CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Scanner
9
  include Msf::Auxiliary::Report
10

11
  def initialize
12
    super(
13
      'Name'        => 'Lotus Domino Version',
14
      'Description' => 'Several checks to determine Lotus Domino Server Version.',
15
      'Author'       => ['CG'],
16
      'License'     => MSF_LICENSE
17
      )
18
    register_options(
19
            [
20
              OptString.new('PATH', [ true,  "path", '/']),
21
            ] )
22
  end
23

24
  def run_host(ip)
25

26
    path = datastore['PATH']
27
    check1 = [
28
      'iNotes/Forms5.nsf',
29
      'iNotes/Forms6.nsf',
30
      'iNotes/Forms7.nsf',
31
      ]
32

33
    check2 = [
34
      'help/readme.nsf?OpenAbout'
35
      ]
36
    check3 = [
37
      'download/filesets/l_LOTUS_SCRIPT.inf',
38
      'download/filesets/n_LOTUS_SCRIPT.inf',
39
      'download/filesets/l_SEARCH.inf',
40
      'download/filesets/n_SEARCH.inf',
41
      ]
42

43
    currentversion = []
44
    baseversion = []
45

46
    begin
47

48
      check1.each do | check |
49

50
        res = send_request_raw({
51
          'uri'          =>  normalize_uri(path, check),
52
          'method'       => 'GET'
53
          }, 10)
54

55
        if (res.nil?)
56
          print_error("no response for #{ip}:#{rport} #{check}")
57
        elsif (res.code == 200 and res.body)
58
          # string we are regexing: <!-- Domino Release 7.0.3FP1 (Windows NT/Intel) -->
59
          if match = res.body.match(/\<!-- Domino Release(.*) --\>/);
60
            server1 = $1
61
            report_note(
62
              :host	=> ip,
63
              :proto => 'tcp',
64
              :sname => (ssl ? "https" : "http"),
65
              :port	=> rport,
66
              :type => 'lotusdomino.version.current',
67
              :data => server1.strip
68
                )
69
            if currentversion.empty? then
70
              currentversion << server1.strip
71
            elsif server1.strip == currentversion.last then
72
              ''
73
            else server1.strip != currentversion.last
74
              print_error("Different current version values") #this shouldnt happen,but just in case
75
              currentversion << ' : ' + server1.strip
76
            end
77
          else
78
            ''
79
          end
80
        elsif
81
          if (res.code and res.headers['Location'])
82
            print_error("#{ip}:#{rport} #{res.code} Redirect to #{res.headers['Location']}")
83
          else
84
            ''
85
          end
86
        else
87
          ''
88
        end
89
      end
90
      if currentversion.length == 0 then
91
        ''
92
      else
93
        print_good("#{ip}:#{rport} Lotus Domino Current Version: #{currentversion}")
94
      end
95

96
      check2.each do | check |
97

98
        res = send_request_raw({
99
          'uri'          =>  normalize_uri(path, check),
100
          'method'       => 'GET'
101
          }, 10)
102

103
        if (res.nil?)
104
          print_error("no response for #{ip}:#{rport} #{check}")
105
        elsif (res.code == 200 and res.body)
106
          # string we are regexing: <title>IBM Lotus Notes/Domino 6.5.6 Release Notes</title>
107
          if match = res.body.match(/\<title\>(.*)Lotus Notes\/Domino (.*) Release Notes\<\/title\>/);
108
            server2 = $2
109
            print_good("#{ip}:#{rport} Lotus Domino Release Notes Version: " + $2)
110
            report_note(
111
              :host	=> ip,
112
              :proto => 'tcp',
113
              :sname => (ssl ? "https" : "http"),
114
              :port	=> rport,
115
              :type => 'lotusdomino.version.releasenotes',
116
              :data => server2.strip
117
                )
118
          else
119
            ''
120
          end
121
        elsif
122
          if (res.code and res.headers['Location'])
123
            print_error("#{ip}:#{rport} #{res.code} Redirect to #{res.headers['Location']}")
124
          else
125
            ''
126
          end
127
        else
128
          ''
129
        end
130
      end
131

132
      check3.each do | check |
133

134
        res = send_request_raw({
135
          'uri'          =>  normalize_uri(path, check),
136
          'method'       => 'GET'
137
          }, 10)
138

139
        if (res.nil?)
140
          print_error("no response for #{ip}:#{rport} #{check}")
141
        elsif (res.code == 200 and res.body and res.body.index('TotalFileSize') and res.body.index('FileCount'))
142
          # string we are regexing: # Regex Version=8.5.1.0
143
          if match = res.body.match(/Version=(.*)/);
144
            server3 = $1
145
            report_note(
146
              :host	=> ip,
147
              :proto => 'tcp',
148
              :sname => (ssl ? "https" : "http"),
149
              :port	=> rport,
150
              :type => 'lotusdomino.version.base',
151
              :data => server3.strip
152
                )
153
            if baseversion.empty? then
154
              baseversion << server3.strip
155
            elsif server3.strip == baseversion.last then
156
              ''
157
            else server3.strip != baseversion.last #this shouldnt happen,but just in case
158
              print_error("Different base version values")
159
              baseversion << ' : ' + server3.strip
160
            end
161
          else
162
            ''
163
          end
164
        elsif
165
          if (res.code and res.headers['Location'])
166
            print_error("#{ip}:#{rport} #{res.code} Redirect to #{res.headers['Location']}")
167
          else
168
            ''
169
          end
170
        else
171
          ''
172
        end
173
      end
174
      if baseversion.length == 0 then
175
        ''
176
      else
177
        print_good("#{ip}:#{rport} Lotus Domino Base Install Version: #{baseversion}")
178
      end
179
    end
180
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
181
    rescue Timeout::Error, Errno::EINVAL, Errno::ECONNRESET, Resolv::ResolvError, EOFError, Errno::ECONNABORTED, Errno::ECONNREFUSED, Errno::EHOSTUNREACH =>e
182
      print_error(e.message)
183
  end
184
end
185

186