Skip to content

Commit 4762e9f

Browse files
jvazquez-r7jvazquez-r7
committed
Land rapid7#5540, @wchen-r7's changes for multiple auxiliary modules to use the new cred API
2 parents 252b573 + fa6e459 commit 4762e9f

21 files changed

+681
-193
lines changed

‎modules/auxiliary/scanner/http/axis_local_file_include.rb

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,32 @@ def run_host(ip)
7070
end
7171
end
7272

73+
def report_cred(opts)
74+
service_data = {
75+
address: opts[:ip],
76+
port: opts[:port],
77+
service_name: (ssl ? 'https' : 'http'),
78+
protocol: 'tcp',
79+
workspace_id: myworkspace_id
80+
}
81+
82+
credential_data = {
83+
origin_type: :service,
84+
module_fullname: fullname,
85+
username: opts[:user],
86+
private_data: opts[:password],
87+
private_type: :password
88+
}.merge(service_data)
89+
90+
login_data = {
91+
last_attempted_at: DateTime.now,
92+
core: create_credential(credential_data),
93+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
94+
}.merge(service_data)
95+
96+
create_credential_login(login_data)
97+
end
98+
7399
def get_credentials(uri)
74100
lfi_payload = "?xsd=../conf/axis2.xml"
75101

@@ -96,15 +122,7 @@ def get_credentials(uri)
96122

97123
print_good("#{target_url} - Apache Axis - Credentials Found Username: '#{username}' - Password: '#{password}'")
98124

99-
report_auth_info(
100-
:host => rhost,
101-
:port => rport,
102-
:sname => (ssl ? 'https' : 'http'),
103-
:user => username,
104-
:pass => password,
105-
:proof => "WEBAPP=\"Apache Axis\", VHOST=#{vhost}",
106-
:active => true
107-
)
125+
report_cred(ip: rhost, port: rport, user: username, password: password)
108126

109127
else
110128
print_error("#{target_url} - Apache Axis - Not Vulnerable")

‎modules/auxiliary/scanner/http/cisco_asa_asdm.rb

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,32 @@ def is_app_asdm?
8888
end
8989
end
9090

91+
def report_cred(opts)
92+
service_data = {
93+
address: opts[:ip],
94+
port: opts[:port],
95+
service_name: 'Cisco ASA ASDM',
96+
protocol: 'tcp',
97+
workspace_id: myworkspace_id
98+
}
99+
100+
credential_data = {
101+
origin_type: :service,
102+
module_fullname: fullname,
103+
username: opts[:user],
104+
private_data: opts[:password],
105+
private_type: :password
106+
}.merge(service_data)
107+
108+
login_data = {
109+
last_attempted_at: DateTime.now,
110+
core: create_credential(credential_data),
111+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
112+
}.merge(service_data)
113+
114+
create_credential_login(login_data)
115+
end
116+
91117
# Brute-force the login page
92118
def do_login(user, pass)
93119
vprint_status("#{peer} - Trying username:#{user.inspect} with password:#{pass.inspect}")
@@ -113,17 +139,7 @@ def do_login(user, pass)
113139

114140
print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
115141

116-
report_hash = {
117-
:host => rhost,
118-
:port => rport,
119-
:sname => 'Cisco ASA ASDM',
120-
:user => user,
121-
:pass => pass,
122-
:active => true,
123-
:type => 'password'
124-
}
125-
126-
report_auth_info(report_hash)
142+
report_cred(ip: rhost, port: rport, user: user, password: pass)
127143
return :next_user
128144

129145
else

‎modules/auxiliary/scanner/http/cisco_ironport_enum.rb

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,32 @@ def is_app_ironport?
114114
end
115115
end
116116

117+
def report_cred(opts)
118+
service_data = {
119+
address: opts[:ip],
120+
port: opts[:port],
121+
service_name: 'Cisco IronPort Appliance',
122+
protocol: 'tcp',
123+
workspace_id: myworkspace_id
124+
}
125+
126+
credential_data = {
127+
origin_type: :service,
128+
module_fullname: fullname,
129+
username: opts[:user],
130+
private_data: opts[:password],
131+
private_type: :password
132+
}.merge(service_data)
133+
134+
login_data = {
135+
last_attempted_at: DateTime.now,
136+
core: create_credential(credential_data),
137+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
138+
}.merge(service_data)
139+
140+
create_credential_login(login_data)
141+
end
142+
117143
#
118144
# Brute-force the login page
119145
#
@@ -138,17 +164,7 @@ def do_login(user, pass)
138164
if res and res.get_cookies.include?('authenticated=')
139165
print_good("#{rhost}:#{rport} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
140166

141-
report_hash = {
142-
:host => rhost,
143-
:port => rport,
144-
:sname => 'Cisco IronPort Appliance',
145-
:user => user,
146-
:pass => pass,
147-
:active => true,
148-
:type => 'password'
149-
}
150-
151-
report_auth_info(report_hash)
167+
report_cred(ip: rhost, port: rport, user: user, password: pass)
152168
return :next_user
153169

154170
else

‎modules/auxiliary/scanner/http/cisco_ssl_vpn.rb

Lines changed: 29 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,33 @@ def do_logout(cookie)
157157
)
158158
end
159159

160+
def report_cred(opts)
161+
service_data = {
162+
address: opts[:ip],
163+
port: opts[:port],
164+
service_name: 'Cisco SSL VPN',
165+
protocol: 'tcp',
166+
workspace_id: myworkspace_id
167+
}
168+
169+
credential_data = {
170+
origin_type: :service,
171+
module_fullname: fullname,
172+
username: opts[:user],
173+
private_data: opts[:password],
174+
private_type: :password
175+
}.merge(service_data)
176+
177+
login_data = {
178+
last_attempted_at: DateTime.now,
179+
core: create_credential(credential_data),
180+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
181+
}.merge(service_data)
182+
183+
create_credential_login(login_data)
184+
end
185+
186+
160187
# Brute-force the login page
161188
def do_login(user, pass, group)
162189
vprint_status("#{peer} - Trying username:#{user.inspect} with password:#{pass.inspect} and group:#{group.inspect}")
@@ -197,18 +224,8 @@ def do_login(user, pass, group)
197224

198225
do_logout(resp.get_cookies)
199226

200-
report_hash = {
201-
:host => rhost,
202-
:port => rport,
203-
:sname => 'Cisco SSL VPN',
204-
:user => user,
205-
:pass => pass,
206-
:group => group,
207-
:active => true,
208-
:type => 'password'
209-
}
210-
211-
report_auth_info(report_hash)
227+
report_cred(ip: rhost, port: rport, user: user, password: pass)
228+
report_note(ip: rhost, type: 'cisco.cred.group', data: "User: #{user} / Group: #{group}")
212229
return :next_user
213230

214231
else

‎modules/auxiliary/scanner/http/dlink_dir_300_615_http_login.rb

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,32 @@ def run_host(ip)
8282
}
8383
end
8484

85+
def report_cred(opts)
86+
service_data = {
87+
address: opts[:ip],
88+
port: opts[:port],
89+
service_name: (ssl ? 'https' : 'http'),
90+
protocol: 'tcp',
91+
workspace_id: myworkspace_id
92+
}
93+
94+
credential_data = {
95+
origin_type: :service,
96+
module_fullname: fullname,
97+
username: opts[:user],
98+
private_data: opts[:password],
99+
private_type: :password
100+
}.merge(service_data)
101+
102+
login_data = {
103+
last_attempted_at: DateTime.now,
104+
core: create_credential(credential_data),
105+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
106+
}.merge(service_data)
107+
108+
create_credential_login(login_data)
109+
end
110+
85111
# default to user=admin without password (default on most dlink routers)
86112
def do_login(user='admin', pass='')
87113
vprint_status("#{target_url} - Trying username:'#{user}' with password:'#{pass}'")
@@ -91,16 +117,7 @@ def do_login(user='admin', pass='')
91117

92118
if result == :success
93119
print_good("#{target_url} - Successful login '#{user}' : '#{pass}'")
94-
95-
report_auth_info(
96-
:host => rhost,
97-
:port => rport,
98-
:sname => (ssl ? 'https' : 'http'),
99-
:user => user,
100-
:pass => pass,
101-
:proof => "WEBAPP=\"D-Link Management Interface\", PROOF=#{response.to_s}",
102-
:active => true
103-
)
120+
report_cred(ip: rhost, port: rport, user: user, password: pass)
104121

105122
return :next_user
106123
else

‎modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -101,15 +101,7 @@ def do_login(user='admin', pass='')
101101
if result == :success
102102
print_good("#{target_url} - Successful login '#{user}' : '#{pass}'")
103103

104-
report_auth_info(
105-
:host => rhost,
106-
:port => rport,
107-
:sname => (ssl ? 'https' : 'http'),
108-
:user => user,
109-
:pass => pass,
110-
:proof => "WEBAPP=\"D-Link Management Interface\", PROOF=#{response.to_s}",
111-
:active => true
112-
)
104+
report_cred(ip: rhost, port: rport, user: user, password: pass)
113105

114106
return :next_user
115107
else
@@ -118,6 +110,32 @@ def do_login(user='admin', pass='')
118110
end
119111
end
120112

113+
def report_cred(opts)
114+
service_data = {
115+
address: opts[:ip],
116+
port: opts[:port],
117+
service_name: (ssl ? 'https' : 'http'),
118+
protocol: 'tcp',
119+
workspace_id: myworkspace_id
120+
}
121+
122+
credential_data = {
123+
origin_type: :service,
124+
module_fullname: fullname,
125+
username: opts[:user],
126+
private_data: opts[:password],
127+
private_type: :password
128+
}.merge(service_data)
129+
130+
login_data = {
131+
last_attempted_at: DateTime.now,
132+
core: create_credential(credential_data),
133+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
134+
}.merge(service_data)
135+
136+
create_credential_login(login_data)
137+
end
138+
121139
def do_http_login(user,pass)
122140
begin
123141
response = send_request_cgi({

‎modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,32 @@ def run_host(ip)
8383
}
8484
end
8585

86+
def report_cred(opts)
87+
service_data = {
88+
address: opts[:ip],
89+
port: opts[:port],
90+
service_name: (ssl ? 'https' : 'http'),
91+
protocol: 'tcp',
92+
workspace_id: myworkspace_id
93+
}
94+
95+
credential_data = {
96+
origin_type: :service,
97+
module_fullname: fullname,
98+
username: opts[:user],
99+
private_data: opts[:password],
100+
private_type: :password
101+
}.merge(service_data)
102+
103+
login_data = {
104+
last_attempted_at: DateTime.now,
105+
core: create_credential(credential_data),
106+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
107+
}.merge(service_data)
108+
109+
create_credential_login(login_data)
110+
end
111+
86112
# default to user=admin without password (default on most dlink routers)
87113
def do_login(user='admin', pass='')
88114
vprint_status("#{target_url} - Trying username:'#{user}' with password:'#{pass}'")
@@ -93,15 +119,7 @@ def do_login(user='admin', pass='')
93119
if result == :success
94120
print_good("#{target_url} - Successful login '#{user}' : '#{pass}'")
95121

96-
report_auth_info(
97-
:host => rhost,
98-
:port => rport,
99-
:sname => (ssl ? 'https' : 'http'),
100-
:user => user,
101-
:pass => pass,
102-
:proof => "WEBAPP=\"D-Link Management Interface\", PROOF=#{response.to_s}",
103-
:active => true
104-
)
122+
report_cred(ip: rhost, port: rport, user: user, password: pass)
105123

106124
return :next_user
107125
else

0 commit comments

Comments
 (0)