Class: Metasploit::Framework::LoginScanner::CiscoFirepower

Inherits:
HTTP
  • Object
show all
Defined in:
lib/metasploit/framework/login_scanner/cisco_firepower.rb

Constant Summary collapse

DEFAULT_PORT = 
443
PRIVATE_TYPES = 
[ :password ]
LOGIN_STATUS =

Shorter name

Metasploit::Model::Login::Status

Constants inherited from HTTP

HTTP::AUTHORIZATION_HEADER, HTTP::DEFAULT_HTTP_NOT_AUTHED_CODES, HTTP::DEFAULT_HTTP_SUCCESS_CODES, HTTP::DEFAULT_REALM, HTTP::DEFAULT_SSL_PORT, HTTP::LIKELY_PORTS, HTTP::LIKELY_SERVICE_NAMES, HTTP::REALM_KEY

Instance Attribute Summary

Attributes inherited from HTTP

#digest_auth_iis, #evade_header_folding, #evade_method_random_case, #evade_method_random_invalid, #evade_method_random_valid, #evade_pad_fake_headers, #evade_pad_fake_headers_count, #evade_pad_get_params, #evade_pad_get_params_count, #evade_pad_method_uri_count, #evade_pad_method_uri_type, #evade_pad_post_params, #evade_pad_post_params_count, #evade_pad_uri_version_count, #evade_pad_uri_version_type, #evade_shuffle_get_params, #evade_shuffle_post_params, #evade_uri_dir_fake_relative, #evade_uri_dir_self_reference, #evade_uri_encode_mode, #evade_uri_fake_end, #evade_uri_fake_params_start, #evade_uri_full_url, #evade_uri_use_backslashes, #evade_version_random_invalid, #evade_version_random_valid, #http_password, #http_success_codes, #http_username, #keep_connection_alive, #kerberos_authenticator_factory, #method, #ntlm_domain, #ntlm_send_lm, #ntlm_send_ntlm, #ntlm_send_spn, #ntlm_use_lm_key, #ntlm_use_ntlmv2, #ntlm_use_ntlmv2_session, #uri, #user_agent, #vhost

Instance Method Summary collapse

Methods inherited from HTTP

#authentication_required?, #build_http_service_opts, #build_service_opts, #db, #send_request, #service_as_result

Methods included from Msf::Auxiliary::Report

#active_db?, #create_cracked_credential, #create_credential, #create_credential_and_login, #create_credential_login, #db, #db_warning_given?, #get_client, #get_host, #inside_workspace_boundary?, #invalidate_login, #mytask, #myworkspace, #myworkspace_id, #report_auth_info, #report_client, #report_exploit, #report_host, #report_loot, #report_note, #report_service, #report_vuln, #report_web_form, #report_web_page, #report_web_site, #report_web_vuln, #store_cred, #store_local, #store_loot

Methods included from Require

optionally, optionally_active_record_railtie, optionally_include_metasploit_credential_creation, #optionally_include_metasploit_credential_creation, optionally_require_metasploit_db_gem_engines

Instance Method Details

#attempt_login(credential) ⇒ Result

Attempts to login to Cisco. This is called first.

Parameters:

Returns:

  • (Result) —

    A Result object indicating success or failure



57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/metasploit/framework/login_scanner/cisco_firepower.rb', line 57

def (credential)
  result_opts = {
    credential: credential,
    status: Metasploit::Model::Login::Status::INCORRECT,
    proof: nil,
    **service_as_result(service_opts)
  }

  begin
    result_opts.merge!((credential))
  rescue ::Rex::ConnectionError => e
    # Something went wrong during login. 'e' knows what's up.
    result_opts.merge!(status: LOGIN_STATUS::UNABLE_TO_CONNECT, proof: e.message)
  end

  Result.new(result_opts)
end

#check_setup ⇒ Object 



14
15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/metasploit/framework/login_scanner/cisco_firepower.rb', line 14

def check_setup
  res = send_request({
    'method' => 'GET',
    'uri'    => normalize_uri("#{uri}login.cgi")
  })

  if res && res.code == 200 && res.body.include?('/img/favicon.png?v=6.0.1-1213')
    report_service(service_opts)
    return false
  end

  'Unable to locate favicon in body. (Is this really CiscoFirepower?)'
end

#do_login(cred) ⇒ Object 



28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/metasploit/framework/login_scanner/cisco_firepower.rb', line 28

def (cred)
  console_user = cred.public
  console_pass = cred.private

  res = send_request({
    'method' => 'POST',
    'uri'    => normalize_uri("#{uri}login.cgi"),
    'vars_post' => {
    'username' => console_user,
    'password' => console_pass,
    'target'   => ''
    }
  })

  unless res
    return {status: LOGIN_STATUS::UNABLE_TO_CONNECT, proof: 'Connection timed out for login.cig'}
  end

  if res.code == 302 && res.get_cookies.include?('CGISESSID')
    return {status: LOGIN_STATUS::SUCCESSFUL, proof: res.body}
  end

  {status: LOGIN_STATUS::INCORRECT, proof: res.body}
end

#service_opts ⇒ Object 



75
76
77
 
# File 'lib/metasploit/framework/login_scanner/cisco_firepower.rb', line 75

def service_opts
  build_service_opts('cisco_firepower')
end