search

rapid7 / metasploit-framework

Metasploit Framework
https://www.metasploit.com/
Other
32.92k stars 13.71k forks source link

auxiliary/scanner/http/softing_sis_login no longer supports modern versions #19142

Open bwatters-r7 opened 2 weeks ago

bwatters-r7 commented 2 weeks ago

Softing Secure Integration Server 1.30.0.48080 no longer works with the softing_sis_login scanner. Based on some packet captures, the protocol has changed for logging in:

msf6 auxiliary(scanner/http/softing_sis_login) > show options

Module options (auxiliary/scanner/http/softing_sis_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   ANONYMOUS_LOGIN   false            yes       Attempt to login with a blank username and password
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   DB_SKIP_EXISTING  none             no        Skip existing credentials stored in the current database (Accepted: none, user, use
                                                r&realm)
   PASSWORD          admin            no        The password to specify for authentication.
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                             yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/us
                                                ing-metasploit.html
   RPORT             8099             yes       The target port (TCP)
   SSL               false            no        Negotiate SSL/TLS for outgoing connections
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME          admin            no        The username to specify for authentication.
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts
   VHOST                              no        HTTP server virtual host

View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/http/softing_sis_login) > set rhost 10.5.132.111
rhost => 10.5.132.111
msf6 auxiliary(scanner/http/softing_sis_login) > set username admin
username => admin
msf6 auxiliary(scanner/http/softing_sis_login) > set password admin
password => admin
msf6 auxiliary(scanner/http/softing_sis_login) > set verbose true
verbose => true
msf6 auxiliary(scanner/http/softing_sis_login) > run

[+] 10.5.132.111:8099 - Softing Secure Integration Server 1.22.0.8686
[+] 10.5.132.111:8099 - Success: 'admin:admin'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf6 auxiliary(scanner/http/softing_sis_login) > set rhost 10.5.132.111
rhost => 10.5.132.111
msf6 auxiliary(scanner/http/softing_sis_login) > set username admin
username => admin
msf6 auxiliary(scanner/http/softing_sis_login) > set password admin
password => admin
msf6 auxiliary(scanner/http/softing_sis_login) > set password v3Mpassword
password => v3Mpassword
msf6 auxiliary(scanner/http/softing_sis_login) > set verbose true
verbose => true
msf6 auxiliary(scanner/http/softing_sis_login) > run

[+] 10.5.132.111:8099 - Softing Secure Integration Server 1.30.0.48080
[-] 10.5.132.111:8099 - Failed: 'admin:v3Mpassword'
[!] No active DB -- Credential data will not be saved!
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/http/softing_sis_login) >

msf6 > use auxiliary/scanner/http/softing_sis_login msf6 auxiliary(scanner/http/softing_sis_login) > set rhost 10.5.132.111 rhost => 10.5.132.111 msf6 auxiliary(scanner/http/softing_sis_login) > set username admin username => admin msf6 auxiliary(scanner/http/softing_sis_login) > set password admin password => admin msf6 auxiliary(scanner/http/softing_sis_login) > set password v3Mpassword password => v3Mpassword msf6 auxiliary(scanner/http/softing_sis_login) > set verbose true verbose => true msf6 auxiliary(scanner/http/softing_sis_login) > run

[+] 10.5.132.111:8099 - Softing Secure Integration Server 1.30.0.48080 [-] 10.5.132.111:8099 - Failed: 'admin:v3Mpassword' [!] No active DB -- Credential data will not be saved! [] Scanned 1 of 1 hosts (100% complete) [] Auxiliary module execution completed msf6 auxiliary(scanner/http/softing_sis_login) > 


Found while testing https://github.com/rapid7/metasploit-framework/pull/19075