Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Centralize networking #13750

Merged
merged 7 commits into from Jul 16, 2020
Merged
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
@@ -1,7 +1,7 @@
## General Notes

This module imports a Brocade configuration file into the database.
This is similar to `post/brocade/gather/enum_brocade` only access isn't required,
This is similar to `post/networking/gather/enum_brocade` only access isn't required,
and assumes you already have the file.

Example files for import can be found on git, like [this](https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/brocade_08.0.30hT311_ic_icx6430.conf).
Expand All @@ -10,7 +10,7 @@ Example files for import can be found on git, like [this](https://raw.githubuser

1. Have a Brocade configuration file
2. Start `msfconsole`
3. `use auxiliary/admin/brocade/brocade_config`
3. `use auxiliary/admin/networking/brocade_config`
4. `set RHOST x.x.x.x`
5. `set CONFIG /tmp/file.config`
6. `run`
Expand All @@ -29,12 +29,12 @@ Example files for import can be found on git, like [this](https://raw.githubuser

```
msf5 > wget https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/brocade_08.0.30hT311_ic_icx6430.conf -o /dev/null -O /tmp/brocade.conf
msf5 > use auxiliary/admin/brocade/brocade_config
msf5 auxiliary(admin/brocade/brocade_config) > set rhosts 127.0.0.1
msf5 > use auxiliary/admin/networking/brocade_config
msf5 auxiliary(admin/networking/brocade_config) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf5 auxiliary(admin/brocade/brocade_config) > set config /tmp/brocade.conf
msf5 auxiliary(admin/networking/brocade_config) > set config /tmp/brocade.conf
config => /tmp/brocade.conf
msf5 auxiliary(admin/brocade/brocade_config) > run
msf5 auxiliary(admin/networking/brocade_config) > run
[*] Running module against 127.0.0.1

[*] Importing config
Expand Down
Expand Up @@ -59,7 +59,7 @@ All of the leaked versions are available in the module
## Verification Steps

- Start `msfconsole`
- `use auxiliary/admin/cisco/cisco_asa_extrabacon`
- `use auxiliary/admin/networking/cisco_asa_extrabacon`
- `set RHOST x.x.x.x`
- `check`
- `run`
Expand All @@ -71,7 +71,7 @@ All of the leaked versions are available in the module
## Checking for a vulnerable version

```
msf > use auxiliary/admin/cisco/cisco_asa_extrabacon
msf > use auxiliary/admin/networking/cisco_asa_extrabacon
msf auxiliary(cisco_asa_extrabacon) > set rhost 192.168.1.1
rhost => 192.168.1.1
msf auxiliary(cisco_asa_extrabacon) > check
Expand Down
@@ -1,7 +1,7 @@
## General Notes

This module imports a Cisco configuration file into the database.
This is similar to `post/cisco/gather/enum_cisco` only access isn't required,
This is similar to `post/networking/gather/enum_cisco` only access isn't required,
and assumes you already have the file.

Example files for import can be found on git, like [this](https://raw.githubusercontent.com/GaetanLongree/MASI-ProjetAvanceReseau/3cf1d9a93828d5f44ee1bc4e4c01411e416892c5/Los%20Angeles/LA_EDGE_D.txt)
Expand All @@ -11,7 +11,7 @@ or from [Cisco](https://www.cisco.com/en/US/docs/routers/access/800/850/software

1. Have a Cisco configuration file
2. Start `msfconsole`
3. `use auxiliary/admin/cisco/cisco_config`
3. `use auxiliary/admin/networking/cisco_config`
4. `set RHOST x.x.x.x`
5. `set CONFIG /tmp/file.config`
6. `run`
Expand All @@ -34,12 +34,12 @@ root@metasploit-dev:~/metasploit-framework# wget https://raw.githubusercontent.c
root@metasploit-dev:~/metasploit-framework# ./msfconsole

[*] Starting persistent handler(s)...
msf5 > use auxiliary/admin/cisco/cisco_config
msf5 auxiliary(admin/cisco/cisco_config) > set config /tmp/LA_EDGE_D.txt
msf5 > use auxiliary/admin/networking/cisco_config
msf5 auxiliary(admin/networking/cisco_config) > set config /tmp/LA_EDGE_D.txt
config => /tmp/LA_EDGE_D.txt
msf5 auxiliary(admin/cisco/cisco_config) > set rhost 127.0.0.1
msf5 auxiliary(admin/networking/cisco_config) > set rhost 127.0.0.1
rhost => 127.0.0.1
msf5 auxiliary(admin/cisco/cisco_config) > run
msf5 auxiliary(admin/networking/cisco_config) > run
[*] Running module against 127.0.0.1

[*] Importing config
Expand Down
Expand Up @@ -13,11 +13,11 @@ work on a few versions below 10.4(2). Only version 11.0(1) requires authenticati
Setup RHOST, pick the file to download (FILENAME, default is /etc/shadow) and enjoy!

```
msf5 exploit(multi/http/cisco_dcnm_upload_2019) > use auxiliary/admin/cisco/cisco_dcnm_download
msf5 exploit > use auxiliary/admin/networking/cisco_dcnm_download

msf5 auxiliary(admin/cisco/cisco_dcnm_download) > set rhost 10.75.1.40
msf5 auxiliary(admin/networking/cisco_dcnm_download) > set rhost 10.75.1.40
rhost => 10.75.1.40
msf5 auxiliary(admin/cisco/cisco_dcnm_download) > run
msf5 auxiliary(admin/networking/cisco_dcnm_download) > run

[+] 10.75.1.40:443 - Detected DCNM 10.4(2)
[*] 10.75.1.40:443 - No authentication required, ready to exploit!
Expand Down
@@ -1,7 +1,7 @@
## General Notes

This module imports a Juniper configuration file into the database.
This is similar to `post/juniper/gather/enum_juniper` only access isn't required,
This is similar to `post/networking/gather/enum_juniper` only access isn't required,
and assumes you already have the file.

Example files for import can be found on git, like [this (junos)](https://raw.githubusercontent.com/h00die/MSF-Testing-Scripts/master/juniper_ex2200.config)
Expand All @@ -11,7 +11,7 @@ or [this (screenos)](https://raw.githubusercontent.com/h00die/MSF-Testing-Script

1. Have a Juniper configuration file
2. Start `msfconsole`
3. `use auxiliary/admin/juniper/juniper_config`
3. `use auxiliary/admin/networking/juniper_config`
4. `set RHOST x.x.x.x`
5. `set CONFIG /tmp/file.config`
6. `set action junos`
Expand Down Expand Up @@ -40,12 +40,12 @@ root@metasploit-dev:~/metasploit-framework# wget -o /dev/null -O /tmp/juniper_ex
root@metasploit-dev:~/metasploit-framework# ./msfconsole

[*] Starting persistent handler(s)...
msf5 > use auxiliary/admin/juniper/gather/juniper_config
msf5 auxiliary(admin/juniper/gather/juniper_config) > set config /tmp/juniper_ex2200.config
msf5 > use auxiliary/admin/networking/gather/juniper_config
msf5 auxiliary(admin/networking/gather/juniper_config) > set config /tmp/juniper_ex2200.config
config => /tmp/juniper_ex2200.config
msf5 auxiliary(admin/juniper/gather/juniper_config) > set rhost 127.0.0.1
msf5 auxiliary(admin/networking/gather/juniper_config) > set rhost 127.0.0.1
rhost => 127.0.0.1
msf5 auxiliary(admin/juniper/gather/juniper_config) > run
msf5 auxiliary(admin/networking/gather/juniper_config) > run
[*] Running module against 127.0.0.1

[*] Importing config
Expand All @@ -72,14 +72,14 @@ root@metasploit-dev:~/metasploit-framework# wget -o /dev/null -O /tmp/screenos.c
root@metasploit-dev:~/metasploit-framework# ./msfconsole

[*] Starting persistent handler(s)...
msf5 > use auxiliary/admin/juniper/gather/juniper_config
msf5 auxiliary(admin/juniper/gather/juniper_config) > set config /tmp/screenos.conf
msf5 > use auxiliary/admin/networking/gather/juniper_config
msf5 auxiliary(admin/networking/gather/juniper_config) > set config /tmp/screenos.conf
config => /tmp/screenos.conf
msf5 auxiliary(admin/juniper/gather/juniper_config) > set rhost 127.0.0.1
msf5 auxiliary(admin/networking/gather/juniper_config) > set rhost 127.0.0.1
rhost => 127.0.0.1
msf5 auxiliary(admin/juniper/gather/juniper_config) > set action SCREENOS
msf5 auxiliary(admin/networking/gather/juniper_config) > set action SCREENOS
action => SCREENOS
msf5 auxiliary(admin/juniper/gather/juniper_config) > run
msf5 auxiliary(admin/networking/gather/juniper_config) > run
[*] Running module against 127.0.0.1

[*] Importing config
Expand Down
Expand Up @@ -18,7 +18,7 @@

1. Have a Ubiquiti Unifi configuration file (db or unf)
2. Start `msfconsole`
3. `use auxiliary/admin/ubiquiti/ubiquiti_config`
3. `use auxiliary/admin/networking/ubiquiti_config`
4. `set RHOST x.x.x.x`
5. `set CONFIG /tmp/file.unf`
6. `run`
Expand All @@ -37,7 +37,7 @@

### Unf File
```
resource (unifi_config.rb)> use auxiliary/admin/ubiquiti/ubiquiti_config
resource (unifi_config.rb)> use auxiliary/admin/networking/ubiquiti_config
gwillcox-r7 marked this conversation as resolved.
Show resolved Hide resolved
resource (unifi_config.rb)> set rhosts 127.0.0.1
rhosts => 127.0.0.1
resource (unifi_config.rb)> set config /root/.msf4/loot/20190825172544_default_1.1.1.1_ubiquiti.unifi.b_740136.unf
Expand All @@ -59,12 +59,12 @@ resource (unifi_config.rb)> run
### db File

```
resource (unifi_config.rb)> use auxiliary/admin/ubiquiti/ubiquiti_config
resource (unifi_config.rb)> use auxiliary/admin/networking/ubiquiti_config
h00die marked this conversation as resolved.
Show resolved Hide resolved
resource (unifi_config.rb)> set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf5 auxiliary(admin/ubiquiti/ubiquiti_config) > set config /root/.msf4/loot/db
msf5 auxiliary(admin/networking/ubiquiti_config) > set config /root/.msf4/loot/db
config => /root/.msf4/loot/db
msf5 auxiliary(admin/ubiquiti/ubiquiti_config) > run
msf5 auxiliary(admin/networking/ubiquiti_config) > run
[*] Running module against 127.0.0.1

[*] Converting config BSON to JSON
Expand Down
Expand Up @@ -24,7 +24,7 @@

1. Start msfconsole
2. Get a shell
3. Do: ```use post/brocade/gather/enum_brocade```
3. Do: ```use post/networking/gather/enum_brocade```
4. Do: ```set session [id]```
5. Do: ```set verbose true```
6. Do: ```run```
Expand All @@ -36,7 +36,7 @@
#### SSH Session with password-display off

```
resource (brocade.rb)> use post/brocade/gather/enum_brocade
resource (brocade.rb)> use post/networking/gather/enum_brocade
gwillcox-r7 marked this conversation as resolved.
Show resolved Hide resolved
resource (brocade.rb)> set session 1
session => 1
resource (brocade.rb)> set verbose true
Expand All @@ -54,7 +54,7 @@ resource (brocade.rb)> run
#### SSH Session with Enable run

```
resource (brocade.rb)> use post/brocade/gather/enum_brocade
resource (brocade.rb)> use post/networking/gather/enum_brocade
resource (brocade.rb)> set session 1
session => 1
resource (brocade.rb)> set verbose true
Expand All @@ -70,7 +70,7 @@ verbose => true
[+] ENCRYPTED SNMP community $MlVzZCFAbg== with permissions ro
[+] ENCRYPTED SNMP community $U2kyXj1k with permissions rw
[*] Post module execution completed
msf5 post(brocade/gather/enum_brocade) > loot
msf5 post(networking/gather/enum_brocade) > loot
h00die marked this conversation as resolved.
Show resolved Hide resolved

Loot
====
Expand All @@ -80,7 +80,7 @@ host service type name content info
10.0.4.51 brocade.version version.txt text/plain Brocade Version /root/.msf4/loot/20190601221959_default_10.0.4.51_brocade.version_003751.txt
10.0.4.51 brocade.config config.txt text/plain Brocade Configuration /root/.msf4/loot/20190601222004_default_10.0.4.51_brocade.config_998514.txt

msf5 post(brocade/gather/enum_brocade) > creds
msf5 post(networking/gather/enum_brocade) > creds
Credentials
===========

Expand Down
Expand Up @@ -26,7 +26,7 @@

1. Start msfconsole
2. Get a shell
3. Do: ```use post/cisco/gather/enum_cisco```
3. Do: ```use post/networking/gather/enum_cisco```
4. Do: ```set session [id]```
5. Do: ```set verbose true```
6. Do: ```run```
Expand All @@ -48,7 +48,7 @@ resource (cisco.rb)> run
[*] Command shell session 1 opened (111.111.1.111:40721 -> 222.222.2.222:22) at 2019-07-20 16:29:05 -0400
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
resource (cisco.rb)> use post/cisco/gather/enum_cisco
resource (cisco.rb)> use post/networking/gather/enum_cisco
resource (cisco.rb)> set session 1
gwillcox-r7 marked this conversation as resolved.
Show resolved Hide resolved
session => 1
resource (cisco.rb)> set verbose true
Expand Down Expand Up @@ -82,7 +82,7 @@ resource (cisco.rb)> run
[+] Saving to /root/.msf4/loot/20190720163006_default_222.222.2.222_cisco.ios.cdp_ne_989308.txt
[*] Post module execution completed
[*] Starting persistent handler(s)...
msf5 post(cisco/gather/enum_cisco) > creds
msf5 post(networking/gather/enum_cisco) > creds
Credentials
===========

Expand Down Expand Up @@ -111,7 +111,7 @@ resource (cisco.rb)> run
[*] Command shell session 1 opened (111.111.1.111:41839 -> 222.222.2.222:22) at 2019-07-21 16:24:02 -0400
gwillcox-r7 marked this conversation as resolved.
Show resolved Hide resolved
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
resource (cisco.rb)> use post/cisco/gather/enum_cisco
resource (cisco.rb)> use post/networking/gather/enum_cisco
resource (cisco.rb)> set session 1
session => 1
resource (cisco.rb)> set verbose true
Expand Down Expand Up @@ -151,7 +151,7 @@ resource (cisco.rb)> run
[+] Saving to /root/.msf4/loot/20190721162508_default_222.222.2.222_cisco.ios.cdp_ne_405367.txt
[*] Post module execution completed
[*] Starting persistent handler(s)...
msf5 post(cisco/gather/enum_cisco) > creds
msf5 post(networking/gather/enum_cisco) > creds
Credentials
===========

Expand Down
Expand Up @@ -27,7 +27,7 @@

1. Start msfconsole
2. Get a shell
3. Do: ```use post/juniper/gather/enum_juniper```
3. Do: ```use post/networking/gather/enum_juniper```
4. Do: ```set session [id]```
5. Do: ```set verbose true```
6. Do: ```run```
Expand Down Expand Up @@ -59,7 +59,7 @@
[+] radius server 1.1.1.1 password hash: $9$Y-4GikqfF39JGCu1Ileq.PQ6AB1hrlMBIyKvWdV
[+] PPTP username 'pap_username' hash $9$he4revM87-dsevm5TQCAp0BErvLxd4JDNdkPfT/9BIR via PAP
[*] Post module execution completed
msf5 post(juniper/gather/enum_juniper) > creds
h00die marked this conversation as resolved.
Show resolved Hide resolved
msf5 post(networking/gather/enum_juniper) > creds
Credentials
===========

Expand Down Expand Up @@ -87,7 +87,7 @@ host origin service public private
[*] Command shell session 2 opened (192.168.1.6:45623 -> 192.168.1.5:22) at 2018-02-19 21:32:20 -0500
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
resource (juniper_ex2200.rc)> use post/juniper/gather/enum_juniper
resource (juniper_ex2200.rc)> use post/networking/gather/enum_juniper
gwillcox-r7 marked this conversation as resolved.
Show resolved Hide resolved
resource (juniper_ex2200.rc)> set session 2
session => 2
resource (juniper_ex2200.rc)> set verbose true
Expand Down