@@ -13,10 +13,12 @@ class Metasploit4 < Msf::Auxiliary
1313 def initialize ( info = { } )
1414 super ( update_info (
1515 info ,
16- 'Name' => 'BMC TrackIt! Unauthenticated Arbitrary Local User Password Change' ,
16+ 'Name' => 'BMC TrackIt! Unauthenticated Arbitrary User Password Change' ,
1717 'Description' => %q(
1818 This module exploits a flaw in the password reset mechanism in BMC TrackIt! 11.3
19- and possibly prior versions.
19+ and possibly prior versions. If the password reset service is configured to use
20+ a domain administrator (which is the recommended configuration), then domain
21+ credentials can be reset (such as domain Administrator).
2022 ) ,
2123 'References' =>
2224 [
@@ -25,7 +27,8 @@ def initialize(info = {})
2527 ] ,
2628 'Author' =>
2729 [
28- 'bperry' , # discovery/metasploit module
30+ 'bperry' , # discovery/metasploit module,
31+ 'jhart'
2932 ] ,
3033 'License' => MSF_LICENSE ,
3134 'DisclosureDate' => "Dec 9 2014"
@@ -34,7 +37,7 @@ def initialize(info = {})
3437 register_options (
3538 [
3639 OptString . new ( 'TARGETURI' , [ true , 'The path to BMC TrackIt!' , '/' ] ) ,
37- OptString . new ( 'LOCALUSER' , [ true , 'The local user to change password for' , 'Administrator' ] ) ,
40+ OptString . new ( 'LOCALUSER' , [ true , 'The user to change password for' , 'Administrator' ] ) ,
3841 OptString . new ( 'LOCALPASS' , [ false , 'The password to set for the local user (blank for random)' , '' ] ) ,
3942 OptString . new ( 'DOMAIN' , [ false , 'The domain of the user. By default the local user\'s computer name will be autodetected' , '' ] )
4043 ] , self . class )
0 commit comments