Update deprecated report_auth_info in various modules #18398
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…fle/smb.rb module
…data/exploits/psnuffle/
|
Any reviews or suggestions? This is my first code PR. |
|
Thanks for the PR! Since this PR is touching so many protocol types/modules it will require some close review on our side to ensure there's no regressions/bugs introduced, as a result it might take a little longer than expected to verify and merge this work 👍 |
|
Any updates? @adfoster-r7 |
adfoster-r7
reviewed
Dec 14, 2023
data/exploits/psnuffle/ftp.rb
Outdated
| report_auth_info(s.merge({:active => false})) | ||
| report_cred( | ||
| :ip => s[:host], | ||
| :port => 21, |
There was a problem hiding this comment.
Why do we need to hard code 21 here, is it not just s[:port] ? 👀
There was a problem hiding this comment.
def parse(pkt)
# We want to return immediatly if we do not have a packet which is handled by us
return unless pkt.is_tcp?
return if (pkt.tcp_sport != 21 and pkt.tcp_dport != 21)
s = find_session((pkt.tcp_sport == 21) ? get_session_src(pkt) : get_session_dst(pkt))
...
The function only analyses packets where the target's port 21 is involved(hard coded by the writer?). So s[:port] is always gonna be 21. But yes, cleaner to use s[:port] instead. I'll have to do the same for the other modules too.
adfoster-r7
reviewed
Dec 14, 2023
adfoster-r7
reviewed
Dec 14, 2023
| @@ -49,7 +57,15 @@ def parse(pkt) | |||
|
|
|||
| when :login_pass | |||
| if(s[:user] and s[:pass]) | |||
| report_auth_info(s) | |||
| report_cred( | |||
There was a problem hiding this comment.
This seems to crash for me, were these changes working for you locally when you were testing? 👀
msf6 auxiliary(sniffer/psnuffle) >
[-] Auxiliary failed: NameError undefined local variable or method `myworkspace_id' for #<#<Module:0x00007f6f1d99d0c0>::SnifferFTP:0x00007f6f1de354e8 @framework=#<Framework (0 sessions, 1 jobs, 0 plugins)>, @module=#<Module:auxiliary/sniffer/psnuffle datastore=[#<Msf::ModuleDataStoreWithFallbacks:0x00007f6f1d2f54c0 @options={"WORKSPACE"=>#<Msf::OptString:0x00007f6f2603a858 @name="WORKSPACE", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="Specify the workspace for this module", @default=nil, @enums=[], @owner=Msf::Module>, "VERBOSE"=>#<Msf::OptBool:0x00007f6f2603a650 @name="VERBOSE", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="Enable detailed status messages", @default=false, @enums=[], @owner=Msf::Module>, "PCAPFILE"=>#<Msf::OptPath:0x00007f6f26038058 @name="PCAPFILE", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The name of the PCAP capture file to process", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "INTERFACE"=>#<Msf::OptString:0x00007f6f26033e68 @name="INTERFACE", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The name of the interface", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "FILTER"=>#<Msf::OptString:0x00007f6f26033c88 @name="FILTER", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The filter string for capturing traffic", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "SNAPLEN"=>#<Msf::OptInt:0x00007f6f26033aa8 @name="SNAPLEN", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="The number of bytes to capture", @default=65535, @enums=[], @owner=Msf::Exploit::Capture>, "TIMEOUT"=>#<Msf::OptInt:0x00007f6f260338f0 @name="TIMEOUT", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="The number of seconds to wait for new data", @default=500, @enums=[], @owner=Msf::Exploit::Capture>, "SECRET"=>#<Msf::OptInt:0x00007f6f260324a0 @name="SECRET", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="A 32-bit cookie for probe requests.", @default=1297303073, @enums=[], @owner=Msf::Exploit::Capture>, "GATEWAY_PROBE_HOST"=>#<Msf::OptAddress:0x00007f6f26032298 @name="GATEWAY_PROBE_HOST", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="Send a TTL=1 random UDP datagram to this host to discover the default gateway's MAC", @default="8.8.8.8", @enums=[], @owner=Msf::Exploit::Capture>, "GATEWAY_PROBE_PORT"=>#<Msf::OptPort:0x00007f6f260320b8 @name="GATEWAY_PROBE_PORT", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The port on GATEWAY_PROBE_HOST to send a random UDP probe to (random if 0 or unset)", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "PROTOCOLS"=>#<Msf::OptString:0x00007f6f26030768 @name="PROTOCOLS", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="A comma-delimited list of protocols to sniff or \"all\".", @default="all", @enums=[], @owner=Msf::Modules::Auxiliary__Sniffer__Psnuffle::MetasploitModule>, "ProtocolBase"=>#<Msf::OptPath:0x00007f6f2602bb50 @name="ProtocolBase", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="The base directory containing the protocol decoders", @default="/home/kali/metasploit-framework/data/exploits/psnuffle", @enums=[], @owner=Msf::Modules::Auxiliary__Sniffer__Psnuffle::MetasploitModule>}, @aliases={}, @defaults={}, @user_defined={"VERBOSE"=>false, "SNAPLEN"=>65535, "TIMEOUT"=>500, "SECRET"=>1297303073, "GATEWAY_PROBE_HOST"=>"8.8.8.8", "PROTOCOLS"=>"all", "ProtocolBase"=>"/home/kali/metasploit-framework/data/exploits/psnuffle"}, @_module=#<Module:auxiliary/sniffer/psnuffle datastore=[#<Msf::ModuleDataStoreWithFallbacks:0x00007f6f2603ab78 @options={"WORKSPACE"=>#<Msf::OptString:0x00007f6f2603a858 @name="WORKSPACE", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="Specify the workspace for this module", @default=nil, @enums=[], @owner=Msf::Module>, "VERBOSE"=>#<Msf::OptBool:0x00007f6f2603a650 @name="VERBOSE", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="Enable detailed status messages", @default=false, @enums=[], @owner=Msf::Module>, "PCAPFILE"=>#<Msf::OptPath:0x00007f6f26038058 @name="PCAPFILE", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The name of the PCAP capture file to process", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "INTERFACE"=>#<Msf::OptString:0x00007f6f26033e68 @name="INTERFACE", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The name of the interface", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "FILTER"=>#<Msf::OptString:0x00007f6f26033c88 @name="FILTER", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The filter string for capturing traffic", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "SNAPLEN"=>#<Msf::OptInt:0x00007f6f26033aa8 @name="SNAPLEN", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="The number of bytes to capture", @default=65535, @enums=[], @owner=Msf::Exploit::Capture>, "TIMEOUT"=>#<Msf::OptInt:0x00007f6f260338f0 @name="TIMEOUT", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="The number of seconds to wait for new data", @default=500, @enums=[], @owner=Msf::Exploit::Capture>, "SECRET"=>#<Msf::OptInt:0x00007f6f260324a0 @name="SECRET", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="A 32-bit cookie for probe requests.", @default=1297303073, @enums=[], @owner=Msf::Exploit::Capture>, "GATEWAY_PROBE_HOST"=>#<Msf::OptAddress:0x00007f6f26032298 @name="GATEWAY_PROBE_HOST", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="Send a TTL=1 random UDP datagram to this host to discover the default gateway's MAC", @default="8.8.8.8", @enums=[], @owner=Msf::Exploit::Capture>, "GATEWAY_PROBE_PORT"=>#<Msf::OptPort:0x00007f6f260320b8 @name="GATEWAY_PROBE_PORT", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=false, @desc="The port on GATEWAY_PROBE_HOST to send a random UDP probe to (random if 0 or unset)", @default=nil, @enums=[], @owner=Msf::Exploit::Capture>, "PROTOCOLS"=>#<Msf::OptString:0x00007f6f26030768 @name="PROTOCOLS", @advanced=false, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="A comma-delimited list of protocols to sniff or \"all\".", @default="all", @enums=[], @owner=Msf::Modules::Auxiliary__Sniffer__Psnuffle::MetasploitModule>, "ProtocolBase"=>#<Msf::OptPath:0x00007f6f2602bb50 @name="ProtocolBase", @advanced=true, @evasion=false, @aliases=[], @max_length=nil, @conditions=[], @fallbacks=[], @required=true, @desc="The base directory containing the protocol decoders", @default="/home/kali/metasploit-framework/data/exploits/psnuffle", @enums=[], @owner=Msf::Modules::Auxiliary__Sniffer__Psnuffle::MetasploitModule>}, @aliases={}, @defaults={}, @user_defined={}, @_module=#<Module:auxiliary/sniffer/psnuffle datastore=[#<Msf::ModuleDataStoreWithFallbacks:0x00007f6f2603ab78 ...>]>>]>>]>, @sessions={"192.168.123.136:49782-192.168.123.1:21"=>{:client_host=>"192.168.123.136", :client_port=>"49782", :host=>"192.168.123.1", :port=>"21", :session=>"192.168.123.136:49782-192.168.123.1:21", :ctime=>2023-12-14 09:28:18.068211206 -0500, :mtime=>2023-12-14 09:28:21.138930833 -0500, :sname=>"ftp", :info=>"220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------", :user=>"ftpuser", :pass=>"ftpuser"}}, @dport=0, @sigs={:banner=>/^(220\s*[^\r\n]+)/i, :user=>/^USER\s+([^\s]+)/i, :pass=>/^PASS\s+([^\s]+)/i, :login_pass=>/^(230\s*[^\n]+)/i, :login_fail=>/^(5\d\d\s*[^\n]+)/i, :bye=>/^221/}>
[-] Call stack:
[-] (eval):100:in `report_cred'
[-] (eval):60:in `block in parse'
[-] (eval):29:in `each_key'
[-] (eval):29:in `parse'
[-] /home/kali/metasploit-framework/modules/auxiliary/sniffer/psnuffle.rb:92:in `block (2 levels) in run'
[-] /home/kali/metasploit-framework/modules/auxiliary/sniffer/psnuffle.rb:91:in `each_key'
[-] /home/kali/metasploit-framework/modules/auxiliary/sniffer/psnuffle.rb:91:in `block in run'
[-] /home/kali/metasploit-framework/lib/msf/core/exploit/capture.rb:171:in `block in each_packet'
[-] /home/kali/metasploit-framework/lib/msf/core/exploit/capture.rb:170:in `each'
[-] /home/kali/metasploit-framework/lib/msf/core/exploit/capture.rb:170:in `each_packet'
[-] /home/kali/metasploit-framework/modules/auxiliary/sniffer/psnuffle.rb:87:in `run'
There was a problem hiding this comment.
For context, I was running an FTP server on my host machine:
docker run -it -e FTP_USER_NAME=ftpuser -e FTP_USER_PASS=ftpuser -e FTP_USER_HOME=/home/bob -p 30000-30009:30000-30009 -p 21:21 -v $(pwd)/testing:/home/bob --rm stilliard/pure-ftpd
And logging in via FTP from the metasploit host machine:
┌──(kali㉿kali)-[~]
└─$ ftp 192.168.123.1
Connected to 192.168.123.1.
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 1 of 5 allowed.
220-Local time is now 14:28. Server port: 21.
220-This is a private system - No anonymous login
220-IPv6 connections are also welcome on this server.
220 You will be disconnected after 15 minutes of inactivity.
Name (192.168.123.1:kali): ftpuser
331 User ftpuser OK. Password required
Password:
230 OK. Current directory is /
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
There was a problem hiding this comment.
Yes it crashes for me too. I think I missed testing this thinking it was too simple(I guess overconfidence does hit back :P). Other than this, I think there a few other fixes to be made in the other modules too. I'll request a review once that is done. Also, as a best practice should I open a different PR for each module?
There was a problem hiding this comment.
I think in this case a single PR is good 👍
Modicon password recoverySince I couldn't get the target, I copied the function call used in the module to the start of the creds output: Lotus Domino HashesSimilar to previous one, I copied the function call to the start of the Output of creds command: Psnuffle's FTP sniffer
output: Psnuffle's POP3 snifferWhile verifying the working of this module, I encountered a bug in the code- seems the module doesn't really extract the
output: PsnuffleOther sniffer modules have been verified by copying the output: |
|
Hi, its been a month without any activity, are we still missing something? |
|
Running through this now 👍 Modicon password recovery 🟢I ran a FTP server with some of the files hard coded as I also don't have access to the real system psnuffleftp 🟢target Running module which causes auth capture: http 🟠target - only works on port 80 Trigger auth capture: Looks like there's a bug in the signature order potentially? Introduced in #10315 Raw netcat request shows that the headers are probably in a different order to when the URL command was written: i.e. if the Host and Authorization headers were swapped around, the module would work - but would obviously break the original test data that bcoles added support for. It'll need restructured either way. Unrelated to this PR's changes smb 🟠not a blocker: Doesn't work with smb 3 negotiation - but also doesn't work against my target when the smb_status value is checked; Unrelated to this PR's changes Running: Logging into a windows box almost works, but fails this smb_status check: Value: For now I've manually hard-coded that it will treat 256 as successful, but looks to be a bug imapTarget Connecting This doesn't trigger logging I think this isn't working due to to the test server not responding on auth success/failure correctly Spec example: Using a different client also doesn't work with the current regex matches. docker-compose file: Running and creating a user: Logging in: Failed matching string From the specification it looks like the server can respond with the login status and then an arbitrary human readable code:
So it looks like this module needs updated to work in more scenarios, unrelated to this PR Pop3 🟠Using the same docker target above for imap; Connecting with the following: Leads to a crash in msfconsole: I think this will be fixed by #18625 being resolved For now I just patched the banner dump: Working as expected: |
Release NotesFixes deprecation warnings when running the |
|
Thanks for the pull request and sorry for the delay 💯 I spotted a bunch of issues with the existing modules when testing things out here, but I don't think that's a blocker to fixing the deprecation warnings It looks like the HTTP/POP3/IMAP parsers have some edgecases in them when running against targets other than whatever were previously tested against |
|
Thanks for merging my work! |
11 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Updates the deprecated report_auth_info in various modules to use the new credential API instead.
Updates the spec file for lotus_domino_password_hashes to comply with the new API
Related to #10314
Verification
List the steps needed to make sure this thing works
msfconsoleuse <module>