Skip to content

Commit df47814

Browse files
jheysel-r7jheysel-r7
committed
Land #18454, add AppleTV and Axis Login Doc files.
2 parents 8ca35b0 + 83e5b7a commit df47814

File tree

2 files changed

+241
-0
lines changed

2 files changed

+241
-0
lines changed

‎documentation/modules/auxiliary/scanner/http/appletv_login.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
## Vulnerable Application
2+
3+
This module attempts to authenticate to an AppleTV service with the username, 'AirPlay'.
4+
The device has two different access control modes: OnScreen and Password.
5+
The difference between the two is the password in OnScreen mode is numeric-only and four digits long,
6+
which means when this option is enabled, the module will make sure to cover all of them - from 0000 to 9999.
7+
The Password mode is more complex, therefore the usual online bruteforce strategies apply.
8+
9+
## Verification Steps
10+
1. Start msfconsole
11+
2. Do: `use auxiliary/scanner/http/appletv_login`
12+
3. Do: set the passwords via the `password` option, or pass a list of passwords via the `pass_file` option. Pass a user list via `user_list`.
13+
4. Do: `run`
14+
5. Hopefully you see something like this:
15+
```
16+
[+] 127.0.0.1:7000 - Login Successful: admin:adminpassword
17+
```
18+
19+
## Options
20+
21+
### BLANK_PASSWORD
22+
23+
Set to `true` if an additional login attempt should be made with an empty password for every user.
24+
25+
### BRUTEFORCE_SPEED
26+
27+
How fast to bruteforce, from 0 to 5
28+
29+
### Onscreen
30+
31+
Enable if AppleTV is using the Onscreen access control
32+
33+
### PASSWORD
34+
35+
A specific password to authenticate with
36+
37+
### PASS_FILE
38+
39+
File containing passwords, one per line
40+
41+
### STOP_ON_SUCCESS
42+
43+
Stop guessing when a credential works for a host
44+
45+
### THREADS
46+
47+
The number of concurrent threads (max one per host)
48+
49+
### USERPASS_FILE
50+
51+
File containing users and passwords separated by space, one pair per line
52+
53+
### USER_FILE
54+
55+
File containing usernames, one per line
56+
57+
### VERBOSE
58+
59+
Whether to print output for all attempts
60+
61+
### VHOST
62+
63+
HTTP server virtual host
64+
65+
## Scenarios
66+
```
67+
msf > use auxiliary/scanner/http/appletv_login
68+
msf6 auxiliary(scanner/http/appletv_login) > set rhosts 127.0.0.1
69+
rhosts => 127.0.0.1
70+
msf6 auxiliary(scanner/http/appletv_login) > set password N0tpassword!
71+
password => N0tpassword!
72+
msf6 auxiliary(scanner/http/appletv_login) > set userfile ./USERNAMES
73+
userfile => ./USERNAMES
74+
msf6 auxiliary(scanner/http/appletv_login) > options
75+
76+
Module options (auxiliary/scanner/http/appletv_login):
77+
78+
Name Current Setting Required Description
79+
---- --------------- -------- -----------
80+
BLANK_PASSWORDS false no Try blank passwords for all users
81+
BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5
82+
DB_ALL_PASS false no Add all passwords in the current database to the list
83+
Onscreen false no Enable if AppleTV is using the Onscreen access control
84+
PASSWORD no A specific password to authenticate with
85+
PASS_FILE /usr/share/metasploit-framework/data/wordlists/htt no File containing passwords, one per line
86+
p_default_pass.txt
87+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
88+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasp
89+
loit.html
90+
RPORT 7000 yes The target port (TCP)
91+
SSL false no Negotiate SSL/TLS for outgoing connections
92+
STOP_ON_SUCCESS true yes Stop guessing when a credential works for a host
93+
THREADS 1 yes The number of concurrent threads (max one per host)
94+
USERPASS_FILE no File containing users and passwords separated by space, one pair per line
95+
USER_FILE no File containing usernames, one per line
96+
VERBOSE true yes Whether to print output for all attempts
97+
VHOST no HTTP server virtual host
98+
99+
100+
View the full module info with the info, or info -d command.
101+
102+
msf6 auxiliary(scanner/http/appletv_login) > run
103+
104+
[*] Attempting to login to /stop using password list
105+
[!] 127.0.0.1:7000 - No active DB -- Credential data will not be saved!
106+
[-] 127.0.0.1:7000 - Failed: 'AirPlay:password'
107+
[+] 127.0.0.1:7000 - 127.0.0.1:7000 - Login Successful: WORKSTATION\sa:N0tpassword!
108+
[*] Auxiliary module execution completed
109+
msf6 auxiliary(scanner/http/appletv_login) >
110+
```

‎documentation/modules/auxiliary/scanner/http/axis_login.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
## Vulnerable Application
2+
3+
This module attempts to login to an Apache Axis2 instance using username and password
4+
combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options.
5+
It has been verified to work on at least versions 1.4.1 and 1.6.2.
6+
7+
## Verification Steps
8+
1. Start msfconsole
9+
2. Do: `use auxiliary/scanner/http/axis_login`
10+
3. Do: set usernames and passwords via the `username` and `password` options, or pass a list via `user_file` and `pass_file` options
11+
4. Do: `run`
12+
5. Hopefully you see somthing like this:
13+
```
14+
[+] 127.0.0.1:8080 - Login Successful: axisadmin:4x15pa$$w0rd
15+
```
16+
17+
## Options
18+
List each option and how to use it.
19+
20+
### BLANK_PASSWORDS
21+
22+
Try blank passwords for all users
23+
24+
### BLANK_PASSWORD
25+
26+
Set to `true` if an additional login attempt should be made with an empty password for every user.
27+
28+
### BRUTEFORCE_SPEED
29+
30+
How fast to bruteforce, from 0 to 5
31+
32+
### DB_ALL_CREDS
33+
34+
Try each user/password couple stored in the current database
35+
36+
### DB_ALL_PASS
37+
38+
Add all passwords in the current database to the list
39+
40+
41+
### DB_ALL_USERS
42+
43+
Add all users in the current database to the list
44+
45+
### DB_SKIP_EXISTING
46+
47+
Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
48+
49+
50+
### PASSWORD
51+
52+
A specific password to authenticate with
53+
54+
### PASS_FILE
55+
56+
File containing passwords, one per line
57+
58+
### STOP_ON_SUCCESS
59+
60+
Stop guessing when a credential works for a host
61+
62+
### THREADS
63+
64+
The number of concurrent threads (max one per host)
65+
66+
### USERPASS_FILE
67+
68+
File containing users and passwords separated by space, one pair per line
69+
70+
### USER_FILE
71+
72+
File containing usernames, one per line
73+
74+
### VERBOSE
75+
76+
Whether to print output for all attempts
77+
78+
### VHOST
79+
80+
HTTP server virtual host
81+
82+
## Scenarios
83+
Specific demo of using the module that might be useful in a real world scenario.
84+
85+
```
86+
msf > use auxiliary/scanner/http/axis_login
87+
msf6 auxiliary(scanner/http/axis_login) > set rhosts 127.0.0.1
88+
rhosts => 127.0.0.1
89+
msf6 auxiliary(scanner/http/axis_login) > set password N0tpassword!
90+
password => N0tpassword!
91+
msf6 auxiliary(scanner/http/axis_login) > set userfile ./USERNAMES
92+
userfile => ./USERNAMES
93+
msf6 auxiliary(scanner/http/axis_login) > show options
94+
95+
Module options (auxiliary/scanner/http/axis_login):
96+
97+
Name Current Setting Required Description
98+
---- --------------- -------- -----------
99+
BLANK_PASSWORDS false no Try blank passwords for all users
100+
BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5
101+
DB_ALL_CREDS false no Try each user/password couple stored in the current database
102+
DB_ALL_PASS false no Add all passwords in the current database to the list
103+
DB_ALL_USERS false no Add all users in the current database to the list
104+
DB_SKIP_EXISTING none no Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
105+
PASSWORD no A specific password to authenticate with
106+
PASS_FILE no File containing passwords, one per line
107+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
108+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
109+
RPORT 8080 yes The target port (TCP)
110+
SSL false no Negotiate SSL/TLS for outgoing connections
111+
STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host
112+
TARGETURI /axis2/axis2-admin/login no Path to the Apache Axis Administration page
113+
THREADS 1 yes The number of concurrent threads (max one per host)
114+
USERNAME no A specific username to authenticate as
115+
USERPASS_FILE no File containing users and passwords separated by space, one pair per line
116+
USER_AS_PASS false no Try the username as the password for all users
117+
USER_FILE no File containing usernames, one per line
118+
VERBOSE true yes Whether to print output for all attempts
119+
VHOST no HTTP server virtual host
120+
121+
View the full module info with the info, or info -d command.
122+
123+
msf6 auxiliary(scanner/http/axis_login) > run
124+
125+
[*] Attempting to login to /stop using password list
126+
[!] 127.0.0.1:8080 - No active DB -- Credential data will not be saved!
127+
[-] 127.0.0.1:8080 - Failed: 'AxisRoot:password'
128+
[+] 127.0.0.1:8080 - 127.0.0.1:8080 - Login Successful: WORKSTATION\AxisRoot:N0tpassword!
129+
[*] Auxiliary module execution completed
130+
msf6 auxiliary(scanner/http/axis_login) >
131+
```

0 commit comments

Comments
 (0)