||
|
|
|
@ -130,7 +130,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
case resp.to_i
|
case resp.to_i
|
||||||
when 401
|
when 401
|
||||||
print_status("Found user: #{testn} [Auth]")
|
print_good("Found user: #{testn} [Auth]")
|
||||||
# Add Report
|
# Add Report
|
||||||
report_note(
|
report_note(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
|
@ -141,7 +141,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
:data => "Found user: #{testn} [Auth]"
|
:data => "Found user: #{testn} [Auth]"
|
||||||
)
|
)
|
||||||
when 200
|
when 200
|
||||||
print_status("Found user: #{testn} [Open]")
|
print_good("Found user: #{testn} [Open]")
|
||||||
#Add Report
|
#Add Report
|
||||||
report_note(
|
report_note(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
|
|
|
@ -84,7 +84,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
case resp
|
case resp
|
||||||
when /^401/
|
when /^401/
|
||||||
print_status("Found user: #{testn} [Auth]")
|
print_good("Found user: #{testn} [Auth]")
|
||||||
# Add Report
|
# Add Report
|
||||||
report_note(
|
report_note(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
|
@ -94,7 +94,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
:data => "Found user: #{testn} [Auth]"
|
:data => "Found user: #{testn} [Auth]"
|
||||||
)
|
)
|
||||||
when /^200/
|
when /^200/
|
||||||
print_status("Found user: #{testn} [Open]")
|
print_good("Found user: #{testn} [Open]")
|
||||||
# Add Report
|
# Add Report
|
||||||
report_note(
|
report_note(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
|
|
|
@ -57,7 +57,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
ctime = Rex::Proto::SMB::Utils.time_smb_to_unix(*(res[108,8].unpack("VV").reverse))
|
ctime = Rex::Proto::SMB::Utils.time_smb_to_unix(*(res[108,8].unpack("VV").reverse))
|
||||||
btime = Rex::Proto::SMB::Utils.time_smb_to_unix(*(res[116,8].unpack("VV").reverse))
|
btime = Rex::Proto::SMB::Utils.time_smb_to_unix(*(res[116,8].unpack("VV").reverse))
|
||||||
utime = ctime - btime
|
utime = ctime - btime
|
||||||
print_status("#{ip} supports SMB 2 [dialect #{vers}] and has been online for #{utime/3600} hours")
|
print_good("#{ip} supports SMB 2 [dialect #{vers}] and has been online for #{utime/3600} hours")
|
||||||
# Add Report
|
# Add Report
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
@ -68,7 +68,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
:data => "supports SMB 2 [dialect #{vers}] and has been online for #{utime/3600} hours"
|
:data => "supports SMB 2 [dialect #{vers}] and has been online for #{utime/3600} hours"
|
||||||
)
|
)
|
||||||
else
|
else
|
||||||
print_status("#{ip} supports SMB 2.0")
|
print_good("#{ip} supports SMB 2.0")
|
||||||
# Add Report
|
# Add Report
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -128,7 +128,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
match_conf['host.domain'] = conf[:SMBDomain]
|
match_conf['host.domain'] = conf[:SMBDomain]
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status("Host is running #{desc}")
|
print_good("Host is running #{desc}")
|
||||||
|
|
||||||
# Report the service with a friendly banner
|
# Report the service with a friendly banner
|
||||||
report_service(
|
report_service(
|
||||||
|
|
|
@ -40,7 +40,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
begin
|
begin
|
||||||
connect
|
connect
|
||||||
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
||||||
print_status("SMTP #{banner_sanitized}")
|
print_good("SMTP #{banner_sanitized}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
|
report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
|
||||||
|
|
||||||
if datastore['EXTENDED']
|
if datastore['EXTENDED']
|
||||||
|
|
|
@ -26,7 +26,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
def run_host(ip)
|
def run_host(ip)
|
||||||
res = connect
|
res = connect
|
||||||
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
||||||
print_status("#{ip}:#{rport} SMTP #{banner_sanitized}")
|
print_good("#{ip}:#{rport} SMTP #{banner_sanitized}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
|
report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -84,7 +84,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
auth = Net::SSH::Authentication::Session.new(transport, opt_hash)
|
auth = Net::SSH::Authentication::Session.new(transport, opt_hash)
|
||||||
auth.authenticate("ssh-connection", Rex::Text.rand_text_alphanumeric(8), Rex::Text.rand_text_alphanumeric(8))
|
auth.authenticate("ssh-connection", Rex::Text.rand_text_alphanumeric(8), Rex::Text.rand_text_alphanumeric(8))
|
||||||
auth_method = auth.allowed_auth_methods.join('|')
|
auth_method = auth.allowed_auth_methods.join('|')
|
||||||
print_status "#{peer(ip)} Server Version: #{auth.transport.server_version.version}"
|
print_good "#{peer(ip)} Server Version: #{auth.transport.server_version.version}"
|
||||||
report_service(
|
report_service(
|
||||||
host: ip,
|
host: ip,
|
||||||
port: rport,
|
port: rport,
|
||||||
|
|
|
@ -84,7 +84,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status("SSH server version: #{ident}#{info}")
|
print_good("SSH server version: #{ident}#{info}")
|
||||||
report_service(host: rhost, port: rport, name: 'ssh', proto: 'tcp', info: ident)
|
report_service(host: rhost, port: rport, name: 'ssh', proto: 'tcp', info: ident)
|
||||||
end
|
end
|
||||||
rescue Timeout::Error
|
rescue Timeout::Error
|
||||||
|
|
|
@ -35,7 +35,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
::Timeout.timeout(to) do
|
::Timeout.timeout(to) do
|
||||||
res = connect
|
res = connect
|
||||||
if banner.start_with? "MAC address"
|
if banner.start_with? "MAC address"
|
||||||
print_status("#{ip}:#{rport} TELNET: #{banner}")
|
print_good("#{ip}:#{rport} TELNET: #{banner}")
|
||||||
version = banner.match(/Software version [\w\.]+ \(\d+\) \w*$/)[0]
|
version = banner.match(/Software version [\w\.]+ \(\d+\) \w*$/)[0]
|
||||||
report_service(:host => rhost, :port => rport, :name => "telnet", :info => "Lantronix Version: #{version}" )
|
report_service(:host => rhost, :port => rport, :name => "telnet", :info => "Lantronix Version: #{version}" )
|
||||||
end
|
end
|
||||||
|
|
|
@ -34,7 +34,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
res = connect
|
res = connect
|
||||||
# This makes db_services look a lot nicer.
|
# This makes db_services look a lot nicer.
|
||||||
banner_santized = Rex::Text.to_hex_ascii(banner.to_s)
|
banner_santized = Rex::Text.to_hex_ascii(banner.to_s)
|
||||||
print_status("#{ip}:#{rport} TELNET #{banner_santized}")
|
print_good("#{ip}:#{rport} TELNET #{banner_santized}")
|
||||||
report_service(:host => rhost, :port => rport, :name => "telnet", :info => banner_santized)
|
report_service(:host => rhost, :port => rport, :name => "telnet", :info => banner_santized)
|
||||||
end
|
end
|
||||||
rescue ::Rex::ConnectionError, ::Errno::ECONNRESET => e
|
rescue ::Rex::ConnectionError, ::Errno::ECONNRESET => e
|
||||||
|
|
|
@ -50,7 +50,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
udp_sock.sendto(pkt, ip, datastore['RPORT'])
|
udp_sock.sendto(pkt, ip, datastore['RPORT'])
|
||||||
resp = udp_sock.get(3)
|
resp = udp_sock.get(3)
|
||||||
if resp and resp.length >= 2 and resp[0, 2] == "\x00\x03"
|
if resp and resp.length >= 2 and resp[0, 2] == "\x00\x03"
|
||||||
print_status("Found #{filename} on #{ip}")
|
print_good("Found #{filename} on #{ip}")
|
||||||
#Add Report
|
#Add Report
|
||||||
report_note(
|
report_note(
|
||||||
:host => ip,
|
:host => ip,
|
||||||
|
|
|
@ -63,7 +63,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
banner << " Certificate:#{cert.subject.to_s}"
|
banner << " Certificate:#{cert.subject.to_s}"
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status "#{rhost}:#{rport} Banner: #{banner}"
|
print_good "#{rhost}:#{rport} Banner: #{banner}"
|
||||||
|
|
||||||
report_service(
|
report_service(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
|
|
|
@ -57,7 +57,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
|
|
||||||
if res.code == 200
|
if res.code == 200
|
||||||
#print_status("Output Of Requested File:\n#{res.body}")
|
#print_status("Output Of Requested File:\n#{res.body}")
|
||||||
print_status("#{target_host}:#{rport} appears vulnerable to VMWare Directory Traversal Vulnerability")
|
print_good("#{target_host}:#{rport} appears vulnerable to VMWare Directory Traversal Vulnerability")
|
||||||
report_vuln(
|
report_vuln(
|
||||||
{
|
{
|
||||||
:host => target_host,
|
:host => target_host,
|
||||||
|
|
|
@ -45,7 +45,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
ver = "#{vnc.majver}.#{vnc.minver}"
|
ver = "#{vnc.majver}.#{vnc.minver}"
|
||||||
print_status("#{target_host}:#{rport} - VNC server protocol version: #{ver}")
|
print_good("#{target_host}:#{rport} - VNC server protocol version: #{ver}")
|
||||||
svc = report_service(
|
svc = report_service(
|
||||||
:host => rhost,
|
:host => rhost,
|
||||||
:port => rport,
|
:port => rport,
|
||||||
|
|
|
@ -135,7 +135,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
if data[48,64] =~ /^.{1,16}\(\d+,\d+\)/
|
if data[48,64] =~ /^.{1,16}\(\d+,\d+\)/
|
||||||
buff = data[48, data.length-48]
|
buff = data[48, data.length-48]
|
||||||
boot,left = buff.split("\x00", 2)
|
boot,left = buff.split("\x00", 2)
|
||||||
print_status("#{pkt[1]}: BOOT> #{boot}")
|
print_good("#{pkt[1]}: BOOT> #{boot}")
|
||||||
report_note(
|
report_note(
|
||||||
:host => pkt[1],
|
:host => pkt[1],
|
||||||
:port => datastore['RPORT'],
|
:port => datastore['RPORT'],
|
||||||
|
@ -150,7 +150,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
res = wdbrpc_parse_connect_reply(data)
|
res = wdbrpc_parse_connect_reply(data)
|
||||||
|
|
||||||
if res[:rt_membase]
|
if res[:rt_membase]
|
||||||
print_status("#{pkt[1]}: #{res[:rt_vers]} #{res[:rt_bsp_name]} #{res[:rt_bootline]}")
|
print_good("#{pkt[1]}: #{res[:rt_vers]} #{res[:rt_bsp_name]} #{res[:rt_bootline]}")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => pkt[1],
|
:host => pkt[1],
|
||||||
|
|
|
@ -130,7 +130,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
res = wdbrpc_parse_connect_reply(data)
|
res = wdbrpc_parse_connect_reply(data)
|
||||||
print_status("#{pkt[1]}: #{res[:rt_vers]} #{res[:rt_bsp_name]} #{res[:rt_bootline]}")
|
print_good("#{pkt[1]}: #{res[:rt_vers]} #{res[:rt_bsp_name]} #{res[:rt_bootline]}")
|
||||||
|
|
||||||
report_note(
|
report_note(
|
||||||
:host => pkt[1],
|
:host => pkt[1],
|
||||||
|
|
|
@ -213,7 +213,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
if @state[c][:user] and @state[c][:pass]
|
if @state[c][:user] and @state[c][:pass]
|
||||||
print_status("DRDA LOGIN #{@state[c][:name]} Database: #{@state[c][:database]}; #{@state[c][:user]} / #{@state[c][:pass]}")
|
print_good("DRDA LOGIN #{@state[c][:name]} Database: #{@state[c][:database]}; #{@state[c][:user]} / #{@state[c][:pass]}")
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: @state[c][:ip],
|
ip: @state[c][:ip],
|
||||||
port: datastore['SRVPORT'],
|
port: datastore['SRVPORT'],
|
||||||
|
|
|
@ -164,7 +164,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
algorithm= ( auth_tokens['algorithm'] ? auth_tokens['algorithm'] : "MD5" )
|
algorithm= ( auth_tokens['algorithm'] ? auth_tokens['algorithm'] : "MD5" )
|
||||||
username = auth_tokens['username']
|
username = auth_tokens['username']
|
||||||
proof = "client: #{client_ip}; username: #{username}; nonce: #{datastore['NONCE']}; response: #{response}; algorithm: #{algorithm}"
|
proof = "client: #{client_ip}; username: #{username}; nonce: #{datastore['NONCE']}; response: #{response}; algorithm: #{algorithm}"
|
||||||
print_status("SIP LOGIN: #{proof}")
|
print_good("SIP LOGIN: #{proof}")
|
||||||
|
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: @requestor[:ip],
|
ip: @requestor[:ip],
|
||||||
|
|
|
@ -123,7 +123,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
c.put "\x00\r\n"
|
c.put "\x00\r\n"
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status("TELNET LOGIN #{@state[c][:name]} #{@state[c][:user]} / #{@state[c][:pass]}")
|
print_good("TELNET LOGIN #{@state[c][:name]} #{@state[c][:user]} / #{@state[c][:pass]}")
|
||||||
c.put "\r\nLogin failed\r\n\r\n"
|
c.put "\r\nLogin failed\r\n\r\n"
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: @state[c][:ip],
|
ip: @state[c][:ip],
|
||||||
|
|
|
@ -113,7 +113,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
elsif @state[c][:chall]
|
elsif @state[c][:chall]
|
||||||
c.put [0x00000001].pack("N")
|
c.put [0x00000001].pack("N")
|
||||||
c.close
|
c.close
|
||||||
print_status("#{peer} - Challenge: #{@challenge.unpack('H*')[0]}; Response: #{data.unpack('H*')[0]}")
|
print_good("#{peer} - Challenge: #{@challenge.unpack('H*')[0]}; Response: #{data.unpack('H*')[0]}")
|
||||||
hash_line = "$vnc$*#{@state[c][:chall].unpack("H*")[0]}*#{data.unpack('H*')[0]}"
|
hash_line = "$vnc$*#{@state[c][:chall].unpack("H*")[0]}*#{data.unpack('H*')[0]}"
|
||||||
report_cred(
|
report_cred(
|
||||||
ip: c.peerhost,
|
ip: c.peerhost,
|
||||||
|
|
|
@ -180,7 +180,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
next if not reply.is_arp?
|
next if not reply.is_arp?
|
||||||
# Without this check any arp request would be added to the cache
|
# Without this check any arp request would be added to the cache
|
||||||
if @dhosts.include? reply.arp_saddr_ip
|
if @dhosts.include? reply.arp_saddr_ip
|
||||||
print_status("#{reply.arp_saddr_ip} appears to be up.")
|
print_good("#{reply.arp_saddr_ip} appears to be up.")
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
@dsthosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
@dsthosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
||||||
end
|
end
|
||||||
|
@ -193,7 +193,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
while(reply = getreply())
|
while(reply = getreply())
|
||||||
next if not reply.is_arp?
|
next if not reply.is_arp?
|
||||||
if @dhosts.include? reply.arp_saddr_ip
|
if @dhosts.include? reply.arp_saddr_ip
|
||||||
print_status("#{reply.arp_saddr_ip} appears to be up.")
|
print_good("#{reply.arp_saddr_ip} appears to be up.")
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
@dsthosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
@dsthosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
||||||
end
|
end
|
||||||
|
@ -217,7 +217,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
while(reply = getreply())
|
while(reply = getreply())
|
||||||
next if not reply.is_arp?
|
next if not reply.is_arp?
|
||||||
if @shosts.include? reply.arp_saddr_ip
|
if @shosts.include? reply.arp_saddr_ip
|
||||||
print_status("#{reply.arp_saddr_ip} appears to be up.")
|
print_good("#{reply.arp_saddr_ip} appears to be up.")
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
@srchosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
@srchosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
||||||
end
|
end
|
||||||
|
@ -230,7 +230,7 @@ class MetasploitModule < Msf::Auxiliary
|
||||||
while(reply = getreply())
|
while(reply = getreply())
|
||||||
next if not reply.is_arp?
|
next if not reply.is_arp?
|
||||||
if @shosts.include? reply.arp_saddr_ip
|
if @shosts.include? reply.arp_saddr_ip
|
||||||
print_status("#{reply.arp_saddr_ip} appears to be up.")
|
print_good("#{reply.arp_saddr_ip} appears to be up.")
|
||||||
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
report_host(:host => reply.arp_saddr_ip, :mac=>reply.arp_saddr_mac)
|
||||||
@srchosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
@srchosts_cache[reply.arp_saddr_ip] = reply.arp_saddr_mac
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue