Yeah I can change it, but if doin that, then for consistency, the version scanner should probably change too...


Sent via BlackBerry by AT&T

-----Original Message-----
From: sinn3r <notifications@github.com>
Date: Thu, 23 May 2013 23:32:56 
To: rapid7/metasploit-framework<metasploit-framework@noreply.github.com>
Reply-To: rapid7/metasploit-framework <reply@reply.github.com>
Cc: ringt<nowhey200@gmail.com>
Subject: Re: [metasploit-framework] Updates for
 auxiliary/gather/coldfusion_pwd_props (#1855)

> +			title.gsub!(/\s/, '')
> +		end
> +		return nil  if( title == 'Not Found' or not title =~ /ColdFusionAdministrator/)
> +
> +		out = nil
> +
> +		if(response.body =~ />\s*Version:\s*(.*)<\/strong\><br\s\//)
> +			v = $1
> +			out = (v =~ /^6/) ? "Adobe ColdFusion MX6 (Not Vulnerable)" : "Adobe ColdFusion MX7 (Not Vulnerable)"
> +		elsif(response.body =~ /<meta name=\"Author\" content=\"Copyright 1995-2012 Adobe/ and response.body =~ /Administrator requires a browser that supports frames/ )
> +			out = "Adobe ColdFusion MX7 (Not Vulnerable)"
> +		elsif(response.body =~ /<meta name=\"Author\" content=\"Copyright \(c\) 1995-2006 Adobe/)
> +			out = "Adobe ColdFusion 8 (Not Vulnerable)"
> +		elsif(response.body =~ /<meta name=\"Author\" content=\"Copyright \(c\) 1995-2010 Adobe/ or
> +			response.body =~ /<meta name=\"Author\" content=\"Copyright \(c\) 1995\-2009 Adobe Systems\, Inc\. All rights reserved/)
> +			out = "Adobe ColdFusion 9"

Tested on ColdFusion 10, didn't work because of one of these conditions.  Demo:

	[*] 10.0.1.78:8500 Adobe ColdFusion 9 (Apache-Coyote/1.1)
	[-] 10.0.1.78:8500 - No passwords found
	[*] Auxiliary module execution completed

The fingerprinting code by HTP's PoC works pretty well for me. It's done by downloading loginbackground.jpg, and then compares the MD5 of it.  Would you consider that approach?  PoC here:
http://www.exploit-db.com/exploits/25305/

---
Reply to this email directly or view it on GitHub:
https://github.com/rapid7/metasploit-framework/pull/1855/files#r4376246