Skip to content

Commit 4133a6f

Browse files
committed
Minor cleanup, msftidy check
1 parent ba8394e commit 4133a6f

File tree

1 file changed

+30
-25
lines changed

1 file changed

+30
-25
lines changed

modules/auxiliary/scanner/http/epmp1000_web_login.rb

Lines changed: 30 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
##
21
##
32
# This module requires Metasploit: http://metasploit.com/download
43
# Current source: https://github.com/rapid7/metasploit-framework
@@ -16,8 +15,7 @@ def initialize(info={})
1615
super(update_info(info,
1716
'Name' => 'Cambium ePMP 1000 Login Scanner',
1817
'Description' => %{
19-
This module scans for Cambium ePMP 1000 management login portal(s), and attempts to identify valid credentials.
20-
18+
This module scans for Cambium ePMP 1000 management login portal(s), and attempts to identify valid credentials. Default login credentials are - admin/admin, installer/installer, home/home and readonly/readonly.
2119
},
2220
'Author' =>
2321
[
@@ -29,9 +27,9 @@ def initialize(info={})
2927

3028
register_options(
3129
[
32-
Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.
33-
OptString.new('USERNAME', [false, "A specific username to authenticate as", "admin"]),
34-
OptString.new('PASSWORD', [false, "A specific password to authenticate with", "admin"])
30+
Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.
31+
OptString.new('USERNAME', [false, "A specific username to authenticate as", "admin"]),
32+
OptString.new('PASSWORD', [false, "A specific password to authenticate with", "admin"])
3533
], self.class)
3634
end
3735

@@ -95,11 +93,13 @@ def is_app_epmp1000?
9593
epmp_ver = get_epmp_ver[1]
9694

9795
print_good("#{rhost}:#{rport} - Running Cambium ePMP 1000 version #{epmp_ver}...")
98-
9996
return true
97+
10098
else
99+
101100
print_error("#{rhost}:#{rport} - Application does not appear to be Cambium ePMP 1000. Module will not continue.")
102101
return false
102+
103103
end
104104
end
105105

@@ -108,14 +108,16 @@ def is_app_epmp1000?
108108
#
109109

110110
def do_login(user, pass)
111+
111112
print_status("#{rhost}:#{rport} - Trying username:#{user.inspect} with password:#{pass.inspect}")
113+
112114
begin
113115

114116
res = send_request_cgi(
115117
{
116118
'uri' => '/cgi-bin/luci',
117119
'method' => 'POST',
118-
'headers' => {'X-Requested-With' => 'XMLHttpRequest','Accept' => 'application/json, text/javascript, */*; q=0.01'},
120+
'headers' => {'X-Requested-With' => 'XMLHttpRequest','Accept' => 'application/json, text/javascript, */*; q=0.01'},
119121
'vars_post' =>
120122
{
121123
'username' => 'dashboard',
@@ -124,20 +126,19 @@ def do_login(user, pass)
124126
})
125127

126128
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
129+
127130
vprint_error("#{rhost}:#{rport} - HTTP Connection Failed...")
128131
return :abort
132+
129133
end
130134

131135
if (res and res.code == 200 and res.headers.include?("Set-Cookie") and res.headers['Set-Cookie'].include?("sysauth"))
132136

133-
get_cookie = res.headers['Set-Cookie']
134-
135-
get_stok = res.headers['Set-Cookie'].match(/stok=(.*)/)
136-
stok_value = get_stok[1]
137-
138-
sysauth_value = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
139-
140-
cookie1 = "#{sysauth_value}; "+"globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
137+
get_cookie = res.headers['Set-Cookie']
138+
get_stok = res.headers['Set-Cookie'].match(/stok=(.*)/)
139+
stok_value = get_stok[1]
140+
sysauth_value = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
141+
cookie1 = "#{sysauth_value}; "+"globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
141142

142143
res = send_request_cgi(
143144
{
@@ -160,9 +161,11 @@ def do_login(user, pass)
160161

161162
if (res and res.code == 200 and res.headers.include?("Set-Cookie") and res.headers['Set-Cookie'].include?("stok="))
162163

163-
print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
164+
print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
164165

166+
#
165167
# Extract ePMP version
168+
#
166169
res = send_request_cgi(
167170
{
168171
'uri' => '/',
@@ -172,16 +175,18 @@ def do_login(user, pass)
172175
get_epmp_ver = res.body.match(/"sw_version">([^<]*)/)
173176
epmp_ver = get_epmp_ver[1]
174177

175-
report_cred(
176-
ip: rhost,
177-
port: rport,
178-
service_name: "Cambium ePMP 1000 version #{epmp_ver}",
179-
user: user,
180-
password: pass
181-
)
178+
report_cred(
179+
ip: rhost,
180+
port: rport,
181+
service_name: "Cambium ePMP 1000 version #{epmp_ver}",
182+
user: user,
183+
password: pass
184+
)
182185

183186
else
184-
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
187+
188+
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
189+
185190
end
186191
end
187192
end

0 commit comments

Comments
 (0)