diff --git a/lib/msf/core/auxiliary/auth_brute.rb b/lib/msf/core/auxiliary/auth_brute.rb index dbe155321c..aeda5ec0cd 100644 --- a/lib/msf/core/auxiliary/auth_brute.rb +++ b/lib/msf/core/auxiliary/auth_brute.rb @@ -49,6 +49,53 @@ module Auxiliary::AuthBrute @@max_per_service = nil end + # This method takes a {Metasploit::Framework::CredentialCollection} and prepends existing NTLMHashes + # from the database. This allows the users to use the DB_ALL_CREDS option. + # + # @param [Metasploit::Framework::CredentialCollection] the credential collection to add to + # @return [Metasploit::Framework::CredentialCollection] the modified Credentialcollection + def prepend_db_hashes(cred_collection) + if datastore['DB_ALL_CREDS'] && framework.db.active + creds = Metasploit::Credential::Core.joins(:private).where(metasploit_credential_privates: { type: 'Metasploit::Credential::NTLMHash' }, workspace_id: myworkspace.id) + creds.each do |cred| + cred_collection.prepend_cred(cred.to_credential) + end + end + cred_collection + end + + # This method takes a {Metasploit::Framework::CredentialCollection} and prepends existing SSHKeys + # from the database. This allows the users to use the DB_ALL_CREDS option. + # + # @param [Metasploit::Framework::CredentialCollection] the credential collection to add to + # @return [Metasploit::Framework::CredentialCollection] the modified Credentialcollection + def prepend_db_keys(cred_collection) + if datastore['DB_ALL_CREDS'] && framework.db.active + creds = Metasploit::Credential::Core.joins(:private).where(metasploit_credential_privates: { type: 'Metasploit::Credential::SSHKey' }, workspace_id: myworkspace.id) + creds.each do |cred| + cred_collection.prepend_cred(cred.to_credential) + end + end + cred_collection + end + + # This method takes a {Metasploit::Framework::CredentialCollection} and prepends existing Password Credentials + # from the database. This allows the users to use the DB_ALL_CREDS option. + # + # @param [Metasploit::Framework::CredentialCollection] the credential collection to add to + # @return [Metasploit::Framework::CredentialCollection] the modified Credentialcollection + def prepend_db_passwords(cred_collection) + if datastore['DB_ALL_CREDS'] && framework.db.active + creds = Metasploit::Credential::Core.joins(:private).where(metasploit_credential_privates: { type: 'Metasploit::Credential::Password' }, workspace_id: myworkspace.id) + creds.each do |cred| + cred_collection.prepend_cred(cred.to_credential) + end + end + cred_collection + end + + + # Checks all three files for usernames and passwords, and combines them into # one credential list to apply against the supplied block. The block (usually # something like do_login(user,pass) ) is responsible for actually recording diff --git a/modules/auxiliary/scanner/afp/afp_login.rb b/modules/auxiliary/scanner/afp/afp_login.rb index c44bd6a52e..f94c8d1c91 100644 --- a/modules/auxiliary/scanner/afp/afp_login.rb +++ b/modules/auxiliary/scanner/afp/afp_login.rb @@ -54,6 +54,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::AFP.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/db2/db2_auth.rb b/modules/auxiliary/scanner/db2/db2_auth.rb index 538ecaf5a1..013ee57bd7 100644 --- a/modules/auxiliary/scanner/db2/db2_auth.rb +++ b/modules/auxiliary/scanner/db2/db2_auth.rb @@ -52,6 +52,8 @@ class Metasploit3 < Msf::Auxiliary realm: datastore['DATABASE'] ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::DB2.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/ftp/ftp_login.rb b/modules/auxiliary/scanner/ftp/ftp_login.rb index 20dae7114b..0ab4ea0c3b 100644 --- a/modules/auxiliary/scanner/ftp/ftp_login.rb +++ b/modules/auxiliary/scanner/ftp/ftp_login.rb @@ -66,6 +66,8 @@ class Metasploit3 < Msf::Auxiliary prepended_creds: anonymous_creds ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::FTP.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/http/axis_login.rb b/modules/auxiliary/scanner/http/axis_login.rb index 4b5f678b1d..fc346ee0dc 100644 --- a/modules/auxiliary/scanner/http/axis_login.rb +++ b/modules/auxiliary/scanner/http/axis_login.rb @@ -72,6 +72,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::Axis2.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/http/http_login.rb b/modules/auxiliary/scanner/http/http_login.rb index 6116a5b28e..0238e3c266 100644 --- a/modules/auxiliary/scanner/http/http_login.rb +++ b/modules/auxiliary/scanner/http/http_login.rb @@ -129,6 +129,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::HTTP.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/http/tomcat_mgr_login.rb b/modules/auxiliary/scanner/http/tomcat_mgr_login.rb index 5fe87e5249..86a6eaef2d 100644 --- a/modules/auxiliary/scanner/http/tomcat_mgr_login.rb +++ b/modules/auxiliary/scanner/http/tomcat_mgr_login.rb @@ -103,13 +103,17 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::Tomcat.new( host: ip, port: rport, proxies: datastore['PROXIES'], cred_details: cred_collection, stop_on_success: datastore['STOP_ON_SUCCESS'], - connection_timeout: 10 + connection_timeout: 10, + user_agent: datastore['UserAgent'], + vhost: datastore['VHOST'] ) scanner.scan! do |result| diff --git a/modules/auxiliary/scanner/mssql/mssql_login.rb b/modules/auxiliary/scanner/mssql/mssql_login.rb index d2c0885a66..9fd20bda6b 100644 --- a/modules/auxiliary/scanner/mssql/mssql_login.rb +++ b/modules/auxiliary/scanner/mssql/mssql_login.rb @@ -43,6 +43,8 @@ class Metasploit3 < Msf::Auxiliary realm: datastore['DOMAIN'] ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::MSSQL.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/mysql/mysql_login.rb b/modules/auxiliary/scanner/mysql/mysql_login.rb index f93dda1485..0b3cefeec2 100644 --- a/modules/auxiliary/scanner/mysql/mysql_login.rb +++ b/modules/auxiliary/scanner/mysql/mysql_login.rb @@ -47,6 +47,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::MySQL.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/pop3/pop3_login.rb b/modules/auxiliary/scanner/pop3/pop3_login.rb index bbdfebb949..290d1f01f1 100644 --- a/modules/auxiliary/scanner/pop3/pop3_login.rb +++ b/modules/auxiliary/scanner/pop3/pop3_login.rb @@ -62,6 +62,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::POP3.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/postgres/postgres_login.rb b/modules/auxiliary/scanner/postgres/postgres_login.rb index 07b9d300d9..cc63a56ff3 100644 --- a/modules/auxiliary/scanner/postgres/postgres_login.rb +++ b/modules/auxiliary/scanner/postgres/postgres_login.rb @@ -60,6 +60,8 @@ class Metasploit3 < Msf::Auxiliary realm: datastore['DATABASE'] ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::Postgres.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/smb/smb_login.rb b/modules/auxiliary/scanner/smb/smb_login.rb index 13880ebe4e..113bd3c06b 100644 --- a/modules/auxiliary/scanner/smb/smb_login.rb +++ b/modules/auxiliary/scanner/smb/smb_login.rb @@ -96,6 +96,9 @@ class Metasploit3 < Msf::Auxiliary realm: domain, ) + cred_collection = prepend_db_passwords(cred_collection) + cred_collection = prepend_db_hashes(cred_collection) + @scanner.cred_details = cred_collection @scanner.scan! do |result| diff --git a/modules/auxiliary/scanner/ssh/ssh_login.rb b/modules/auxiliary/scanner/ssh/ssh_login.rb index 7861719284..8e984c7893 100644 --- a/modules/auxiliary/scanner/ssh/ssh_login.rb +++ b/modules/auxiliary/scanner/ssh/ssh_login.rb @@ -107,6 +107,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::SSH.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb b/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb index ebad012f29..a2f5757bbc 100644 --- a/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb +++ b/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb @@ -196,6 +196,8 @@ class Metasploit3 < Msf::Auxiliary username: datastore['USERNAME'], ) + keys = prepend_db_keys(keys) + print_brute :level => :vstatus, :ip => ip, :msg => "Testing #{keys.key_data.count} keys" scanner = Metasploit::Framework::LoginScanner::SSH.new( host: ip, @@ -236,7 +238,7 @@ class Metasploit3 < Msf::Auxiliary end - class KeyCollection + class KeyCollection < Metasploit::Framework::CredentialCollection attr_accessor :key_data def initialize(opts={}) @@ -272,6 +274,8 @@ class Metasploit3 < Msf::Auxiliary end def each + prepended_creds.each { |c| yield c } + if @user_file.present? File.open(@user_file, 'rb') do |user_fd| user_fd.each_line do |user_from_file| diff --git a/modules/auxiliary/scanner/telnet/telnet_login.rb b/modules/auxiliary/scanner/telnet/telnet_login.rb index 1ba1e0ccc4..206ab55be5 100644 --- a/modules/auxiliary/scanner/telnet/telnet_login.rb +++ b/modules/auxiliary/scanner/telnet/telnet_login.rb @@ -57,6 +57,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::Telnet.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/vnc/vnc_login.rb b/modules/auxiliary/scanner/vnc/vnc_login.rb index f4a0ab5772..31bfc44f02 100644 --- a/modules/auxiliary/scanner/vnc/vnc_login.rb +++ b/modules/auxiliary/scanner/vnc/vnc_login.rb @@ -68,6 +68,8 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'] ) + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::VNC.new( host: ip, port: rport, diff --git a/modules/auxiliary/scanner/winrm/winrm_login.rb b/modules/auxiliary/scanner/winrm/winrm_login.rb index f80e458d59..ec0a77a730 100644 --- a/modules/auxiliary/scanner/winrm/winrm_login.rb +++ b/modules/auxiliary/scanner/winrm/winrm_login.rb @@ -50,6 +50,9 @@ class Metasploit3 < Msf::Auxiliary user_as_pass: datastore['USER_AS_PASS'], realm: datastore['DOMAIN'], ) + + cred_collection = prepend_db_passwords(cred_collection) + scanner = Metasploit::Framework::LoginScanner::WinRM.new( host: ip, port: rport,