Skip to content

Commit ddee88b

Browse files
sinn3rsinn3r
committed
Merge branch 'aux-scan-openvas' of git://github.com/kost/metasploit-framework into kost-aux-scan-openvas
2 parents 2978775 + ec3ce49 commit ddee88b

File tree

3 files changed

+347
-0
lines changed

3 files changed

+347
-0
lines changed

‎modules/auxiliary/scanner/openvas/openvas_gsad_login.rb

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
##
2+
# openvas_gsad_login.rb
3+
##
4+
5+
##
6+
# This file is part of the Metasploit Framework and may be subject to
7+
# redistribution and commercial restrictions. Please see the Metasploit
8+
# web site for more information on licensing and terms of use.
9+
# http://metasploit.com/
10+
##
11+
12+
require 'msf/core'
13+
14+
class Metasploit3 < Msf::Auxiliary
15+
16+
include Msf::Exploit::Remote::HttpClient
17+
include Msf::Auxiliary::Report
18+
include Msf::Auxiliary::AuthBrute
19+
20+
include Msf::Auxiliary::Scanner
21+
22+
def initialize
23+
super(
24+
'Name' => 'OpenVAS gsad Web interface Login Utility',
25+
'Description' => 'This module simply attempts to login to a OpenVAS gsad interface using a specific user/pass.',
26+
'Author' => [ 'Vlatko Kosturjak <kost[at]linux.hr>' ],
27+
'License' => MSF_LICENSE
28+
)
29+
30+
register_options(
31+
[
32+
Opt::RPORT(443),
33+
OptString.new('URI', [true, "URI for OpenVAS omp login. Default is /omp", "/omp"]),
34+
OptBool.new('BLANK_PASSWORDS', [false, "Try blank passwords for all users", false]),
35+
OptBool.new('SSL', [ true, "Negotiate SSL for outgoing connections", true])
36+
], self.class)
37+
38+
register_advanced_options(
39+
[
40+
OptString.new('OMP_text', [true, "value for OpenVAS omp text login hidden field", "/omp?cmd=get_tasks&amp;overrides=1"]),
41+
OptString.new('OMP_cmd', [true, "value for OpenVAS omp cmd login hidden field", "login"])
42+
], self.class)
43+
end
44+
45+
def run_host(ip)
46+
begin
47+
res = send_request_cgi({
48+
'uri' => datastore['URI'],
49+
'method' => 'GET'
50+
}, 25)
51+
http_fingerprint({ :response => res })
52+
rescue ::Rex::ConnectionError => e
53+
vprint_error("#{msg} #{datastore['URI']} - #{e}")
54+
return
55+
end
56+
57+
if not res
58+
vprint_error("#{msg} #{datastore['URI']} - No response")
59+
return
60+
end
61+
if res.code != 200
62+
vprint_error("#{msg} - Expected 200 HTTP code - not gsad?")
63+
return
64+
end
65+
if res.body !~ /Greenbone Security Assistant \(GSA\)/
66+
vprint_error("#{msg} - Expected GSA keyword on page - not gsad?")
67+
return
68+
end
69+
70+
each_user_pass do |user, pass|
71+
do_login(user, pass)
72+
end
73+
end
74+
75+
def do_login(user='openvas', pass='openvas')
76+
vprint_status("#{msg} - Trying username:'#{user}' with password:'#{pass}'")
77+
headers = {}
78+
begin
79+
res = send_request_cgi({
80+
'encode' => true,
81+
'uri' => datastore['URI'],
82+
'method' => 'POST',
83+
'headers' => headers,
84+
'vars_post' => {
85+
'cmd' => datastore['OMP_cmd'],
86+
'text' => datastore['OMP_text'],
87+
'login' => user,
88+
'password' => pass
89+
}
90+
}, 25)
91+
92+
rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
93+
print_error("#{msg} HTTP Connection Failed, Aborting")
94+
return :abort
95+
end
96+
97+
if not res
98+
print_error("#{msg} HTTP Connection Error - res, Aborting")
99+
return :abort
100+
end
101+
102+
# vprint_status("#{msg} GOT BODY. '#{user}' : '#{pass}' - #{res.code} #{res.body}")
103+
104+
if res.code == 303
105+
print_good("#{msg} SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")
106+
107+
report_hash = {
108+
:host => datastore['RHOST'],
109+
:port => datastore['RPORT'],
110+
:sname => 'openvas-gsa',
111+
:user => user,
112+
:pass => pass,
113+
:active => true,
114+
:type => 'password'}
115+
116+
report_auth_info(report_hash)
117+
return :next_user
118+
end
119+
vprint_error("#{msg} FAILED LOGIN. '#{user}' : '#{pass}'")
120+
return :skip_pass
121+
end
122+
123+
def msg
124+
"#{vhost}:#{rport} OpenVAS gsad -"
125+
end
126+
end

‎modules/auxiliary/scanner/openvas/openvas_omp_login.rb

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
##
2+
# openvas_omp_login.rb
3+
##
4+
5+
# This file is part of the Metasploit Framework and may be subject to
6+
# redistribution and commercial restrictions. Please see the Metasploit
7+
# web site for more information on licensing and terms of use.
8+
# http://metasploit.com/
9+
##
10+
11+
require 'msf/core'
12+
13+
class Metasploit3 < Msf::Auxiliary
14+
15+
include Msf::Exploit::Remote::Tcp
16+
include Msf::Auxiliary::Scanner
17+
include Msf::Auxiliary::Report
18+
include Msf::Auxiliary::AuthBrute
19+
20+
def initialize
21+
super(
22+
'Name' => 'OpenVAS OMP Login Utility',
23+
'Description' => 'This module attempts to authenticate to an OpenVAS OMP service.',
24+
'Author' => [ 'Vlatko Kosturjak <kost[at]linux.hr>' ],
25+
'License' => MSF_LICENSE
26+
)
27+
register_options(
28+
[
29+
Opt::RPORT(9390),
30+
OptBool.new('BLANK_PASSWORDS', [false, "Try blank passwords for all users", false])
31+
], self.class)
32+
33+
register_advanced_options(
34+
[
35+
OptBool.new('SSL', [ true, "Negotiate SSL for outgoing connections", true]),
36+
OptString.new('SSLVersion', [ true, " Specify the version of SSL that should be used", "TLS1"])
37+
], self.class)
38+
end
39+
40+
def run_host(ip)
41+
begin
42+
print_status("#{msg} Connecting and checking username and passwords")
43+
each_user_pass do |user, pass|
44+
do_login(user, pass)
45+
end
46+
rescue ::Rex::ConnectionError
47+
rescue ::Exception => e
48+
vprint_error("#{msg} #{e.to_s} #{e.backtrace}")
49+
end
50+
end
51+
52+
def omp_send(data=nil, con=true)
53+
begin
54+
@result=''
55+
@coderesult=''
56+
if (con)
57+
@connected=false
58+
connect
59+
select(nil,nil,nil,0.4)
60+
end
61+
@connected=true
62+
sock.put(data)
63+
@result=sock.get_once
64+
rescue ::Exception => err
65+
print_error("#{msg} Error: #{err.to_s}")
66+
end
67+
end
68+
69+
def do_login(user=nil,pass=nil)
70+
begin
71+
vprint_status("#{msg} Trying user:'#{user}' with password:'#{pass}'")
72+
cmd = "<authenticate><credentials><username>#{user}</username><password>#{pass}</password></credentials></authenticate><HELP/>\r\n"
73+
omp_send(cmd,true) # send hello
74+
if @result =~ /<authenticate_response.*status="200"/is
75+
print_good("#{msg} SUCCESSFUL login for '#{user}' : '#{pass}'")
76+
report_auth_info(
77+
:host => rhost,
78+
:port => rport,
79+
:sname => 'openvas-omp',
80+
:user => user,
81+
:pass => pass,
82+
:source_type => "user_supplied",
83+
:active => true
84+
)
85+
disconnect
86+
@connected = false
87+
return :next_user
88+
else
89+
if (@connected)
90+
disconnect # Sometime openvas disconnect the client after wrongs attempts
91+
@connected = false
92+
end
93+
vprint_error("#{msg} Rejected user: '#{user}' with password: '#{pass}': #{@result}")
94+
return :fail
95+
end
96+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
97+
rescue ::Timeout::Error, ::Errno::EPIPE
98+
end
99+
end
100+
101+
def msg
102+
"#{rhost}:#{rport} OpenVAS OMP -"
103+
end
104+
end

‎modules/auxiliary/scanner/openvas/openvas_otp_login.rb

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
##
2+
# openvas_otp_login.rb
3+
##
4+
5+
# This file is part of the Metasploit Framework and may be subject to
6+
# redistribution and commercial restrictions. Please see the Metasploit
7+
# web site for more information on licensing and terms of use.
8+
# http://metasploit.com/
9+
##
10+
11+
require 'msf/core'
12+
13+
class Metasploit3 < Msf::Auxiliary
14+
15+
include Msf::Exploit::Remote::Tcp
16+
include Msf::Auxiliary::Scanner
17+
include Msf::Auxiliary::Report
18+
include Msf::Auxiliary::AuthBrute
19+
20+
def initialize
21+
super(
22+
'Name' => 'OpenVAS OTP Login Utility',
23+
'Description' => 'This module attempts to authenticate to an OpenVAS OTP service.',
24+
'Author' => [ 'Vlatko Kosturjak <kost[at]linux.hr>' ],
25+
'License' => MSF_LICENSE
26+
)
27+
register_options(
28+
[
29+
Opt::RPORT(9391),
30+
OptBool.new('BLANK_PASSWORDS', [false, "Try blank passwords for all users", false])
31+
], self.class)
32+
33+
register_advanced_options(
34+
[
35+
OptBool.new('SSL', [ true, "Negotiate SSL for outgoing connections", true]),
36+
OptString.new('SSLVersion', [ true, " Specify the version of SSL that should be used", "TLS1"])
37+
], self.class)
38+
end
39+
40+
def run_host(ip)
41+
begin
42+
print_status("#{msg} Connecting and checking username and passwords")
43+
each_user_pass do |user, pass|
44+
do_login(user, pass)
45+
end
46+
rescue ::Rex::ConnectionError
47+
rescue ::Exception => e
48+
vprint_error("#{msg} #{e.to_s} #{e.backtrace}")
49+
end
50+
end
51+
52+
def otp_send(data=nil, con=true)
53+
begin
54+
@result=''
55+
@coderesult=''
56+
if (con)
57+
@connected=false
58+
connect
59+
select(nil,nil,nil,0.4)
60+
end
61+
@connected=true
62+
sock.put(data)
63+
@result=sock.get_once
64+
rescue ::Exception => err
65+
print_error("#{msg} Error: #{err.to_s}")
66+
end
67+
end
68+
69+
def do_login(user=nil,pass=nil)
70+
begin
71+
otp_send("< OTP/1.0 >\n",true) # send hello
72+
if @result !~ /\<\ OTP\/1\.0 \>/
73+
print_error("#{msg} OpenVAS OTP does not appear to be running: did not get response to OTP hello: #{@result}")
74+
return :abort
75+
end
76+
77+
vprint_status("#{msg} Trying user:'#{user}' with password:'#{pass}'")
78+
otp_send(nil,!@connected)
79+
if @result !~ /User\ \:/
80+
print_error("#{msg} OpenVAS OTP did not send User request: #{@result}")
81+
end
82+
otp_send("#{user}\n",!@connected)
83+
if @result !~ /Password\ \:/
84+
print_error("#{msg} OpenVAS OTP did not send Password request: #{@result}")
85+
end
86+
otp_send("#{pass}\n",!@connected)
87+
if @result =~ /SERVER <|>.*<|> SERVER/is
88+
print_good("#{msg} SUCCESSFUL login for '#{user}' : '#{pass}'")
89+
report_auth_info(
90+
:host => rhost,
91+
:port => rport,
92+
:sname => 'openvas-otp',
93+
:user => user,
94+
:pass => pass,
95+
:source_type => "user_supplied",
96+
:active => true
97+
)
98+
disconnect
99+
@connected = false
100+
return :next_user
101+
else
102+
if (@connected)
103+
disconnect # Sometime openvas disconnect the client after wrongs attempts
104+
@connected = false
105+
end
106+
vprint_error("#{msg} Rejected user: '#{user}' with password: '#{pass}': #{@result}")
107+
return :fail
108+
end
109+
rescue ::Rex::ConnectionError
110+
rescue ::Timeout::Error, ::Errno::EPIPE
111+
end
112+
end
113+
114+
def msg
115+
"#{rhost}:#{rport} OpenVAS OTP -"
116+
end
117+
end

0 commit comments

Comments
 (0)