@@ -13,10 +13,12 @@ class Metasploit4 < Msf::Auxiliary
13
13
def initialize ( info = { } )
14
14
super ( update_info (
15
15
info ,
16
- 'Name' => 'BMC TrackIt! Unauthenticated Arbitrary Local User Password Change' ,
16
+ 'Name' => 'BMC TrackIt! Unauthenticated Arbitrary User Password Change' ,
17
17
'Description' => %q(
18
18
This module exploits a flaw in the password reset mechanism in BMC TrackIt! 11.3
19
- and possibly prior versions.
19
+ and possibly prior versions. If the password reset service is configured to use
20
+ a domain administrator (which is the recommended configuration), then domain
21
+ credentials can be reset (such as domain Administrator).
20
22
) ,
21
23
'References' =>
22
24
[
@@ -25,7 +27,8 @@ def initialize(info = {})
25
27
] ,
26
28
'Author' =>
27
29
[
28
- 'bperry' , # discovery/metasploit module
30
+ 'bperry' , # discovery/metasploit module,
31
+ 'jhart'
29
32
] ,
30
33
'License' => MSF_LICENSE ,
31
34
'DisclosureDate' => "Dec 9 2014"
@@ -34,7 +37,7 @@ def initialize(info = {})
34
37
register_options (
35
38
[
36
39
OptString . new ( 'TARGETURI' , [ true , 'The path to BMC TrackIt!' , '/' ] ) ,
37
- OptString . new ( 'LOCALUSER' , [ true , 'The local user to change password for' , 'Administrator' ] ) ,
40
+ OptString . new ( 'LOCALUSER' , [ true , 'The user to change password for' , 'Administrator' ] ) ,
38
41
OptString . new ( 'LOCALPASS' , [ false , 'The password to set for the local user (blank for random)' , '' ] ) ,
39
42
OptString . new ( 'DOMAIN' , [ false , 'The domain of the user. By default the local user\'s computer name will be autodetected' , '' ] )
40
43
] , self . class )
0 commit comments