Fix spelling errors
git-svn-id: file:///home/svn/framework3/trunk@13983 4d416f70-5f16-0410-b530-b9f4589650daunstable
parent
39ecc19546
commit
975cc52bac
|
@ -65,7 +65,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
#Check to verify server reported is a 2wire router
|
#Check to verify server reported is a 2wire router
|
||||||
if (res.headers['Server'].match(/2wire Gateway/i))
|
if (res.headers['Server'].match(/2wire Gateway/i))
|
||||||
print_status("Server is a 2wire Gateway! Grabing info\n")
|
print_status("Server is a 2wire Gateway! Grabbing info\n")
|
||||||
else
|
else
|
||||||
print_error("Target doesn't seem to be a 2wire router. Exiting!")
|
print_error("Target doesn't seem to be a 2wire router. Exiting!")
|
||||||
return
|
return
|
||||||
|
|
|
@ -798,7 +798,7 @@ EOS
|
||||||
if i.strip != "MSSQLSERVER"
|
if i.strip != "MSSQLSERVER"
|
||||||
privinst = mssql_query("EXEC master..xp_regread \'HKEY_LOCAL_MACHINE\' ,\'SYSTEM\\CurrentControlSet\\Services\\MSSQL$#{i.strip}\',\'ObjectName\'")[:rows]
|
privinst = mssql_query("EXEC master..xp_regread \'HKEY_LOCAL_MACHINE\' ,\'SYSTEM\\CurrentControlSet\\Services\\MSSQL$#{i.strip}\',\'ObjectName\'")[:rows]
|
||||||
if privinst != nil
|
if privinst != nil
|
||||||
print_status("Instance #{i} SQL Server Service is running under the privilage of:")
|
print_status("Instance #{i} SQL Server Service is running under the privilege of:")
|
||||||
privinst.each do |p|
|
privinst.each do |p|
|
||||||
print_status("\t#{p[1]}")
|
print_status("\t#{p[1]}")
|
||||||
report_note(:host => datastore['RHOST'],
|
report_note(:host => datastore['RHOST'],
|
||||||
|
|
|
@ -225,7 +225,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
AND profile = 'DEFAULT'
|
AND profile = 'DEFAULT'
|
||||||
|
|
|
|
||||||
passreusemax = prepare_exec(query)
|
passreusemax = prepare_exec(query)
|
||||||
print_status("\tThe Maximun Number of Times a Password needs to be changed before it can be reused is set to #{passreusemax[0].chomp}")
|
print_status("\tThe Maximum Number of Times a Password needs to be changed before it can be reused is set to #{passreusemax[0].chomp}")
|
||||||
report_note(:host => datastore['RHOST'], :proto => 'tcp', :sname => 'TNS', :port => datastore['RPORT'], :type => 'ORA_ENUM', :data => "Password Maximun Reuse Time: #{passreusemax[0].chomp}")
|
report_note(:host => datastore['RHOST'], :proto => 'tcp', :sname => 'TNS', :port => datastore['RPORT'], :type => 'ORA_ENUM', :data => "Password Maximun Reuse Time: #{passreusemax[0].chomp}")
|
||||||
print_status("\tThe Number of Times a Password can be reused is set to #{passreuse[0].chomp}")
|
print_status("\tThe Number of Times a Password can be reused is set to #{passreuse[0].chomp}")
|
||||||
|
|
||||||
|
|
|
@ -126,7 +126,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
return if not resp
|
return if not resp
|
||||||
|
|
||||||
if resp.length != 0x108
|
if resp.length != 0x108
|
||||||
print_error("An unknown error occured while calling FindFirstFile.")
|
print_error("An unknown error occurred while calling FindFirstFile.")
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -151,7 +151,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
return if not resp
|
return if not resp
|
||||||
|
|
||||||
if resp.length != 0x108
|
if resp.length != 0x108
|
||||||
print_error("An unknown error occured while calling FindFirstFile.")
|
print_error("An unknown error occurred while calling FindFirstFile.")
|
||||||
break
|
break
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -186,7 +186,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
ret, = resp[8,4].unpack('V')
|
ret, = resp[8,4].unpack('V')
|
||||||
|
|
||||||
if ret == 0
|
if ret == 0
|
||||||
print_status("File #{args[0]} successfuly deleted.")
|
print_status("File #{args[0]} successfully deleted.")
|
||||||
else
|
else
|
||||||
print_error("An error occurred while deleting #{args[0]}: #{ret}.")
|
print_error("An error occurred while deleting #{args[0]}: #{ret}.")
|
||||||
end
|
end
|
||||||
|
@ -224,7 +224,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
serverprotect_closehandle(handle)
|
serverprotect_closehandle(handle)
|
||||||
|
|
||||||
print_status("File #{args[0]} successfuly downloaded.")
|
print_status("File #{args[0]} successfully downloaded.")
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
|
@ -257,7 +257,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
serverprotect_closehandle(handle)
|
serverprotect_closehandle(handle)
|
||||||
|
|
||||||
print_status("File #{args[1]} successfuly uploaded.")
|
print_status("File #{args[1]} successfully uploaded.")
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
|
@ -278,7 +278,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
ret, = resp[544,4].unpack('V')
|
ret, = resp[544,4].unpack('V')
|
||||||
|
|
||||||
if ret != 0
|
if ret != 0
|
||||||
print_error("An error occured while calling CreateFile: #{ret}.")
|
print_error("An error occurred while calling CreateFile: #{ret}.")
|
||||||
return 0
|
return 0
|
||||||
else
|
else
|
||||||
return handle
|
return handle
|
||||||
|
@ -301,7 +301,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
ret, = resp[4108,4].unpack('V')
|
ret, = resp[4108,4].unpack('V')
|
||||||
|
|
||||||
if ret != 0
|
if ret != 0
|
||||||
print_error("An error occured while calling CreateFile: #{ret}.")
|
print_error("An error occurred while calling CreateFile: #{ret}.")
|
||||||
return ''
|
return ''
|
||||||
else
|
else
|
||||||
br, = resp[4104, 4].unpack('V')
|
br, = resp[4104, 4].unpack('V')
|
||||||
|
@ -327,7 +327,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
ret, = resp[4108,4].unpack('V')
|
ret, = resp[4108,4].unpack('V')
|
||||||
|
|
||||||
if ret != 0
|
if ret != 0
|
||||||
print_error("An error occured while calling WriteFile: #{ret}.")
|
print_error("An error occurred while calling WriteFile: #{ret}.")
|
||||||
return 0
|
return 0
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
@ -348,7 +348,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
ret, = resp[8,4].unpack('V')
|
ret, = resp[8,4].unpack('V')
|
||||||
|
|
||||||
if ret != 0
|
if ret != 0
|
||||||
print_error("An error occured while calling CloseHandle: #{ret}.")
|
print_error("An error occurred while calling CloseHandle: #{ret}.")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -94,7 +94,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
authmethods = s.read(2)
|
authmethods = s.read(2)
|
||||||
|
|
||||||
print_status("Auth methods recieved. Sending null authentication option to client")
|
print_status("Auth methods received. Sending null authentication option to client")
|
||||||
client.write("\x01\x01")
|
client.write("\x01\x01")
|
||||||
client.read(1)
|
client.read(1)
|
||||||
s.put("\x01")
|
s.put("\x01")
|
||||||
|
|
|
@ -65,7 +65,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
disconnect_udp
|
disconnect_udp
|
||||||
|
|
||||||
if res[0] =~ /HELLO/
|
if res[0] =~ /HELLO/
|
||||||
print_error("DoS attempt failed. It apperas target is still up.")
|
print_error("DoS attempt failed. It appears target is still up.")
|
||||||
else
|
else
|
||||||
print_good("Target is down")
|
print_good("Target is down")
|
||||||
end
|
end
|
||||||
|
|
|
@ -480,7 +480,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
if(datastore['ENUM_BRT'])
|
if(datastore['ENUM_BRT'])
|
||||||
if wldcrd & datastore['STOP_WLDCRD']
|
if wldcrd & datastore['STOP_WLDCRD']
|
||||||
print_status("Wilcard Record Found!")
|
print_status("Wildcard Record Found!")
|
||||||
else
|
else
|
||||||
dnsbrute(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])
|
dnsbrute(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])
|
||||||
end
|
end
|
||||||
|
@ -488,7 +488,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
if(datastore['ENUM_IP6'])
|
if(datastore['ENUM_IP6'])
|
||||||
if wldcrd & datastore['STOP_WLDCRD']
|
if wldcrd & datastore['STOP_WLDCRD']
|
||||||
print_status("Wilcard Record Found!")
|
print_status("Wildcard Record Found!")
|
||||||
else
|
else
|
||||||
bruteipv6(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])
|
bruteipv6(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])
|
||||||
end
|
end
|
||||||
|
|
|
@ -11,11 +11,11 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
include Msf::Auxiliary::Report
|
include Msf::Auxiliary::Report
|
||||||
def initialize
|
def initialize
|
||||||
super(
|
super(
|
||||||
'Name' => 'IPv6 Local Neighbor Discovery Using Router Advertisment',
|
'Name' => 'IPv6 Local Neighbor Discovery Using Router Advertisement',
|
||||||
'Version' => '$Revision$',
|
'Version' => '$Revision$',
|
||||||
'Description' => %q{
|
'Description' => %q{
|
||||||
Send a spoofed router advertisment with high priority to force hosts to
|
Send a spoofed router advertisement with high priority to force hosts to
|
||||||
start the IPv6 address auto-config. Monitor for IPv6 host advertisments,
|
start the IPv6 address auto-config. Monitor for IPv6 host advertisements,
|
||||||
and try to guess the link-local address by concatinating the prefix, and
|
and try to guess the link-local address by concatinating the prefix, and
|
||||||
the host portion of the IPv6 address. Use NDP host solicitation to
|
the host portion of the IPv6 address. Use NDP host solicitation to
|
||||||
determine if the IP address is valid'
|
determine if the IP address is valid'
|
||||||
|
@ -152,12 +152,12 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
# Start caputure
|
# Start caputure
|
||||||
open_pcap({'FILTER' => "icmp6"})
|
open_pcap({'FILTER' => "icmp6"})
|
||||||
|
|
||||||
# Send router advertisment
|
# Send router advertisement
|
||||||
print_status("Sending router advertisment...")
|
print_status("Sending router advertisement...")
|
||||||
pkt = create_router_advertisment()
|
pkt = create_router_advertisment()
|
||||||
capture.inject(pkt.to_s)
|
capture.inject(pkt.to_s)
|
||||||
|
|
||||||
# Listen for host advertisments
|
# Listen for host advertisements
|
||||||
print_status("Listening for neighbor solicitation...")
|
print_status("Listening for neighbor solicitation...")
|
||||||
hosts = listen_for_neighbor_solicitation()
|
hosts = listen_for_neighbor_solicitation()
|
||||||
|
|
||||||
|
|
|
@ -66,7 +66,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
get_credentials(new_uri)
|
get_credentials(new_uri)
|
||||||
|
|
||||||
else
|
else
|
||||||
print_status("#{target_url} - Apache Axis - The remote page not acessible")
|
print_status("#{target_url} - Apache Axis - The remote page not accessible")
|
||||||
return
|
return
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
|
@ -145,7 +145,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
middle = (low + high) / 2;
|
middle = (low + high) / 2;
|
||||||
|
|
||||||
if datastore['DEBUG_INJ']
|
if datastore['DEBUG_INJ']
|
||||||
print_status("Lenght Low: #{low} High: #{high} Med: #{middle}")
|
print_status("Length Low: #{low} High: #{high} Med: #{middle}")
|
||||||
end
|
end
|
||||||
|
|
||||||
injlen = "'%20and%20string-length(#{xcomm})=#{middle}%20and%20'#{rnum}'='#{rnum}"
|
injlen = "'%20and%20string-length(#{xcomm})=#{middle}%20and%20'#{rnum}'='#{rnum}"
|
||||||
|
|
|
@ -21,7 +21,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
super(
|
super(
|
||||||
'Name' => 'Lotus Domino Password Hash Collector',
|
'Name' => 'Lotus Domino Password Hash Collector',
|
||||||
'Version' => '$Revision$',
|
'Version' => '$Revision$',
|
||||||
'Description' => 'Get users passwords hashs from names.nsf page',
|
'Description' => 'Get users passwords hashes from names.nsf page',
|
||||||
'Author' => 'Tiago Ferreira <tiago.ccna[at]gmail.com>',
|
'Author' => 'Tiago Ferreira <tiago.ccna[at]gmail.com>',
|
||||||
'License' => MSF_LICENSE
|
'License' => MSF_LICENSE
|
||||||
)
|
)
|
||||||
|
@ -42,7 +42,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
$uri = datastore['URI'].to_s
|
$uri = datastore['URI'].to_s
|
||||||
|
|
||||||
if (user.length == 0 and pass.length == 0)
|
if (user.length == 0 and pass.length == 0)
|
||||||
print_status("http://#{vhost}:#{rport} - Lotus Domino - Trying dump password hashs without credentials")
|
print_status("http://#{vhost}:#{rport} - Lotus Domino - Trying dump password hashes without credentials")
|
||||||
|
|
||||||
begin
|
begin
|
||||||
res = send_request_raw({
|
res = send_request_raw({
|
||||||
|
@ -71,7 +71,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
else
|
else
|
||||||
print_status("http://#{vhost}:#{rport} - Lotus Domino - Trying dump password hashs with given credentials")
|
print_status("http://#{vhost}:#{rport} - Lotus Domino - Trying dump password hashes with given credentials")
|
||||||
do_login(user, pass)
|
do_login(user, pass)
|
||||||
|
|
||||||
end
|
end
|
||||||
|
@ -100,7 +100,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
return :abort
|
return :abort
|
||||||
end
|
end
|
||||||
print_good("http://#{vhost}:#{rport} - Lotus Domino - SUCCESSFUL authentication for '#{user}'")
|
print_good("http://#{vhost}:#{rport} - Lotus Domino - SUCCESSFUL authentication for '#{user}'")
|
||||||
print_status("http://#{vhost}:#{rport} - Lotus Domino - Getting password hashs")
|
print_status("http://#{vhost}:#{rport} - Lotus Domino - Getting password hashes")
|
||||||
get_views(cookie,$uri)
|
get_views(cookie,$uri)
|
||||||
|
|
||||||
elsif (res and res.body.to_s =~ /names.nsf\?Login/)
|
elsif (res and res.body.to_s =~ /names.nsf\?Login/)
|
||||||
|
|
|
@ -158,7 +158,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
elsif (res.code == 200)
|
elsif (res.code == 200)
|
||||||
if (res.body =~ /ORA-01017:/ or res.body =~ /ORA-28273:/)
|
if (res.body =~ /ORA-01017:/ or res.body =~ /ORA-28273:/)
|
||||||
if sid.nil? || sid.empty?
|
if sid.nil? || sid.empty?
|
||||||
print_good("#{msg} Recieved ORA-01017 on a blank SID -- SIDs are not enforced upon login.")
|
print_good("#{msg} Received ORA-01017 on a blank SID -- SIDs are not enforced upon login.")
|
||||||
else
|
else
|
||||||
print_good("#{msg} Received ORA-01017, probable correct SID '#{sid.strip}'")
|
print_good("#{msg} Received ORA-01017, probable correct SID '#{sid.strip}'")
|
||||||
end
|
end
|
||||||
|
|
|
@ -24,7 +24,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
'Version' => '$Revision$',
|
'Version' => '$Revision$',
|
||||||
'Description' => %Q{
|
'Description' => %Q{
|
||||||
This module dumps the usernames and password hashes
|
This module dumps the usernames and password hashes
|
||||||
from Oracle given the propper Credentials and SID.
|
from Oracle given the proper Credentials and SID.
|
||||||
These are then stored as loot for later cracking.
|
These are then stored as loot for later cracking.
|
||||||
},
|
},
|
||||||
'Author' => ['TheLightCosine <thelightcosine[at]gmail.com>'],
|
'Author' => ['TheLightCosine <thelightcosine[at]gmail.com>'],
|
||||||
|
@ -94,7 +94,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
end
|
end
|
||||||
rescue => e
|
rescue => e
|
||||||
print_error("An error occured. The supplied credentials may not have propper privs")
|
print_error("An error occured. The supplied credentials may not have proper privs")
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
print_status("Hash table :\n #{tbl}")
|
print_status("Hash table :\n #{tbl}")
|
||||||
|
|
|
@ -112,7 +112,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
store_loot("sap.abap.syslog", "text/xml", rhost, res.body, "sap_abap_syslog.xml", "SAP ABAP syslog")
|
store_loot("sap.abap.syslog", "text/xml", rhost, res.body, "sap_abap_syslog.xml", "SAP ABAP syslog")
|
||||||
|
|
||||||
elsif fault
|
elsif fault
|
||||||
print_error("#{rhost}:#{rport} [SAP] Errorcode: #{faultcode}")
|
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_error("#{rhost}:#{rport} [SAP] failed to access ABAPSyslog")
|
print_error("#{rhost}:#{rport} [SAP] failed to access ABAPSyslog")
|
||||||
|
|
|
@ -140,7 +140,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
return
|
return
|
||||||
elsif fault
|
elsif fault
|
||||||
print_error("#{rhost}:#{rport} [SAP] Errorcode: #{faultcode}")
|
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_error("#{rhost}#{rport} [SAP] failed to access ABAPSyslog on #{rhost}:#{rport}")
|
print_error("#{rhost}#{rport} [SAP] failed to access ABAPSyslog on #{rhost}:#{rport}")
|
||||||
|
|
|
@ -152,7 +152,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
"SAP Get Logfile"
|
"SAP Get Logfile"
|
||||||
)
|
)
|
||||||
elsif fault
|
elsif fault
|
||||||
print_error("#{rhost}:#{rport} [SAP] Errorcode: #{faultcode}")
|
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_error("#{rhost}:#{rport} [SAP] failed to request environment")
|
print_error("#{rhost}:#{rport} [SAP] failed to request environment")
|
||||||
|
|
|
@ -210,7 +210,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
return
|
return
|
||||||
elsif fault
|
elsif fault
|
||||||
print_error("#{rhost}:#{rport} [SAP] Errorcode: #{faultcode}")
|
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_error("#{rhost}:#{rport} [SAP] failed to identify instance properties")
|
print_error("#{rhost}:#{rport} [SAP] failed to identify instance properties")
|
||||||
|
|
|
@ -160,7 +160,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
return
|
return
|
||||||
|
|
||||||
elsif fault
|
elsif fault
|
||||||
print_error("#{rhost}:#{rport} [SAP] Errorcode: #{faultcode}")
|
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
|
||||||
return
|
return
|
||||||
|
|
||||||
else
|
else
|
||||||
|
|
|
@ -140,7 +140,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
|
|
||||||
elsif fault
|
elsif fault
|
||||||
print_error("#{rhost}:#{rport} [SAP] Errorcode: #{faultcode}")
|
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_error("#{rhost}:#{rport} [SAP] failed to request environment")
|
print_error("#{rhost}:#{rport} [SAP] failed to request environment")
|
||||||
|
|
|
@ -137,7 +137,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
return
|
return
|
||||||
elsif fault
|
elsif fault
|
||||||
print_error("[SAP] Errorcode: #{faultcode}")
|
print_error("[SAP] Error code: #{faultcode}")
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_error("[SAP] failed to identify version")
|
print_error("[SAP] failed to identify version")
|
||||||
|
|
|
@ -148,7 +148,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
elsif nt_len == 0
|
elsif nt_len == 0
|
||||||
print_status("Empty hash from #{host} captured, ignoring ... ")
|
print_status("Empty hash from #{host} captured, ignoring ... ")
|
||||||
else
|
else
|
||||||
print_status("Unknow hash type from #{host}, ignoring ...")
|
print_status("Unknown hash type from #{host}, ignoring ...")
|
||||||
end
|
end
|
||||||
|
|
||||||
arg[:host] = host
|
arg[:host] = host
|
||||||
|
|
|
@ -120,7 +120,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
elsif wordcount == 0x0C
|
elsif wordcount == 0x0C
|
||||||
smb_cmd_session_setup(c, buff, true)
|
smb_cmd_session_setup(c, buff, true)
|
||||||
else
|
else
|
||||||
print_status("Unknow SMB_COM_SESSION_SETUP_ANDX request type , ignoring... ")
|
print_status("Unknown SMB_COM_SESSION_SETUP_ANDX request type , ignoring... ")
|
||||||
smb_error(cmd, c, CONST::SMB_STATUS_SUCCESS, @s_smb_esn)
|
smb_error(cmd, c, CONST::SMB_STATUS_SUCCESS, @s_smb_esn)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -320,7 +320,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_status("Unknow hash type from #{smb[:name]}, ignoring ...")
|
print_status("Unknown hash type from #{smb[:name]}, ignoring ...")
|
||||||
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
@ -381,7 +381,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
||||||
return
|
return
|
||||||
else
|
else
|
||||||
print_status("Unknow hash type capture from #{smb[:name]}, ignoring ...")
|
print_status("Unknown hash type capture from #{smb[:name]}, ignoring ...")
|
||||||
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
smb_error(CONST::SMB_COM_SESSION_SETUP_ANDX, c, CONST::SMB_STATUS_LOGON_FAILURE, true)
|
||||||
return
|
return
|
||||||
end
|
end
|
||||||
|
|
|
@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
uri << "(asdf)(('\\u0023rt.exec(\"CMD\".split(\"@\"))')(\\u0023rt\\u003d@java.lang.Runtime@getRuntime()))=1" if target['Platform'] == 'linux'
|
uri << "(asdf)(('\\u0023rt.exec(\"CMD\".split(\"@\"))')(\\u0023rt\\u003d@java.lang.Runtime@getRuntime()))=1" if target['Platform'] == 'linux'
|
||||||
uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd))
|
uri.gsub!(/CMD/, Rex::Text::uri_encode(cmd))
|
||||||
|
|
||||||
vprint_status("Attemping to execute: #{cmd}")
|
vprint_status("Attempting to execute: #{cmd}")
|
||||||
|
|
||||||
resp = send_request_raw({
|
resp = send_request_raw({
|
||||||
'uri' => uri,
|
'uri' => uri,
|
||||||
|
|
|
@ -131,7 +131,7 @@ EOS
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
||||||
print_error("Encountered unexpected #{res.code} reponse:")
|
print_error("Encountered unexpected #{res.code} response:")
|
||||||
print_error(res.inspect)
|
print_error(res.inspect)
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
|
|
|
@ -87,7 +87,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
res = sock.get_once
|
res = sock.get_once
|
||||||
|
|
||||||
if (!res)
|
if (!res)
|
||||||
print_error("Did not recieve data. Failed?")
|
print_error("Did not received data. Failed?")
|
||||||
else
|
else
|
||||||
print_status("Got data, execution successful!")
|
print_status("Got data, execution successful!")
|
||||||
end
|
end
|
||||||
|
|
|
@ -157,7 +157,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
uri << '?/x+/c+'
|
uri << '?/x+/c+'
|
||||||
uri << Rex::Text.uri_encode(cmd)
|
uri << Rex::Text.uri_encode(cmd)
|
||||||
|
|
||||||
vprint_status("Attemping to execute: #{uri}")
|
vprint_status("Attempting to execute: #{uri}")
|
||||||
|
|
||||||
mini_http_request({
|
mini_http_request({
|
||||||
'uri' => uri,
|
'uri' => uri,
|
||||||
|
|
|
@ -81,7 +81,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
end
|
end
|
||||||
|
|
||||||
print_status("")
|
print_status("")
|
||||||
print_status("Sucessfully authenticated to #{rhost}:#{rport} with user 'sa' and password '#{pass}'")
|
print_status("Successfully authenticated to #{rhost}:#{rport} with user 'sa' and password '#{pass}'")
|
||||||
print_status("")
|
print_status("")
|
||||||
|
|
||||||
exe = generate_payload_exe
|
exe = generate_payload_exe
|
||||||
|
|
|
@ -380,7 +380,7 @@ class Metasploit3 < Msf::Post
|
||||||
print_status("Capturing screenshot")
|
print_status("Capturing screenshot")
|
||||||
picture_name = ::Time.now.strftime("%Y%m%d.%M%S")
|
picture_name = ::Time.now.strftime("%Y%m%d.%M%S")
|
||||||
if check_root
|
if check_root
|
||||||
print_status("Capturing screenshot for each loginwindow process since privilage is root")
|
print_status("Capturing screenshot for each loginwindow process since privilege is root")
|
||||||
if session.type =~ /shell/
|
if session.type =~ /shell/
|
||||||
loginwindow_pids = session.shell_command_token("/bin/ps aux \| /usr/bin/awk \'/name/ \&\& \!/awk/ \{print \$2\}\'").split("\n")
|
loginwindow_pids = session.shell_command_token("/bin/ps aux \| /usr/bin/awk \'/name/ \&\& \!/awk/ \{print \$2\}\'").split("\n")
|
||||||
loginwindow_pids.each do |pid|
|
loginwindow_pids.each do |pid|
|
||||||
|
|
|
@ -36,7 +36,7 @@ class Metasploit3 < Msf::Post
|
||||||
[
|
[
|
||||||
OptInt.new('INTERVAL',[true, 'Time between key collection during logging',30]),
|
OptInt.new('INTERVAL',[true, 'Time between key collection during logging',30]),
|
||||||
OptInt.new('HEARTBEAT',[true, 'Heart beat between idle checks',30]),
|
OptInt.new('HEARTBEAT',[true, 'Heart beat between idle checks',30]),
|
||||||
OptInt.new('LOCKTIME',[true, 'Amount of idletime before lockout',300]),
|
OptInt.new('LOCKTIME',[true, 'Amount of idle time before lockout',300]),
|
||||||
OptInt.new('PID',[false,'Target PID, only needed if multiple winlogon.exe instances exist',nil]),
|
OptInt.new('PID',[false,'Target PID, only needed if multiple winlogon.exe instances exist',nil]),
|
||||||
OptBool.new('WAIT', [true, 'Wait for lockout instead of default method', false])
|
OptBool.new('WAIT', [true, 'Wait for lockout instead of default method', false])
|
||||||
], self.class)
|
], self.class)
|
||||||
|
@ -226,7 +226,7 @@ class Metasploit3 < Msf::Post
|
||||||
currentidle = session.ui.idle_time
|
currentidle = session.ui.idle_time
|
||||||
print_status("System has currently been idle for #{currentidle} seconds")
|
print_status("System has currently been idle for #{currentidle} seconds")
|
||||||
while currentidle <= datastore['locktime'] do
|
while currentidle <= datastore['locktime'] do
|
||||||
print_status("Current Idletime: #{currentidle} seconds")
|
print_status("Current Idle time: #{currentidle} seconds")
|
||||||
sleep(datastore['heartbeat'])
|
sleep(datastore['heartbeat'])
|
||||||
currentidle = session.ui.idle_time
|
currentidle = session.ui.idle_time
|
||||||
end
|
end
|
||||||
|
|
|
@ -85,7 +85,7 @@ class Metasploit3 < Msf::Post
|
||||||
print_status("IDM user credentials saved in: #{path}")
|
print_status("IDM user credentials saved in: #{path}")
|
||||||
|
|
||||||
rescue ::Exception => e
|
rescue ::Exception => e
|
||||||
print_error("An error has occured: #{e.to_s}")
|
print_error("An error has occurred: #{e.to_s}")
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
||||||
|
|
|
@ -157,7 +157,7 @@ class Metasploit3 < Msf::Post
|
||||||
if e.to_s =~ /execution expired/i
|
if e.to_s =~ /execution expired/i
|
||||||
print_error("Sorry, execution expired. Module could not finish running.")
|
print_error("Sorry, execution expired. Module could not finish running.")
|
||||||
else
|
else
|
||||||
print_error("An unexpected error has occured: #{e.to_s}:\n#{e.backtrace}")
|
print_error("An unexpected error has occurred: #{e.to_s}:\n#{e.backtrace}")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -348,7 +348,7 @@ class Metasploit3 < Msf::Post
|
||||||
end
|
end
|
||||||
|
|
||||||
#get creds from credential store
|
#get creds from credential store
|
||||||
print_status("Looking in the Credential Store for HTTP Authenication Creds...")
|
print_status("Looking in the Credential Store for HTTP Authentication Creds...")
|
||||||
#get data from credential store
|
#get data from credential store
|
||||||
ret = rg.advapi32.CredEnumerateA(nil,0,4,4)
|
ret = rg.advapi32.CredEnumerateA(nil,0,4,4)
|
||||||
p_to_arr = ret["Credentials"].unpack("V")
|
p_to_arr = ret["Credentials"].unpack("V")
|
||||||
|
|
|
@ -141,7 +141,7 @@ class Metasploit3 < Msf::Post
|
||||||
end
|
end
|
||||||
|
|
||||||
rescue ::Exception => e
|
rescue ::Exception => e
|
||||||
print_error("An error has occured: #{e.to_s}")
|
print_error("An error has occurred: #{e.to_s}")
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -116,7 +116,7 @@ class Metasploit3 < Msf::Post
|
||||||
'Payload' => mul.datastore['PAYLOAD'],
|
'Payload' => mul.datastore['PAYLOAD'],
|
||||||
'RunAsJob' => true
|
'RunAsJob' => true
|
||||||
)
|
)
|
||||||
print_good("Multi/Handler starterd!")
|
print_good("Multi/Handler started!")
|
||||||
end
|
end
|
||||||
|
|
||||||
# Function for Creating the Payload
|
# Function for Creating the Payload
|
||||||
|
|
|
@ -146,8 +146,8 @@ class Metasploit3 < Msf::Post
|
||||||
"CREATE_NEW_CONSOLE", nil, nil, startinfo, 16)
|
"CREATE_NEW_CONSOLE", nil, nil, startinfo, 16)
|
||||||
end
|
end
|
||||||
else
|
else
|
||||||
print_error("Insuficient Privileges, either you are not Admin or system or you elevated")
|
print_error("Insufficient Privileges, either you are not Admin or system or you elevated")
|
||||||
print_error("privs to system and do not have sufficent Priveldges. If you elevated to")
|
print_error("privs to system and do not have sufficient privileges. If you elevated to")
|
||||||
print_error("system, migrate to a process that was started as system (srvhost.exe)")
|
print_error("system, migrate to a process that was started as system (srvhost.exe)")
|
||||||
return 0
|
return 0
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue