Fixed code issues as requested in PR2801
Mostly coding style issues Re-tested in testbed - output as expectedbug/bundler_fix
kicks4kittens
parent
87648476e1
commit
d0d82fe405
|
|
@ -8,391 +8,385 @@ require 'uri'
|
|||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'IBM Lotus Sametime Version Enumeration',
|
||||
'Description' => %q{
|
||||
This module scans an IBM Lotus Sametime web interface to enumerate
|
||||
the version and configuration information.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'kicks4kittens' # Metasploit module
|
||||
],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(443),
|
||||
OptString.new('TARGETURI', [ true, "The path to the Sametime Server", '/']),
|
||||
OptBool.new('QuerySametimeProxy', [ true, "Automatically query Sametime proxy if found", true]),
|
||||
OptBool.new('ShowVersions', [ true, "Display Version information from server", true]),
|
||||
OptBool.new('ShowConfig', [ true, "Display Config information from server", true]),
|
||||
OptBool.new('ShowAPIVersions', [ true, "Display API Version information from server", false])
|
||||
], self.class)
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'IBM Lotus Sametime Version Enumeration',
|
||||
'Description' => %q{
|
||||
This module scans an IBM Lotus Sametime web interface to enumerate
|
||||
the version and configuration information.
|
||||
},
|
||||
'Author' =>
|
||||
[
|
||||
'kicks4kittens' # Metasploit module
|
||||
],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
OptString.new('TARGETURI', [ true, "The path to the Sametime Server", '/']),
|
||||
OptBool.new('QuerySametimeProxy', [ true, "Automatically query Sametime proxy if found", true]),
|
||||
OptBool.new('ShowVersions', [ true, "Display Version information from server", true]),
|
||||
OptBool.new('ShowConfig', [ true, "Display Config information from server", true]),
|
||||
OptBool.new('ShowAPIVersions', [ true, "Display API Version information from server", false])
|
||||
], self.class)
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptBool.new('StoreConfigs', [ true, "Store JSON configs to loot", true])
|
||||
], self.class)
|
||||
register_advanced_options(
|
||||
[
|
||||
OptBool.new('StoreConfigs', [ true, "Store JSON configs to loot", true])
|
||||
], self.class)
|
||||
|
||||
end
|
||||
|
||||
def check_url(tpath, url, stproxy_rhost='')
|
||||
|
||||
if stproxy_rhost.empty?
|
||||
checked_host = datastore['RHOST']
|
||||
vprint_status("Requesting \"#{checked_host}:#{rport}#{normalize_uri(tpath, url)}\"")
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(tpath, url),
|
||||
'method' => 'GET'
|
||||
})
|
||||
else
|
||||
checked_host = stproxy_rhost
|
||||
# make request with provided stproxy rhost
|
||||
vprint_status("Requesting \"#{checked_host}:#{rport}#{normalize_uri(tpath, url)}\"")
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(tpath, url),
|
||||
'method' => 'GET',
|
||||
'rhost' => stproxy_rhost, # connect to Sametime Proxy
|
||||
'vhost' => stproxy_rhost # set appropriate VHOST
|
||||
})
|
||||
end
|
||||
|
||||
if not res
|
||||
print_status("#{checked_host}:#{rport} - Did not respond")
|
||||
return
|
||||
elsif res.code == 403
|
||||
print_status("#{checked_host}:#{rport} - Access Denied #{res.code} #{res.message}")
|
||||
return
|
||||
elsif not res.code == 200
|
||||
print_error("#{checked_host}:#{rport} - Unexpected Response code (#{res.code}) received from server")
|
||||
return
|
||||
end
|
||||
|
||||
if url.include?('WebAVServlet')
|
||||
# special handler for WebAVServlet as body is JSON regardless of content-type
|
||||
|
||||
begin
|
||||
res_json = JSON.parse(res.body)
|
||||
rescue JSON::ParserError
|
||||
print_error("Unable to parse JSON response")
|
||||
end
|
||||
extract_webavservlet_data(res_json)
|
||||
|
||||
elsif res['content-type'].include?("text/plain") or res['content-type'].include?("text/html")
|
||||
|
||||
res.body.each_line do | response_line |
|
||||
extract_response_data(response_line, url)
|
||||
end
|
||||
|
||||
elsif res['content-type'].include?("text/json") or res['content-type'].include?("text/javaScript")
|
||||
|
||||
begin
|
||||
res_json = JSON.parse(res.body)
|
||||
rescue JSON::ParserError
|
||||
print_error("Unable to parse JSON response")
|
||||
end
|
||||
|
||||
# store configuration files as loot
|
||||
store_config(tpath, url, res_json, checked_host) if datastore['StoreConfigs']
|
||||
|
||||
extract_json_data(res_json)
|
||||
|
||||
end
|
||||
|
||||
def peer
|
||||
return "#{rhost}:#{rport}"
|
||||
end
|
||||
|
||||
def extract_webavservlet_data(res_json)
|
||||
# extract data from WebAVServlet
|
||||
|
||||
# stwebav/WebAVServlet --> WebPlayer information
|
||||
if res_json['Softphone']
|
||||
@version_info['version']['Softphone'] = res_json['Softphone']
|
||||
end
|
||||
if res_json['WebPlayer']
|
||||
@version_info['version']['WebPlayer'] = res_json['WebPlayer']
|
||||
end
|
||||
|
||||
def check_url(tpath, url, stproxy_rhost='')
|
||||
end
|
||||
|
||||
begin
|
||||
if not stproxy_rhost.empty?
|
||||
checked_host = stproxy_rhost
|
||||
# make request with provided stproxy rhost
|
||||
vprint_status("Requesting \"#{checked_host}:#{rport}#{normalize_uri(tpath, url)}\"")
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(tpath, url),
|
||||
'method' => 'GET',
|
||||
'rhost' => stproxy_rhost, # connect to Sametime Proxy
|
||||
'vhost' => stproxy_rhost # set appropriate VHOST
|
||||
})
|
||||
else
|
||||
checked_host = datastore['RHOST']
|
||||
vprint_status("Requesting \"#{checked_host}:#{rport}#{normalize_uri(tpath, url)}\"")
|
||||
res = send_request_cgi({
|
||||
'uri' => normalize_uri(tpath, url),
|
||||
'method' => 'GET'
|
||||
})
|
||||
def extract_response_data(response_line, url)
|
||||
# extract data from response
|
||||
|
||||
end
|
||||
case response_line
|
||||
# stmeetings/about.jsp --> Sametime Server version string
|
||||
when /lotusBuild">Release (.+?)<\/td>/i
|
||||
# lotus build version
|
||||
@version_info['version']['sametimeVersion'] = $1.chomp
|
||||
# serverversion.properties --> API Version information
|
||||
when /^meeting=(.*)$/i
|
||||
# meeting api version
|
||||
@version_info['api']['meeting'] = $1.chomp
|
||||
when /^appshare=(.*)$/i
|
||||
# appshare api version
|
||||
@version_info['api']['appshare'] = $1.chomp
|
||||
when /^docshare=(.*)$/i
|
||||
# docshare api version
|
||||
@version_info['api']['docshare'] = $1.chomp
|
||||
when /^rtc4web=(.*)$/i
|
||||
# rtc4web api version
|
||||
@version_info['api']['rtc4web'] = $1.chomp
|
||||
when /^roomapi=(.*)$/i
|
||||
# room api version
|
||||
@version_info['api']['roomapi'] = $1.chomp
|
||||
when /^recordings=(.*)$/i
|
||||
# recording api version
|
||||
@version_info['api']['recordings'] = $1.chomp
|
||||
when /^audio=(.*)$/i
|
||||
# audio api version
|
||||
@version_info['api']['audio'] = $1.chomp
|
||||
when /^video=(.*)$/i
|
||||
# video api version
|
||||
@version_info['api']['video'] = $1.chomp
|
||||
# rtc/buildinfo.txt --> Server Build version
|
||||
when /^(\d{8}-\d+)$/
|
||||
if url.include?('buildinfo.txt')
|
||||
# buildinfo version
|
||||
@version_info['version']['buildinfo'] = $1.chomp
|
||||
end
|
||||
# stwebclient/i18nStrings.jsp --> Sametime Server version string
|
||||
when /aboutBoxProductTitle":"(.*?)",/i
|
||||
if not @version_info['version']['sametimeVersion']
|
||||
# sametime version
|
||||
@version_info['version']['sametimeVersion'] = $1.chomp
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if not res
|
||||
print_status("#{checked_host}:#{rport} - Did not respond")
|
||||
return
|
||||
elsif res.code == 403
|
||||
print_status("#{checked_host}:#{rport} - Access Denied #{res.code} #{res.message}")
|
||||
return
|
||||
elsif not res.code == 200
|
||||
print_error("#{checked_host}:#{rport} - Unexpected Response code (#{res.code}) received from server")
|
||||
return
|
||||
end
|
||||
|
||||
if url.include?('WebAVServlet')
|
||||
# special handler for WebAVServlet as body is JSON regardless of content-type
|
||||
def extract_json_data(res_json)
|
||||
# extract data from JSON response
|
||||
|
||||
res_json = JSON.parse(res.body)
|
||||
extract_webavservlet_data(res_json)
|
||||
|
||||
elsif res['content-type'].include?("text/plain") or res['content-type'].include?("text/html")
|
||||
|
||||
res.body.each_line do | response_line |
|
||||
extract_response_data(response_line, url)
|
||||
end
|
||||
|
||||
elsif res['content-type'].include?("text/json") or res['content-type'].include?("text/javaScript")
|
||||
|
||||
res_json = JSON.parse(res.body)
|
||||
|
||||
# store configuration files as loot
|
||||
store_config(tpath, url, res_json, checked_host) if datastore['StoreConfigs']
|
||||
|
||||
extract_json_data(res_json)
|
||||
|
||||
end
|
||||
|
||||
rescue Errno::ENOPROTOOPT, Errno::ECONNRESET, ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::ArgumentError
|
||||
print_error("#{checked_host}:#{rport} - Unable to Connect")
|
||||
return
|
||||
rescue ::Timeout::Error, ::Errno::EPIPE
|
||||
print_error("#{checked_host}:#{rport} - Timeout error")
|
||||
return
|
||||
end
|
||||
# stwebclient/communityserver --> Community server address
|
||||
if res_json['communityRef']
|
||||
@version_info['conf']['communityRef'] = res_json['communityRef']
|
||||
end
|
||||
if res_json['anonymousEnabled']
|
||||
@version_info['conf']['communityref_anonymousEnabled'] = res_json['anonymousEnabled']
|
||||
# stmeetings/configuration --> Sametime configuration
|
||||
end
|
||||
if res_json['calinteg.enabled']
|
||||
@version_info['conf']['calinteg.enabled'] = res_json['calinteg.enabled']
|
||||
end
|
||||
if res_json['docshare.fileio.codebase']
|
||||
@version_info['conf']['docshare.fileio.codebase'] = res_json['docshare.fileio.codebase']
|
||||
end
|
||||
if res_json['docshare.native.codebase']
|
||||
@version_info['conf']['docshare.native.codebase'] = res_json['docshare.native.codebase']
|
||||
end
|
||||
if res_json['docshare.remote.url']
|
||||
@version_info['conf']['docshare.remote.url'] = res_json['docshare.remote.url']
|
||||
end
|
||||
if res_json['meetingroom.allowGuestAccess']
|
||||
if res_json['meetingroom.allowGuestAccess'] == "1"
|
||||
@version_info['conf']['meetingroom.allowGuestAccess'] = "true"
|
||||
else
|
||||
@version_info['conf']['meetingroom.allowGuestAccess'] = "false"
|
||||
end
|
||||
end
|
||||
if res_json['meetingroomcenter.allowGuestAccess']
|
||||
if res_json['meetingroomcenter.allowGuestAccess'] == "1"
|
||||
@version_info['conf']['meetingroomcenter.allowGuestAccess'] = "true"
|
||||
else
|
||||
@version_info['conf']['meetingroomcenter.allowGuestAccess'] = "false"
|
||||
end
|
||||
end
|
||||
if res_json['meetingroomcenter.customLoginPage']
|
||||
@version_info['conf']['meetingroomcenter.customLoginPage'] = res_json['meetingroomcenter.customLoginPage']
|
||||
end
|
||||
if res_json['meetingroomcenter.enforceCSRFToken']
|
||||
@version_info['conf']['meetingroomcenter.enforceCSRFToken'] = res_json['meetingroomcenter.enforceCSRFToken']
|
||||
end
|
||||
if res_json['meetingroomcenter.enforceHiddenRooms']
|
||||
@version_info['conf']['meetingroomcenter.enforceHiddenRooms'] = res_json['meetingroomcenter.enforceHiddenRooms']
|
||||
end
|
||||
if res_json['meetingroomcenter.passwords']
|
||||
@version_info['conf']['meetingroomcenter.passwords'] = res_json['meetingroomcenter.passwords']
|
||||
end
|
||||
if res_json['meetingserver.statistics.jmx.enabled']
|
||||
@version_info['conf']['meetingserver.statistics.jmx.enabled'] = res_json['meetingserver.statistics.jmx.enabled']
|
||||
end
|
||||
if res_json['rtc4web.enforceNonce']
|
||||
@version_info['conf']['rtc4web.enforceNonce'] = res_json['rtc4web.enforceNonce']
|
||||
end
|
||||
if res_json['userInfoRedirect']
|
||||
@version_info['conf']['userInfoRedirect'] = res_json['userInfoRedirect']
|
||||
end
|
||||
if res_json['userInfoUrlTemplate']
|
||||
@version_info['conf']['userInfoUrlTemplatee'] = res_json['userInfoUrlTemplate']
|
||||
end
|
||||
if res_json['meetingroomcenter.stProxyAddress']
|
||||
@version_info['conf']['meetingroomcenter.stProxyAddress'] = res_json['meetingroomcenter.stProxyAddress']
|
||||
end
|
||||
if res_json['meetingroomcenter.stProxySSLAddress']
|
||||
@version_info['conf']['meetingroomcenter.stProxySSLAddress'] = res_json['meetingroomcenter.stProxySSLAddress']
|
||||
end
|
||||
# stwebclient/communityserver --> Sametime Community server name
|
||||
if res_json['communityRef']
|
||||
@version_info['conf']['communityRef'] = res_json['communityRef']
|
||||
@version_info['conf']['anonymousEnabled'] = res_json['anonymousEnabled']
|
||||
end
|
||||
|
||||
def extract_webavservlet_data(res_json)
|
||||
# extract data from WebAVServlet
|
||||
end
|
||||
|
||||
# stwebav/WebAVServlet --> WebPlayer information
|
||||
if res_json['Softphone']
|
||||
@version_info['version']['Softphone'] = res_json['Softphone']
|
||||
end
|
||||
if res_json['WebPlayer']
|
||||
@version_info['version']['WebPlayer'] = res_json['WebPlayer']
|
||||
end
|
||||
def report
|
||||
|
||||
if @version_info['version']['sametimeVersion']
|
||||
print_line()
|
||||
print_good("#{@version_info['version']['sametimeVersion']} Detected (#{peer})")
|
||||
else
|
||||
print_line()
|
||||
print_status("#{peer} - IBM Lotus Sametime information")
|
||||
end
|
||||
|
||||
def extract_response_data(response_line, url)
|
||||
# extract data from response
|
||||
# configure tables
|
||||
version_tbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "IBM Lotus Sametime Information [Version]",
|
||||
'Prefix' => "",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"Component",
|
||||
"Version"
|
||||
])
|
||||
|
||||
case response_line
|
||||
# stmeetings/about.jsp --> Sametime Server version string
|
||||
when /lotusBuild">Release (.+?)<\/td>/i
|
||||
# lotus build version
|
||||
@version_info['version']['sametimeVersion'] = $1.chomp
|
||||
# serverversion.properties --> API Version information
|
||||
when /^meeting=(.*)$/i
|
||||
# meeting api version
|
||||
@version_info['api']['meeting'] = $1.chomp
|
||||
when /^appshare=(.*)$/i
|
||||
# appshare api version
|
||||
@version_info['api']['appshare'] = $1.chomp
|
||||
when /^docshare=(.*)$/i
|
||||
# docshare api version
|
||||
@version_info['api']['docshare'] = $1.chomp
|
||||
when /^rtc4web=(.*)$/i
|
||||
# rtc4web api version
|
||||
@version_info['api']['rtc4web'] = $1.chomp
|
||||
when /^roomapi=(.*)$/i
|
||||
# room api version
|
||||
@version_info['api']['roomapi'] = $1.chomp
|
||||
when /^recordings=(.*)$/i
|
||||
# recording api version
|
||||
@version_info['api']['recordings'] = $1.chomp
|
||||
when /^audio=(.*)$/i
|
||||
# audio api version
|
||||
@version_info['api']['audio'] = $1.chomp
|
||||
when /^video=(.*)$/i
|
||||
# video api version
|
||||
@version_info['api']['video'] = $1.chomp
|
||||
# rtc/buildinfo.txt --> Server Build version
|
||||
when /^(\d{8}-\d+)$/
|
||||
if url.include?('buildinfo.txt')
|
||||
# buildinfo version
|
||||
@version_info['version']['buildinfo'] = $1.chomp
|
||||
end
|
||||
# stwebclient/i18nStrings.jsp --> Sametime Server version string
|
||||
when /aboutBoxProductTitle":"(.*?)",/i
|
||||
if not @version_info['version']['sametimeVersion']
|
||||
# sametime version
|
||||
@version_info['version']['sametimeVersion'] = $1.chomp
|
||||
end
|
||||
end
|
||||
conf_tbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "IBM Lotus Sametime Information [Config]",
|
||||
'Prefix' => "",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"Key",
|
||||
"Value"
|
||||
])
|
||||
|
||||
api_tbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "IBM Lotus Sametime Information [API]",
|
||||
'Prefix' => "",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"API",
|
||||
"Version"
|
||||
])
|
||||
|
||||
# populate tables
|
||||
@version_info['version'].each do | line |
|
||||
version_tbl << [ line[0], line[1] ]
|
||||
end
|
||||
|
||||
|
||||
def extract_json_data(res_json)
|
||||
# extract data from JSON response
|
||||
|
||||
# stwebclient/communityserver --> Community server address
|
||||
if res_json['communityRef']
|
||||
@version_info['conf']['communityRef'] = res_json['communityRef']
|
||||
end
|
||||
if res_json['anonymousEnabled']
|
||||
@version_info['conf']['communityref_anonymousEnabled'] = res_json['anonymousEnabled']
|
||||
# stmeetings/configuration --> Sametime configuration
|
||||
end
|
||||
if res_json['calinteg.enabled']
|
||||
@version_info['conf']['calinteg.enabled'] = res_json['calinteg.enabled']
|
||||
end
|
||||
if res_json['docshare.fileio.codebase']
|
||||
@version_info['conf']['docshare.fileio.codebase'] = res_json['docshare.fileio.codebase']
|
||||
end
|
||||
if res_json['docshare.native.codebase']
|
||||
@version_info['conf']['docshare.native.codebase'] = res_json['docshare.native.codebase']
|
||||
end
|
||||
if res_json['docshare.remote.url']
|
||||
@version_info['conf']['docshare.remote.url'] = res_json['docshare.remote.url']
|
||||
end
|
||||
if res_json['meetingroom.allowGuestAccess']
|
||||
if res_json['meetingroom.allowGuestAccess'] == "1"
|
||||
@version_info['conf']['meetingroom.allowGuestAccess'] = "true"
|
||||
else
|
||||
@version_info['conf']['meetingroom.allowGuestAccess'] = "false"
|
||||
end
|
||||
end
|
||||
if res_json['meetingroomcenter.allowGuestAccess']
|
||||
if res_json['meetingroomcenter.allowGuestAccess'] == "1"
|
||||
@version_info['conf']['meetingroomcenter.allowGuestAccess'] = "true"
|
||||
else
|
||||
@version_info['conf']['meetingroomcenter.allowGuestAccess'] = "false"
|
||||
end
|
||||
end
|
||||
if res_json['meetingroomcenter.customLoginPage']
|
||||
@version_info['conf']['meetingroomcenter.customLoginPage'] = res_json['meetingroomcenter.customLoginPage']
|
||||
end
|
||||
if res_json['meetingroomcenter.enforceCSRFToken']
|
||||
@version_info['conf']['meetingroomcenter.enforceCSRFToken'] = res_json['meetingroomcenter.enforceCSRFToken']
|
||||
end
|
||||
if res_json['meetingroomcenter.enforceHiddenRooms']
|
||||
@version_info['conf']['meetingroomcenter.enforceHiddenRooms'] = res_json['meetingroomcenter.enforceHiddenRooms']
|
||||
end
|
||||
if res_json['meetingroomcenter.passwords']
|
||||
@version_info['conf']['meetingroomcenter.passwords'] = res_json['meetingroomcenter.passwords']
|
||||
end
|
||||
if res_json['meetingserver.statistics.jmx.enabled']
|
||||
@version_info['conf']['meetingserver.statistics.jmx.enabled'] = res_json['meetingserver.statistics.jmx.enabled']
|
||||
end
|
||||
if res_json['rtc4web.enforceNonce']
|
||||
@version_info['conf']['rtc4web.enforceNonce'] = res_json['rtc4web.enforceNonce']
|
||||
end
|
||||
if res_json['userInfoRedirect']
|
||||
@version_info['conf']['userInfoRedirect'] = res_json['userInfoRedirect']
|
||||
end
|
||||
if res_json['userInfoUrlTemplate']
|
||||
@version_info['conf']['userInfoUrlTemplatee'] = res_json['userInfoUrlTemplate']
|
||||
end
|
||||
if res_json['meetingroomcenter.stProxyAddress']
|
||||
@version_info['conf']['meetingroomcenter.stProxyAddress'] = res_json['meetingroomcenter.stProxyAddress']
|
||||
end
|
||||
if res_json['meetingroomcenter.stProxySSLAddress']
|
||||
@version_info['conf']['meetingroomcenter.stProxySSLAddress'] = res_json['meetingroomcenter.stProxySSLAddress']
|
||||
end
|
||||
# stwebclient/communityserver --> Sametime Community server name
|
||||
if res_json['communityRef']
|
||||
@version_info['conf']['communityRef'] = res_json['communityRef']
|
||||
@version_info['conf']['anonymousEnabled'] = res_json['anonymousEnabled']
|
||||
end
|
||||
|
||||
@version_info['conf'].each do | line |
|
||||
conf_tbl << [ line[0], line[1] ]
|
||||
end
|
||||
|
||||
def report
|
||||
@version_info['api'].each do | line |
|
||||
api_tbl << [ line[0], line[1] ]
|
||||
end
|
||||
|
||||
if @version_info['version']['sametimeVersion']
|
||||
print_line()
|
||||
print_good("#{@version_info['version']['sametimeVersion']} Detected (#{peer})")
|
||||
# display tables
|
||||
print_good("#{version_tbl.to_s}") if not version_tbl.to_s.empty? and datastore['ShowVersions']
|
||||
print_good("#{api_tbl.to_s}") if not api_tbl.to_s.empty? and datastore['ShowAPIVersions']
|
||||
print_good("#{conf_tbl.to_s}") if not conf_tbl.to_s.empty? and datastore['ShowConfig']
|
||||
|
||||
# report_note
|
||||
if @version_info['version']['sametimeVersion']
|
||||
report_note(
|
||||
:host => datastore['rhost'],
|
||||
:port => datastore['rport'],
|
||||
:proto => 'http',
|
||||
:ntype => 'ibm_lotus_sametime_version',
|
||||
:data => @version_info['version']['sametimeVersion']
|
||||
)
|
||||
end
|
||||
end
|
||||
|
||||
def store_config(tpath, url, config_to_store, checked_host)
|
||||
# store configuration as loot
|
||||
|
||||
if not config_to_store.empty?
|
||||
loot = store_loot(
|
||||
"ibm_lotus_sametime_configuration_" + url,
|
||||
"text/json",
|
||||
datastore['rhost'],
|
||||
config_to_store,
|
||||
".json"
|
||||
)
|
||||
|
||||
print_good("#{checked_host} - IBM Lotus Sametime Configuration data stored as loot")
|
||||
print_status("#{checked_host}#{normalize_uri(tpath, url)}\n => #{loot}")
|
||||
end
|
||||
end
|
||||
|
||||
def run
|
||||
|
||||
# create storage for extracted information+
|
||||
@version_info = {}
|
||||
@version_info['version'] = {}
|
||||
@version_info['conf'] = {}
|
||||
@version_info['api'] = {}
|
||||
|
||||
tpath = normalize_uri(target_uri.path)
|
||||
|
||||
sametime_urls = [
|
||||
'/stmeetings/about.jsp',
|
||||
'/stmeetings/serverversion.properties',
|
||||
'/rtc/buildinfo.txt',
|
||||
'/stmeetings/configuration?format=json&verbose=true'
|
||||
]
|
||||
|
||||
sametime_proxy_urls = [
|
||||
'/stwebclient/i18nStrings.jsp',
|
||||
'/stwebclient/communityserver',
|
||||
'/stwebav/WebAVServlet?Name=WebPlayerVersion'
|
||||
]
|
||||
|
||||
print_status("#{peer} - Checking IBM Lotus Sametime Server")
|
||||
sametime_urls.each do | url |
|
||||
check_url(tpath, url)
|
||||
end
|
||||
|
||||
if @version_info['conf']['meetingroomcenter.stProxyAddress'] or @version_info['conf']['meetingroomcenter.stProxySSLAddress']
|
||||
# check Sametime proxy if configured to do so
|
||||
if datastore['QuerySametimeProxy']
|
||||
|
||||
if @version_info['conf']['meetingroomcenter.stProxySSLAddress'] and datastore['SSL']
|
||||
# keep using SSL
|
||||
stproxy_rhost = URI(@version_info['conf']['meetingroomcenter.stProxySSLAddress']).host
|
||||
vprint_status("Testing discovered Sametime proxy address for further data #{stproxy_rhost}")
|
||||
else
|
||||
print_line()
|
||||
print_status("#{peer} - IBM Lotus Sametime information")
|
||||
stproxy_rhost = URI(@version_info['conf']['meetingroomcenter.stProxyAddress']).host
|
||||
vprint_status("Testing discovered Sametime proxy address for further data #{stproxy_rhost}")
|
||||
end
|
||||
|
||||
# configure tables
|
||||
version_tbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "IBM Lotus Sametime Information [Version]",
|
||||
'Prefix' => "",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"Component",
|
||||
"Version"
|
||||
])
|
||||
print_good("#{peer} - Sametime Proxy address discovered #{stproxy_rhost}")
|
||||
|
||||
conf_tbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "IBM Lotus Sametime Information [Config]",
|
||||
'Prefix' => "",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"Key",
|
||||
"Value"
|
||||
])
|
||||
|
||||
api_tbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "IBM Lotus Sametime Information [API]",
|
||||
'Prefix' => "",
|
||||
'Indent' => 1,
|
||||
'Columns' =>
|
||||
[
|
||||
"API",
|
||||
"Version"
|
||||
])
|
||||
|
||||
# populate tables
|
||||
@version_info['version'].each do | line |
|
||||
version_tbl << [ line[0], line[1] ]
|
||||
sametime_proxy_urls.each do | url |
|
||||
check_url(tpath, url, stproxy_rhost)
|
||||
end
|
||||
|
||||
@version_info['conf'].each do | line |
|
||||
conf_tbl << [ line[0], line[1] ]
|
||||
end
|
||||
|
||||
@version_info['api'].each do | line |
|
||||
api_tbl << [ line[0], line[1] ]
|
||||
end
|
||||
|
||||
# display tables
|
||||
print_good("#{version_tbl.to_s}") if not version_tbl.to_s.empty? and datastore['ShowVersions']
|
||||
print_good("#{api_tbl.to_s}") if not api_tbl.to_s.empty? and datastore['ShowAPIVersions']
|
||||
print_good("#{conf_tbl.to_s}") if not conf_tbl.to_s.empty? and datastore['ShowConfig']
|
||||
|
||||
# report_note
|
||||
if @version_info['version']['sametimeVersion']
|
||||
report_note(
|
||||
:host => datastore['rhost'],
|
||||
:port => datastore['rport'],
|
||||
:proto => 'http',
|
||||
:ntype => 'ibm_lotus_sametime_version',
|
||||
:data => @version_info['version']['sametimeVersion']
|
||||
)
|
||||
end
|
||||
else
|
||||
print_status("#{peer} - Sametime Proxy address discovered #{stproxy_rhost}, but checks disabled")
|
||||
end
|
||||
end
|
||||
|
||||
def store_config(tpath, url, config_to_store, checked_host)
|
||||
# store configuration as loot
|
||||
report unless @version_info.empty?
|
||||
|
||||
if not config_to_store.empty?
|
||||
loot = store_loot(
|
||||
"ibm_lotus_sametime_configuration_" + url,
|
||||
"text/json",
|
||||
datastore['rhost'],
|
||||
config_to_store,
|
||||
".json"
|
||||
)
|
||||
|
||||
print_good("#{checked_host} - IBM Lotus Sametime Configuration data stored as loot")
|
||||
print_status("#{checked_host}#{normalize_uri(tpath, url)}\n => #{loot}")
|
||||
end
|
||||
end
|
||||
|
||||
def run
|
||||
|
||||
# create storage for extracted information+
|
||||
@version_info = {}
|
||||
@version_info['version'] = {}
|
||||
@version_info['conf'] = {}
|
||||
@version_info['api'] = {}
|
||||
|
||||
tpath = normalize_uri(target_uri.path)
|
||||
|
||||
sametime_urls = [
|
||||
'/stmeetings/about.jsp',
|
||||
'/stmeetings/serverversion.properties',
|
||||
'/rtc/buildinfo.txt',
|
||||
'/stmeetings/configuration?format=json&verbose=true'
|
||||
]
|
||||
|
||||
sametime_proxy_urls = [
|
||||
'/stwebclient/i18nStrings.jsp',
|
||||
'/stwebclient/communityserver',
|
||||
'/stwebav/WebAVServlet?Name=WebPlayerVersion'
|
||||
]
|
||||
|
||||
print_status("#{peer} - Checking IBM Lotus Sametime Server")
|
||||
sametime_urls.each do | url |
|
||||
check_url(tpath, url)
|
||||
end
|
||||
|
||||
if @version_info['conf']['meetingroomcenter.stProxyAddress'] or @version_info['conf']['meetingroomcenter.stProxySSLAddress']
|
||||
# check Sametime proxy if configured to do so
|
||||
if datastore['QuerySametimeProxy']
|
||||
|
||||
if @version_info['conf']['meetingroomcenter.stProxySSLAddress'] and datastore['SSL']
|
||||
# keep using SSL
|
||||
stproxy_rhost = URI(@version_info['conf']['meetingroomcenter.stProxySSLAddress']).host
|
||||
vprint_status("Testing discovered Sametime proxy address for further data #{stproxy_rhost}")
|
||||
else
|
||||
stproxy_rhost = URI(@version_info['conf']['meetingroomcenter.stProxyAddress']).host
|
||||
vprint_status("Testing discovered Sametime proxy address for further data #{stproxy_rhost}")
|
||||
end
|
||||
|
||||
print_good("#{peer} - Sametime Proxy address discovered #{stproxy_rhost}")
|
||||
|
||||
sametime_proxy_urls.each do | url |
|
||||
check_url(tpath, url, stproxy_rhost)
|
||||
end
|
||||
|
||||
else
|
||||
print_status("#{peer} - Sametime Proxy address discovered #{stproxy_rhost}, but checks disabled")
|
||||
end
|
||||
end
|
||||
|
||||
report unless @version_info.empty?
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue