Class: Metasploit::Framework::LoginScanner::Smh

Inherits:
HTTP
  • Object
show all
Defined in:
lib/metasploit/framework/login_scanner/smh.rb

Overview

HP System Management login scanner tested on v6.3.1.24 upto v7.2.1.3 and 7.4

Constant Summary collapse

DEFAULT_PORT = 
4848
PRIVATE_TYPES = 
[ :password ]
CAN_GET_SESSION = 
true

Constants inherited from HTTP

HTTP::AUTHORIZATION_HEADER, HTTP::DEFAULT_HTTP_NOT_AUTHED_CODES, HTTP::DEFAULT_HTTP_SUCCESS_CODES, HTTP::DEFAULT_REALM, HTTP::DEFAULT_SSL_PORT, HTTP::LIKELY_PORTS, HTTP::LIKELY_SERVICE_NAMES, HTTP::REALM_KEY

Instance Attribute Summary

Attributes inherited from HTTP

#digest_auth_iis, #evade_header_folding, #evade_method_random_case, #evade_method_random_invalid, #evade_method_random_valid, #evade_pad_fake_headers, #evade_pad_fake_headers_count, #evade_pad_get_params, #evade_pad_get_params_count, #evade_pad_method_uri_count, #evade_pad_method_uri_type, #evade_pad_post_params, #evade_pad_post_params_count, #evade_pad_uri_version_count, #evade_pad_uri_version_type, #evade_shuffle_get_params, #evade_shuffle_post_params, #evade_uri_dir_fake_relative, #evade_uri_dir_self_reference, #evade_uri_encode_mode, #evade_uri_fake_end, #evade_uri_fake_params_start, #evade_uri_full_url, #evade_uri_use_backslashes, #evade_version_random_invalid, #evade_version_random_valid, #http_password, #http_success_codes, #http_username, #keep_connection_alive, #kerberos_authenticator_factory, #method, #ntlm_domain, #ntlm_send_lm, #ntlm_send_ntlm, #ntlm_send_spn, #ntlm_use_lm_key, #ntlm_use_ntlmv2, #ntlm_use_ntlmv2_session, #uri, #user_agent, #vhost

Instance Method Summary collapse

Methods inherited from HTTP

#authentication_required?, #build_http_service_opts, #build_service_opts, #db, #send_request, #service_as_result

Methods included from Msf::Auxiliary::Report

#active_db?, #create_cracked_credential, #create_credential, #create_credential_and_login, #create_credential_login, #db, #db_warning_given?, #get_client, #get_host, #inside_workspace_boundary?, #invalidate_login, #mytask, #myworkspace, #myworkspace_id, #report_auth_info, #report_client, #report_exploit, #report_host, #report_loot, #report_note, #report_service, #report_vuln, #report_web_form, #report_web_page, #report_web_site, #report_web_vuln, #store_cred, #store_local, #store_loot

Methods included from Require

optionally, optionally_active_record_railtie, optionally_include_metasploit_credential_creation, #optionally_include_metasploit_credential_creation, optionally_require_metasploit_db_gem_engines

Instance Method Details

#attempt_login(credential) ⇒ Object 



38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/metasploit/framework/login_scanner/smh.rb', line 38

def (credential)
  result_opts = {
    credential: credential,
    **service_as_result(service_opts)
  }

  req_opts = {
    'method' => 'POST',
    'uri'    => uri,
    'vars_post' => {
      'redirecturl'         => '',
      'redirectquerystring' => '',
      'user'                => credential.public,
      'password'            => credential.private
    }
  }

  res = nil

  begin
    res = send_request(req_opts)

  rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, ::EOFError, ::Timeout::Error => e
    result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: e)
    return Result.new(result_opts)
  end

  if res && res.headers['CpqElm-Login'].to_s =~ /success/
    result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL)
  else
    result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT)
  end

  Result.new(result_opts)
end

#check_setup ⇒ false, String

Checks if the target is HP System Management Homepage

Returns:

  • (false) —

    if the target looks like HP SMH

  • (String) —

    a human-readable error message if it doesn’t



19
20
21
22
23
24
25
26
27
28
29
30
31
 
# File 'lib/metasploit/framework/login_scanner/smh.rb', line 19

def check_setup
  res = send_request({
    'method' => 'GET',
    'uri'    => normalize_uri('/cpqlogin.htm')
  })

  return 'Unable to connect to the HP System Management Homepage login page' unless res
  return 'Unable to locate HP System Management Homepage login page (Is this really HP SMH?)' unless res.code == 200 && res.body.include?('HP System Management Homepage')

  report_service(service_opts)

  false
end

#service_opts ⇒ Object 



33
34
35
 
# File 'lib/metasploit/framework/login_scanner/smh.rb', line 33

def service_opts
  build_service_opts('hp-smh')
end