Skip to content

Commit eb47ca5

Browse files
committed
update desc to include domain admin information
1 parent 2e94280 commit eb47ca5

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

modules/auxiliary/scanner/http/bmc_trackit_passwd_reset.rb

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@ class Metasploit4 < Msf::Auxiliary
1313
def initialize(info = {})
1414
super(update_info(
1515
info,
16-
'Name' => 'BMC TrackIt! Unauthenticated Arbitrary Local User Password Change',
16+
'Name' => 'BMC TrackIt! Unauthenticated Arbitrary User Password Change',
1717
'Description' => %q(
1818
This module exploits a flaw in the password reset mechanism in BMC TrackIt! 11.3
19-
and possibly prior versions.
19+
and possibly prior versions. If the password reset service is configured to use
20+
a domain administrator (which is the recommended configuration), then domain
21+
credentials can be reset (such as domain Administrator).
2022
),
2123
'References' =>
2224
[
@@ -25,7 +27,8 @@ def initialize(info = {})
2527
],
2628
'Author' =>
2729
[
28-
'bperry', # discovery/metasploit module
30+
'bperry', # discovery/metasploit module,
31+
'jhart'
2932
],
3033
'License' => MSF_LICENSE,
3134
'DisclosureDate' => "Dec 9 2014"
@@ -34,7 +37,7 @@ def initialize(info = {})
3437
register_options(
3538
[
3639
OptString.new('TARGETURI', [true, 'The path to BMC TrackIt!', '/']),
37-
OptString.new('LOCALUSER', [true, 'The local user to change password for', 'Administrator']),
40+
OptString.new('LOCALUSER', [true, 'The user to change password for', 'Administrator']),
3841
OptString.new('LOCALPASS', [false, 'The password to set for the local user (blank for random)', '']),
3942
OptString.new('DOMAIN', [false, 'The domain of the user. By default the local user\'s computer name will be autodetected', ''])
4043
], self.class)

0 commit comments

Comments
 (0)