Skip to content

Commit 5a1cd24

Browse files
committed
finishing converting the last of this to credentials
1 parent 0972005 commit 5a1cd24

File tree

2 files changed

+56
-34
lines changed

2 files changed

+56
-34
lines changed

lib/msf/core/auxiliary/cisco.rb

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -391,34 +391,36 @@ def cisco_ios_config_eater(thost, tport, config)
391391

392392
when /^\s*ppp chap (secret|password) (\d+) ([^\s]+)/i
393393
stype = $2.to_i
394-
shash = $3
394+
spass = $3
395395

396396
if stype == 5
397-
print_good("#{thost}:#{tport} PPP CHAP MD5 Encrypted Password: #{shash}")
398-
store_loot("cisco.ios.ppp_password_hash", "text/plain", thost, shash, "ppp_password_hash.txt", "Cisco IOS PPP Password Hash (MD5)")
397+
print_good("#{thost}:#{tport} PPP CHAP MD5 Encrypted Password: #{spass}")
398+
store_loot("cisco.ios.ppp_password_hash", "text/plain", thost, spass, "ppp_password_hash.txt", "Cisco IOS PPP Password Hash (MD5)")
399+
cred = credential_data.dup
400+
cred[:private_data] = spass
401+
cred[:private_type] = :nonreplayable_hash
402+
create_credential_and_login(cred)
399403
end
400404

401405
if stype == 0
402-
print_good("#{thost}:#{tport} Password: #{shash}")
403-
store_loot("cisco.ios.ppp_password", "text/plain", thost, shash, "ppp_password.txt", "Cisco IOS PPP Password")
404-
405-
cred = cred_info.dup
406-
cred[:pass] = shash
407-
cred[:type] = "password"
408-
cred[:collect_type] = "password"
409-
store_cred(cred)
406+
print_good("#{thost}:#{tport} Password: #{spass}")
407+
store_loot("cisco.ios.ppp_password", "text/plain", thost, spass, "ppp_password.txt", "Cisco IOS PPP Password")
408+
409+
cred = credential_data.dup
410+
cred[:private_data] = spass
411+
cred[:private_type] = :nonreplayable_hash
412+
create_credential_and_login(cred)
410413
end
411414

412415
if stype == 7
413-
shash = cisco_ios_decrypt7(shash) rescue shash
414-
print_good("#{thost}:#{tport} PPP Decrypted Password: #{shash}")
415-
store_loot("cisco.ios.ppp_password", "text/plain", thost, shash, "ppp_password.txt", "Cisco IOS PPP Password")
416-
417-
cred = cred_info.dup
418-
cred[:pass] = shash
419-
cred[:type] = "password"
420-
cred[:collect_type] = "password"
421-
store_cred(cred)
416+
spass = cisco_ios_decrypt7(spass) rescue spass
417+
print_good("#{thost}:#{tport} PPP Decrypted Password: #{spass}")
418+
store_loot("cisco.ios.ppp_password", "text/plain", thost, spass, "ppp_password.txt", "Cisco IOS PPP Password")
419+
420+
cred = credential_data.dup
421+
cred[:private_data] = spass
422+
cred[:private_type] = :password
423+
create_credential_and_login(cred)
422424
end
423425
end
424426
end

spec/lib/msf/core/auxiliary/cisco_spec.rb

Lines changed: 34 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -756,15 +756,18 @@ def myworkspace
756756
expect(aux_cisco).to receive(:store_loot).with(
757757
"cisco.ios.ppp_password", "text/plain", "127.0.0.1", "1511021F0725", "ppp_password.txt", "Cisco IOS PPP Password"
758758
)
759-
expect(aux_cisco).to receive(:store_cred).with(
759+
expect(aux_cisco).to receive(:create_credential_and_login).with(
760760
{
761-
host: "127.0.0.1",
761+
address: "127.0.0.1",
762762
port: 1337,
763-
user: "",
764-
pass: "1511021F0725",
765-
type: "password",
766-
collect_type: "password",
767-
active: true
763+
protocol: "tcp",
764+
workspace_id: workspace.id,
765+
origin_type: :service,
766+
service_name: '',
767+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
768+
private_data: "1511021F0725",
769+
private_type: :nonreplayable_hash,
770+
status: Metasploit::Model::Login::Status::UNTRIED
768771
}
769772
)
770773
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'ppp chap secret 0 1511021F0725')
@@ -779,6 +782,20 @@ def myworkspace
779782
"cisco.ios.ppp_password_hash", "text/plain", "127.0.0.1", "1511021F0725", "ppp_password_hash.txt",
780783
"Cisco IOS PPP Password Hash (MD5)"
781784
)
785+
expect(aux_cisco).to receive(:create_credential_and_login).with(
786+
{
787+
address: "127.0.0.1",
788+
port: 1337,
789+
protocol: "tcp",
790+
workspace_id: workspace.id,
791+
origin_type: :service,
792+
service_name: '',
793+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
794+
private_data: "1511021F0725",
795+
private_type: :nonreplayable_hash,
796+
status: Metasploit::Model::Login::Status::UNTRIED
797+
}
798+
)
782799
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'ppp chap secret 5 1511021F0725')
783800
end
784801

@@ -791,15 +808,18 @@ def myworkspace
791808
expect(aux_cisco).to receive(:store_loot).with(
792809
"cisco.ios.ppp_password", "text/plain", "127.0.0.1", "cisco", "ppp_password.txt", "Cisco IOS PPP Password"
793810
)
794-
expect(aux_cisco).to receive(:store_cred).with(
811+
expect(aux_cisco).to receive(:create_credential_and_login).with(
795812
{
796-
host: "127.0.0.1",
813+
address: "127.0.0.1",
797814
port: 1337,
798-
user: "",
799-
pass: "cisco",
800-
type: "password",
801-
collect_type: "password",
802-
active: true
815+
protocol: "tcp",
816+
workspace_id: workspace.id,
817+
origin_type: :service,
818+
service_name: '',
819+
module_fullname: "auxiliary/scanner/snmp/cisco_dummy",
820+
private_data: "cisco",
821+
private_type: :password,
822+
status: Metasploit::Model::Login::Status::UNTRIED
803823
}
804824
)
805825
aux_cisco.cisco_ios_config_eater('127.0.0.1',1337,'ppp chap secret 7 1511021F0725')

0 commit comments

Comments
 (0)