Skip to content

Commit 264085b

Browse files
h00dieh00die
committed
juniper lib updates
1 parent d05e855 commit 264085b

File tree

2 files changed

+173
-35
lines changed

2 files changed

+173
-35
lines changed

‎lib/msf/core/auxiliary/juniper.rb‎

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -228,19 +228,38 @@ def juniper_junos_config_eater(thost, tport, config)
228228
create_credential_and_login(cred)
229229
end
230230

231-
config.scan(/radius-server \{\s+(?<radius_server>[0-9.]{7,15}) secret "(?<radius_hash>[^"]+)";/i).each do |result|
232-
radius_hash = result[1].strip
233-
radius_server = result[0].strip
234-
print_good("radius server #{radius_server} password hash: #{radius_hash}")
235-
next unless framework.db.active
231+
# radius-server
232+
config.scan(/\s*radius-server \{([^}]+)\}/i).each do |result_block|
233+
result_block[0].strip.scan(/(?<radius_server>[0-9.]{7,15}) secret "(?<radius_hash>[^"]+)";/i).each do |result|
234+
radius_hash = result[1].strip
235+
radius_server = result[0].strip
236+
print_good("radius server #{radius_server} password hash: #{radius_hash}")
237+
next unless framework.db.active
236238

237-
cred = credential_data.dup
238-
cred[:address] = radius_server
239-
cred[:port] = 1812
240-
cred[:protocol] = 'udp'
241-
cred[:private_data] = radius_hash
242-
cred[:service_name] = 'radius'
243-
create_credential_and_login(cred)
239+
cred = credential_data.dup
240+
cred[:address] = radius_server
241+
cred[:port] = 1812
242+
cred[:protocol] = 'udp'
243+
cred[:private_data] = radius_hash
244+
cred[:service_name] = 'radius'
245+
create_credential_and_login(cred)
246+
end
247+
end
248+
249+
# tacplus-server
250+
config.scan(/\s*tacplus-server \{([^}]+)\}/i).each do |result_block|
251+
result_block[0].strip.scan(/(?<tacplus_server>[0-9.]{7,15}) secret "(?<hash>[^"]+)";/i).each do |result|
252+
ip = result[0].strip
253+
hash = result[1].strip
254+
jtr_format = identify_hash hash
255+
print_good("tacplus server #{ip} with password hash #{hash}")
256+
next unless framework.db.active
257+
258+
cred = credential_data.dup
259+
cred[:jtr_format] = jtr_format
260+
cred[:private_data] = hash
261+
create_credential_and_login(cred)
262+
end
244263
end
245264

246265
config.scan(/pap {\s+local-name "(?<ppp_username>.+)";\s+local-password "(?<ppp_hash>[^"]+)";/i).each do |result|

‎spec/lib/msf/core/auxiliary/juniper_spec.rb‎

Lines changed: 142 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,80 @@ def myworkspace
276276
))
277277
end
278278

279+
context 'deals tacplus-server blocks' do
280+
it 'with one cred' do
281+
expect(aux_juniper).to receive(:print_good).with('tacplus server 1.1.1.1 with password hash $9$aaAAAAAeAA1AAAb2AAjAqmAA')
282+
expect(aux_juniper).to receive(:report_host).with({ host: '127.0.0.1', os_name: 'Juniper JunOS' })
283+
expect(aux_juniper).to receive(:store_loot).with('juniper.junos.config', 'text/plain', '127.0.0.1',
284+
"tacplus-server {\n 1.1.1.1 secret \"$9$aaAAAAAeAA1AAAb2AAjAqmAA\"; ## SECRET-DATA\n }",
285+
'config.txt', 'Juniper JunOS Configuration')
286+
expect(aux_juniper).to receive(:create_credential_and_login).with(
287+
{
288+
address: '127.0.0.1',
289+
port: 1337,
290+
protocol: 'tcp',
291+
workspace_id: workspace.id,
292+
origin_type: :service,
293+
service_name: '',
294+
module_fullname: 'auxiliary/scanner/snmp/juniper_dummy',
295+
jtr_format: '',
296+
private_data: '$9$aaAAAAAeAA1AAAb2AAjAqmAA',
297+
private_type: :nonreplayable_hash,
298+
status: Metasploit::Model::Login::Status::UNTRIED
299+
}
300+
)
301+
302+
aux_juniper.juniper_junos_config_eater('127.0.0.1', 1337,
303+
%q(tacplus-server {
304+
1.1.1.1 secret "$9$aaAAAAAeAA1AAAb2AAjAqmAA"; ## SECRET-DATA
305+
}))
306+
end
307+
it 'with two cred' do
308+
expect(aux_juniper).to receive(:print_good).with('tacplus server 1.1.1.1 with password hash $9$aaAAAAAeAA1AAAb2AAjAqmAA')
309+
expect(aux_juniper).to receive(:print_good).with('tacplus server 2.2.2.2 with password hash $9$aaaAa/1aAAAa1aaaAAaa11aAA')
310+
expect(aux_juniper).to receive(:report_host).with({ host: '127.0.0.1', os_name: 'Juniper JunOS' })
311+
expect(aux_juniper).to receive(:store_loot).with('juniper.junos.config', 'text/plain', '127.0.0.1',
312+
"tacplus-server {\n 1.1.1.1 secret \"$9$aaAAAAAeAA1AAAb2AAjAqmAA\"; ## SECRET-DATA\n 2.2.2.2 secret \"$9$aaaAa/1aAAAa1aaaAAaa11aAA\"; ## SECRET-DATA\n }",
313+
'config.txt', 'Juniper JunOS Configuration')
314+
expect(aux_juniper).to receive(:create_credential_and_login).with(
315+
{
316+
address: '127.0.0.1',
317+
port: 1337,
318+
protocol: 'tcp',
319+
workspace_id: workspace.id,
320+
origin_type: :service,
321+
service_name: '',
322+
module_fullname: 'auxiliary/scanner/snmp/juniper_dummy',
323+
private_data: '$9$aaAAAAAeAA1AAAb2AAjAqmAA',
324+
jtr_format: '',
325+
private_type: :nonreplayable_hash,
326+
status: Metasploit::Model::Login::Status::UNTRIED
327+
}
328+
)
329+
330+
expect(aux_juniper).to receive(:create_credential_and_login).with(
331+
{
332+
address: '127.0.0.1',
333+
port: 1337,
334+
protocol: 'tcp',
335+
workspace_id: workspace.id,
336+
origin_type: :service,
337+
service_name: '',
338+
module_fullname: 'auxiliary/scanner/snmp/juniper_dummy',
339+
private_data: '$9$aaaAa/1aAAAa1aaaAAaa11aAA',
340+
jtr_format: '',
341+
private_type: :nonreplayable_hash,
342+
status: Metasploit::Model::Login::Status::UNTRIED
343+
}
344+
)
345+
346+
aux_juniper.juniper_junos_config_eater('127.0.0.1', 1337,
347+
%q(tacplus-server {
348+
1.1.1.1 secret "$9$aaAAAAAeAA1AAAb2AAjAqmAA"; ## SECRET-DATA
349+
2.2.2.2 secret "$9$aaaAa/1aAAAa1aaaAAaa11aAA"; ## SECRET-DATA
350+
}))
351+
end
352+
end
279353
context 'deals with user account with password hash' do
280354
it 'with super-user' do
281355
expect(aux_juniper).to receive(:print_good).with('User 2000 named newuser in group super-user found with password hash $1$rm8FaMFY$k4LFxqsVAiGO5tKqyO9jJ/.')
@@ -579,36 +653,81 @@ class unauthorized;
579653
))
580654
end
581655
end
656+
context 'deals radius-server blocks' do
657+
it 'with one credential' do
658+
expect(aux_juniper).to receive(:print_good).with('radius server 1.1.1.1 password hash: $9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV')
659+
expect(aux_juniper).to receive(:report_host).with({ host: '127.0.0.1', os_name: 'Juniper JunOS' })
660+
expect(aux_juniper).to receive(:store_loot).with('juniper.junos.config', 'text/plain', '127.0.0.1',
661+
"access {\n radius-server {\n 1.1.1.1 secret \"$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV\"; ## SECRET-DATA\n }\n }",
662+
'config.txt', 'Juniper JunOS Configuration')
663+
expect(aux_juniper).to receive(:create_credential_and_login).with(
664+
{
665+
address: '1.1.1.1',
666+
port: 1812,
667+
protocol: 'udp',
668+
workspace_id: workspace.id,
669+
origin_type: :service,
670+
service_name: 'radius',
671+
module_fullname: 'auxiliary/scanner/snmp/juniper_dummy',
672+
private_data: '$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV',
673+
private_type: :nonreplayable_hash,
674+
status: Metasploit::Model::Login::Status::UNTRIED
675+
}
676+
)
677+
aux_juniper.juniper_junos_config_eater('127.0.0.1', 1337,
678+
%q(access {
679+
radius-server {
680+
1.1.1.1 secret "$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV"; ## SECRET-DATA
681+
}
682+
}
683+
))
684+
end
582685

583-
it 'deals with radius' do
584-
expect(aux_juniper).to receive(:print_good).with('radius server 1.1.1.1 password hash: $9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV')
585-
expect(aux_juniper).to receive(:report_host).with({ host: '127.0.0.1', os_name: 'Juniper JunOS' })
586-
expect(aux_juniper).to receive(:store_loot).with('juniper.junos.config', 'text/plain', '127.0.0.1',
587-
"access {\n radius-server {\n 1.1.1.1 secret \"$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV\"; ## SECRET-DATA\n }\n }",
588-
'config.txt', 'Juniper JunOS Configuration')
589-
expect(aux_juniper).to receive(:create_credential_and_login).with(
590-
{
591-
address: '1.1.1.1',
592-
port: 1812,
593-
protocol: 'udp',
594-
workspace_id: workspace.id,
595-
origin_type: :service,
596-
service_name: 'radius',
597-
module_fullname: 'auxiliary/scanner/snmp/juniper_dummy',
598-
private_data: '$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV',
599-
private_type: :nonreplayable_hash,
600-
status: Metasploit::Model::Login::Status::UNTRIED
601-
}
602-
)
603-
aux_juniper.juniper_junos_config_eater('127.0.0.1', 1337,
604-
%q(access {
686+
it 'with two credentials' do
687+
expect(aux_juniper).to receive(:print_good).with('radius server 2.2.2.2 password hash: $9$Y-11ikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKv111')
688+
expect(aux_juniper).to receive(:print_good).with('radius server 1.1.1.1 password hash: $9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV')
689+
expect(aux_juniper).to receive(:report_host).with({ host: '127.0.0.1', os_name: 'Juniper JunOS' })
690+
expect(aux_juniper).to receive(:store_loot).with('juniper.junos.config', 'text/plain', '127.0.0.1',
691+
"access {\n radius-server {\n 1.1.1.1 secret \"$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV\"; ## SECRET-DATA\n 2.2.2.2 secret \"$9$Y-11ikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKv111\"; ## SECRET-DATA\n }\n }",
692+
'config.txt', 'Juniper JunOS Configuration')
693+
expect(aux_juniper).to receive(:create_credential_and_login).with(
694+
{
695+
address: '1.1.1.1',
696+
port: 1812,
697+
protocol: 'udp',
698+
workspace_id: workspace.id,
699+
origin_type: :service,
700+
service_name: 'radius',
701+
module_fullname: 'auxiliary/scanner/snmp/juniper_dummy',
702+
private_data: '$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV',
703+
private_type: :nonreplayable_hash,
704+
status: Metasploit::Model::Login::Status::UNTRIED
705+
}
706+
)
707+
expect(aux_juniper).to receive(:create_credential_and_login).with(
708+
{
709+
address: '2.2.2.2',
710+
port: 1812,
711+
protocol: 'udp',
712+
workspace_id: workspace.id,
713+
origin_type: :service,
714+
service_name: 'radius',
715+
module_fullname: 'auxiliary/scanner/snmp/juniper_dummy',
716+
private_data: '$9$Y-11ikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKv111',
717+
private_type: :nonreplayable_hash,
718+
status: Metasploit::Model::Login::Status::UNTRIED
719+
}
720+
)
721+
aux_juniper.juniper_junos_config_eater('127.0.0.1', 1337,
722+
%q(access {
605723
radius-server {
606724
1.1.1.1 secret "$9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV"; ## SECRET-DATA
725+
2.2.2.2 secret "$9$Y-11ikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKv111"; ## SECRET-DATA
607726
}
608727
}
609728
))
729+
end
610730
end
611-
612731
it 'deals with pap' do
613732
expect(aux_juniper).to receive(:print_good).with('PPTP username \'pap_username\' hash $9$he4revM87-dsevm5TQCAp0BErvLxd4JDNdkPfT/9BIR via PAP')
614733
expect(aux_juniper).to receive(:report_host).with({ host: '127.0.0.1', os_name: 'Juniper JunOS' })

0 commit comments

Comments
 (0)