diff --git a/modules/auxiliary/scanner/vmware/vmauthd_login.rb b/modules/auxiliary/scanner/vmware/vmauthd_login.rb index be29c48519..b8904638d1 100644 --- a/modules/auxiliary/scanner/vmware/vmauthd_login.rb +++ b/modules/auxiliary/scanner/vmware/vmauthd_login.rb @@ -4,6 +4,8 @@ ## require 'msf/core/exploit/tcp' +require 'metasploit/framework/credential_collection' +require 'metasploit/framework/login_scanner/vmauthd' class Metasploit3 < Msf::Auxiliary @@ -33,103 +35,67 @@ class Metasploit3 < Msf::Auxiliary end def run_host(ip) + print_brute :ip => ip, :msg => 'Starting bruteforce' + + # Peform a sanity check to ensure that our target is vmauthd before + # attempting to brute force it. begin - - connect rescue nil - if not self.sock - print_error "#{rhost}:#{rport} Could not connect to vmauthd" - return - end - - banner = sock.get_once(-1, 10) - if not banner - print_error "#{rhost}:#{rport} No banner received from vmauthd" - return - end - - banner = banner.strip - print_status "#{rhost}:#{rport} Banner: #{banner}" - - unless banner =~ /VMware Authentication Daemon/ - print_error "#{rhost}:#{rport} This does not appear to be a vmauthd service" - return - end - - if banner =~ /SSL/ - print_status("#{rhost}:#{rport} Switching to SSL connection...") - swap_sock_plain_to_ssl - end - - each_user_pass do |user, pass| - result = do_login(user, pass) - case result - when :failed - print_error("#{rhost}:#{rport} vmauthd login FAILED - #{user}:#{pass}") - when :success - print_good("#{rhost}:#{rport} vmauthd login SUCCESS - #{user}:#{pass}") - report_auth_info( - :host => rhost, - :port => rport, - :sname => 'vmauthd', - :user => user, - :pass => pass, - :source_type => "user_supplied", - :active => true - ) - return if datastore['STOP_ON_SUCCESS'] - else - print_error("#{rhost}:#{rport} Error: #{result}") + connect rescue nil + if !self.sock + print_brute :level => :verror, :ip => ip, :msg => 'Could not connect' + return + end + banner = sock.get_once(-1, 10) + if !banner || !banner =~ /^220 VMware Authentication Daemon Version.*/ + print_brute :level => :verror, :ip => ip, :msg => 'Target does not appear to be a vmauthd service' + return end - end - rescue ::Interrupt - raise $! + rescue ::Interrupt + raise $ERROR_INFO ensure disconnect end - end + cred_collection = Metasploit::Framework::CredentialCollection.new( + blank_passwords: datastore['BLANK_PASSWORDS'], + pass_file: datastore['PASS_FILE'], + password: datastore['PASSWORD'], + user_file: datastore['USER_FILE'], + userpass_file: datastore['USERPASS_FILE'], + username: datastore['USERNAME'], + user_as_pass: datastore['USER_AS_PASS'] + ) + scanner = Metasploit::Framework::LoginScanner::VMAUTHD.new( + host: ip, + port: rport, + proxies: datastore['PROXIES'], + cred_details: cred_collection, + stop_on_success: datastore['STOP_ON_SUCCESS'], + connection_timeout: 30 + ) - def do_login(user, pass, nsock=self.sock) - nsock.put("USER #{user}\r\n") - res = nsock.get_once - unless res.start_with? "331" - ret_msg = "Unexpected reply to the USER command: #{res}" - return ret_msg - end - nsock.put("PASS #{pass}\r\n") - res = nsock.get_once || '' - if res.start_with? "530" - return :failed - elsif res.start_with? "230" - return :success - else - ret_msg = "Unexpected reply to the PASS command: #{res}" - return ret_msg + scanner.scan! do |result| + credential_data = result.to_h + credential_data.merge!( + module_fullname: self.fullname, + workspace_id: myworkspace_id + ) + case result.status + when Metasploit::Model::Login::Status::SUCCESSFUL + print_brute :level => :good, :ip => ip, :msg => "Success: '#{result.credential}' '#{result.proof.to_s.gsub(/[\r\n\e\b\a]/, ' ')}'" + credential_core = create_credential(credential_data) + credential_data[:core] = credential_core + create_credential_login(credential_data) + :next_user + when Metasploit::Model::Login::Status::UNABLE_TO_CONNECT + print_brute :level => :verror, :ip => ip, :msg => 'Could not connect' + invalidate_login(credential_data) + :abort + when Metasploit::Model::Login::Status::INCORRECT + print_brute :level => :verror, :ip => ip, :msg => "Failed: '#{result.credential}' #{result.proof}" + invalidate_login(credential_data) + end end end - - def swap_sock_plain_to_ssl(nsock=self.sock) - ctx = generate_ssl_context() - ssl = OpenSSL::SSL::SSLSocket.new(nsock, ctx) - - ssl.connect - - nsock.extend(Rex::Socket::SslTcp) - nsock.sslsock = ssl - nsock.sslctx = ctx - end - - def generate_ssl_context - ctx = OpenSSL::SSL::SSLContext.new(:SSLv3) - @@cached_rsa_key ||= OpenSSL::PKey::RSA.new(1024){ } - - ctx.key = @@cached_rsa_key - - ctx.session_id_context = Rex::Text.rand_text(16) - - return ctx - end - - end