Skip to content

Commit 1d33c9a

Browse files
darkbushidodarkbushido
committed
updating specs upto 'username secret'
1 parent 73b362c commit 1d33c9a

File tree

2 files changed

+123
-79
lines changed

2 files changed

+123
-79
lines changed

‎lib/msf/core/auxiliary/cisco.rb

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -285,71 +285,71 @@ def cisco_ios_config_eater(thost, tport, config)
285285
user = $1
286286
priv = $2
287287
stype = $4.to_i
288-
shash = $5
288+
spass = $5
289289

290290
if stype == 5
291-
print_good("#{thost}:#{tport} Username '#{user}' with MD5 Encrypted Password: #{shash}")
292-
store_loot("cisco.ios.username_password_hash", "text/plain", thost, "#{user}_level#{priv}:#{shash}", "username_password_hash.txt", "Cisco IOS Username and Password Hash (MD5)")
291+
print_good("#{thost}:#{tport} Username '#{user}' with MD5 Encrypted Password: #{spass}")
292+
store_loot("cisco.ios.username_password_hash", "text/plain", thost, "#{user}_level#{priv}:#{spass}", "username_password_hash.txt", "Cisco IOS Username and Password Hash (MD5)")
293+
cred = credential_data.dup
294+
cred[:private_data] = spass
295+
cred[:private_type] = :nonreplayable_hash
296+
create_credential_and_login(cred)
293297
end
294298

295299
if stype == 0
296-
print_good("#{thost}:#{tport} Username '#{user}' with Password: #{shash}")
297-
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}_level#{priv}:#{shash}", "username_password.txt", "Cisco IOS Username and Password")
300+
print_good("#{thost}:#{tport} Username '#{user}' with Password: #{spass}")
301+
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}_level#{priv}:#{spass}", "username_password.txt", "Cisco IOS Username and Password")
298302

299-
cred = cred_info.dup
300-
cred[:user] = user
301-
cred[:pass] = shash
302-
cred[:type] = "password"
303-
cred[:collect_type] = "password"
304-
store_cred(cred)
303+
cred = credential_data.dup
304+
cred[:private_data] = spass
305+
cred[:private_type] = :nonreplayable_hash
306+
create_credential_and_login(cred)
305307
end
306308

307309
if stype == 7
308-
shash = cisco_ios_decrypt7(shash) rescue shash
309-
print_good("#{thost}:#{tport} Username '#{user}' with Decrypted Password: #{shash}")
310-
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}_level#{priv}:#{shash}", "username_password.txt", "Cisco IOS Username and Password")
310+
spass = cisco_ios_decrypt7(spass) rescue spass
311+
print_good("#{thost}:#{tport} Username '#{user}' with Decrypted Password: #{spass}")
312+
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}_level#{priv}:#{spass}", "username_password.txt", "Cisco IOS Username and Password")
311313

312-
cred = cred_info.dup
313-
cred[:user] = user
314-
cred[:pass] = shash
315-
cred[:type] = "password"
316-
cred[:collect_type] = "password"
317-
store_cred(cred)
314+
cred = credential_data.dup
315+
cred[:private_data] = spass
316+
cred[:private_type] = :password
317+
create_credential_and_login(cred)
318318
end
319319

320320
when /^\s*username ([^\s]+) (secret|password) (\d+) ([^\s]+)/i
321321
user = $1
322322
stype = $3.to_i
323-
shash = $4
323+
spass = $4
324324

325325
if stype == 5
326-
print_good("#{thost}:#{tport} Username '#{user}' with MD5 Encrypted Password: #{shash}")
327-
store_loot("cisco.ios.username_password_hash", "text/plain", thost, "#{user}:#{shash}", "username_password_hash.txt", "Cisco IOS Username and Password Hash (MD5)")
326+
print_good("#{thost}:#{tport} Username '#{user}' with MD5 Encrypted Password: #{spass}")
327+
store_loot("cisco.ios.username_password_hash", "text/plain", thost, "#{user}:#{spass}", "username_password_hash.txt", "Cisco IOS Username and Password Hash (MD5)")
328+
cred = credential_data.dup
329+
cred[:private_data] = spass
330+
cred[:private_type] = :nonreplayable_hash
331+
create_credential_and_login(cred)
328332
end
329333

330334
if stype == 0
331-
print_good("#{thost}:#{tport} Username '#{user}' with Password: #{shash}")
332-
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}:#{shash}", "username_password.txt", "Cisco IOS Username and Password")
335+
print_good("#{thost}:#{tport} Username '#{user}' with Password: #{spass}")
336+
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}:#{spass}", "username_password.txt", "Cisco IOS Username and Password")
333337

334-
cred = cred_info.dup
335-
cred[:user] = user
336-
cred[:pass] = shash
337-
cred[:type] = "password"
338-
cred[:collect_type] = "password"
339-
store_cred(cred)
338+
cred = credential_data.dup
339+
cred[:private_data] = spass
340+
cred[:private_type] = :nonreplayable_hash
341+
create_credential_and_login(cred)
340342
end
341343

342344
if stype == 7
343-
shash = cisco_ios_decrypt7(shash) rescue shash
344-
print_good("#{thost}:#{tport} Username '#{user}' with Decrypted Password: #{shash}")
345-
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}:#{shash}", "username_password.txt", "Cisco IOS Username and Password")
345+
spass = cisco_ios_decrypt7(spass) rescue spass
346+
print_good("#{thost}:#{tport} Username '#{user}' with Decrypted Password: #{spass}")
347+
store_loot("cisco.ios.username_password", "text/plain", thost, "#{user}:#{spass}", "username_password.txt", "Cisco IOS Username and Password")
346348

347-
cred = cred_info.dup
348-
cred[:user] = user
349-
cred[:pass] = shash
350-
cred[:type] = "password"
351-
cred[:collect_type] = "password"
352-
store_cred(cred)
349+
cred = credential_data.dup
350+
cred[:private_data] = spass
351+
cred[:private_type] = :password
352+
create_credential_and_login(cred)
353353
end
354354

355355
when /^\s*ppp.*username ([^\s]+) (secret|password) (\d+) ([^\s]+)/i

‎spec/lib/msf/core/auxiliary/cisco_spec.rb

Lines changed: 83 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -481,25 +481,28 @@ def myworkspace
481481
end
482482

483483
it 'ip nhrp authentication' do
484-
expect(aux_cisco).to receive(:print_good).with("127.0.0.1:1337 NHRP Authentication Key somestring for Interface Tunnel ")
484+
expect(aux_cisco).to receive(:print_good).with("127.0.0.1:1337 NHRP Authentication Key 1511021F0725 for Interface Tunnel ")
485485
expect(aux_cisco).to receive(:store_loot).with(
486-
"cisco.ios.config", "text/plain", "127.0.0.1", "ip nhrp authentication somestring", "config.txt", "Cisco IOS Configuration"
486+
"cisco.ios.config", "text/plain", "127.0.0.1", "ip nhrp authentication 1511021F0725", "config.txt", "Cisco IOS Configuration"
487487
)
488488
expect(aux_cisco).to receive(:store_loot).with(
489-
"cisco.ios.nhrp_tunnel_key", "text/plain", "127.0.0.1", "tunnel_somestring", "nhrp_tunnel_key.txt", "Cisco NHRP Authentication Key"
489+
"cisco.ios.nhrp_tunnel_key", "text/plain", "127.0.0.1", "tunnel_1511021F0725", "nhrp_tunnel_key.txt", "Cisco NHRP Authentication Key"
490490
)
491-
expect(aux_cisco).to receive(:store_cred).with(
491+
expect(aux_cisco).to receive(:create_credential_and_login).with(
492492
{
493-
host: "127.0.0.1",
493+
address: "127.0.0.1",
494494
port: 1337,
495-
user: "",
496-
pass: "somestring",
497-
type: "password",
498-
collect_type: "password",
499-
active: true
495+
protocol: "tcp",
496+
workspace_id: workspace.id,
497+
origin_type: :service,
498+
service_name: '',
499+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
500+
private_data: "1511021F0725",
501+
private_type: :nonreplayable_hash,
502+
status: Metasploit::Model::Login::Status::UNTRIED
500503
}
501504
)
502-
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'ip nhrp authentication somestring')
505+
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'ip nhrp authentication 1511021F0725')
503506
end
504507

505508
context 'username privilege secret' do
@@ -511,17 +514,21 @@ def myworkspace
511514
expect(aux_cisco).to receive(:store_loot).with(
512515
"cisco.ios.username_password", "text/plain", "127.0.0.1", "someusername_level0:1511021F0725", "username_password.txt", "Cisco IOS Username and Password"
513516
)
514-
expect(aux_cisco).to receive(:store_cred).with(
517+
expect(aux_cisco).to receive(:create_credential_and_login).with(
515518
{
516-
host: "127.0.0.1",
519+
address: "127.0.0.1",
517520
port: 1337,
518-
user: "someusername",
519-
pass: "1511021F0725",
520-
type: "password",
521-
collect_type: "password",
522-
active: true
521+
protocol: "tcp",
522+
workspace_id: workspace.id,
523+
origin_type: :service,
524+
service_name: '',
525+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
526+
private_data: "1511021F0725",
527+
private_type: :nonreplayable_hash,
528+
status: Metasploit::Model::Login::Status::UNTRIED
523529
}
524530
)
531+
525532
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'username someusername privilege 0 secret 0 1511021F0725')
526533
end
527534

@@ -534,6 +541,20 @@ def myworkspace
534541
"cisco.ios.username_password_hash", "text/plain", "127.0.0.1", "someusername_level0:1511021F0725",
535542
"username_password_hash.txt", "Cisco IOS Username and Password Hash (MD5)"
536543
)
544+
expect(aux_cisco).to receive(:create_credential_and_login).with(
545+
{
546+
address: "127.0.0.1",
547+
port: 1337,
548+
protocol: "tcp",
549+
workspace_id: workspace.id,
550+
origin_type: :service,
551+
service_name: '',
552+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
553+
private_data: "1511021F0725",
554+
private_type: :nonreplayable_hash,
555+
status: Metasploit::Model::Login::Status::UNTRIED
556+
}
557+
)
537558
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'username someusername privilege 0 secret 5 1511021F0725')
538559
end
539560

@@ -546,15 +567,18 @@ def myworkspace
546567
expect(aux_cisco).to receive(:store_loot).with(
547568
"cisco.ios.username_password", "text/plain", "127.0.0.1", "someusername_level0:cisco", "username_password.txt", "Cisco IOS Username and Password"
548569
)
549-
expect(aux_cisco).to receive(:store_cred).with(
570+
expect(aux_cisco).to receive(:create_credential_and_login).with(
550571
{
551-
host: "127.0.0.1",
572+
address: "127.0.0.1",
552573
port: 1337,
553-
user: "someusername",
554-
pass: "cisco",
555-
type: "password",
556-
collect_type: "password",
557-
active: true
574+
protocol: "tcp",
575+
workspace_id: workspace.id,
576+
origin_type: :service,
577+
service_name: '',
578+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
579+
private_data: "cisco",
580+
private_type: :password,
581+
status: Metasploit::Model::Login::Status::UNTRIED
558582
}
559583
)
560584
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'username someusername privilege 0 secret 7 1511021F0725')
@@ -571,15 +595,18 @@ def myworkspace
571595
"cisco.ios.username_password", "text/plain", "127.0.0.1", "someusername:1511021F0725", "username_password.txt",
572596
"Cisco IOS Username and Password"
573597
)
574-
expect(aux_cisco).to receive(:store_cred).with(
598+
expect(aux_cisco).to receive(:create_credential_and_login).with(
575599
{
576-
host: "127.0.0.1",
600+
address: "127.0.0.1",
577601
port: 1337,
578-
user: "someusername",
579-
pass: "1511021F0725",
580-
type: "password",
581-
collect_type: "password",
582-
active: true
602+
protocol: "tcp",
603+
workspace_id: workspace.id,
604+
origin_type: :service,
605+
service_name: '',
606+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
607+
private_data: "1511021F0725",
608+
private_type: :nonreplayable_hash,
609+
status: Metasploit::Model::Login::Status::UNTRIED
583610
}
584611
)
585612
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'username someusername secret 0 1511021F0725')
@@ -594,6 +621,20 @@ def myworkspace
594621
"cisco.ios.username_password_hash", "text/plain", "127.0.0.1", "someusername:1511021F0725", "username_password_hash.txt",
595622
"Cisco IOS Username and Password Hash (MD5)"
596623
)
624+
expect(aux_cisco).to receive(:create_credential_and_login).with(
625+
{
626+
address: "127.0.0.1",
627+
port: 1337,
628+
protocol: "tcp",
629+
workspace_id: workspace.id,
630+
origin_type: :service,
631+
service_name: '',
632+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
633+
private_data: "1511021F0725",
634+
private_type: :nonreplayable_hash,
635+
status: Metasploit::Model::Login::Status::UNTRIED
636+
}
637+
)
597638
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'username someusername secret 5 1511021F0725')
598639
end
599640

@@ -607,15 +648,18 @@ def myworkspace
607648
"cisco.ios.username_password", "text/plain", "127.0.0.1", "someusername:cisco", "username_password.txt",
608649
"Cisco IOS Username and Password"
609650
)
610-
expect(aux_cisco).to receive(:store_cred).with(
651+
expect(aux_cisco).to receive(:create_credential_and_login).with(
611652
{
612-
host: "127.0.0.1",
653+
address: "127.0.0.1",
613654
port: 1337,
614-
user: "someusername",
615-
pass: "cisco",
616-
type: "password",
617-
collect_type: "password",
618-
active: true
655+
protocol: "tcp",
656+
workspace_id: workspace.id,
657+
origin_type: :service,
658+
service_name: '',
659+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
660+
private_data: "cisco",
661+
private_type: :password,
662+
status: Metasploit::Model::Login::Status::UNTRIED
619663
}
620664
)
621665
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'username someusername secret 7 1511021F0725')

0 commit comments

Comments
 (0)