Changeset 387

Timestamp:

04/10/2010 02:26:45 PM (3 years ago)

Author:

deity

Message:

Mangled apacheusers and user_enum_apache together. Added facility for plugins to describe their options

Location:

trunk

Files:

• docs/CHANGES.txt (modified) (1 diff)
• plugins/nikto_apacheusers.plugin (modified) (3 diffs)
• plugins/nikto_core.plugin (modified) (1 diff)
• plugins/nikto_tests.plugin (modified) (2 diffs)
• plugins/nikto_user_enum_apache.plugin (deleted)

trunk/docs/CHANGES.txt

@@ +1 @@
+2010-04-10
+        - Merged apacheusers and apache_enum_users together
+        - Add facillity for a plugin to inform which options it can take
 2010-04-09
         - Ticket 137: Added -ask to override nikto.conf's UPDATES value (same options)

trunk/plugins/nikto_apacheusers.plugin

@@ -21 +21 @@
 # Apache user enumeration
 ###############################################################################
+
 sub nikto_apacheusers_init {
     my $id = {
             name        => "apacheusers",
             full_name   => "Apache Users",
-            author      => "Sullo",
+            author      => "Javier Fernandez-Sanguinoi Pena",
             description => "Checks whether we can enumerate usernames directly from the web server",
             scan_method => \&nikto_apacheusers,
-            copyright   => "2008 CIRT Inc."
+            copyright   => "2008 CIRT Inc.",
+            options     =>  {
+                                enumerate   => "Flag to indicate whether to attempt to enumerate users",
+                                dictionary  => "Filename for a dictionary file of users",
+                                size        => "Maximum size of username if bruteforcing"
+                            }
             };
     return $id;
@@ -34 +40 @@
 
 sub nikto_apacheusers {
-    my ($mark) = @_;
-    (my $RES, $CONTENT) = nfetch($mark, "/~root", "GET", "", "", "", "apacheusers: known user");
-
-    $CONTENT = char_escape($CONTENT);
-    if ($CONTENT =~ /forbidden/i)    # good on "root"
+    my ($mark, $parameters) = @_;
+    my $apacheusers=0;
+    
+    # First ensure that the server is vulnerable
+    (my $result, $content) = nfetch($mark, "/~root", "GET", "", "", "", "apacheusers: known user");
+
+    $content = char_escape($content);
+    if ($content =~ /forbidden/i)    # good on "root"
     {
-        (my $RES, $CONTENT) = nfetch($mark, "/~" . LW2::utils_randstr(8),
-                                     "GET", "", "", "", "apacheusers: invalid user");
-
-        $CONTENT = char_escape($CONTENT);
-        if ($CONTENT !~ /forbidden/i)    # Good, it gave an error instead of forbidden
+        (my $result, $content) = nfetch($mark, "/~" . LW2::utils_randstr(8),
+                                        "GET", "", "", "", "apacheusers: invalid user");
+
+        $content = char_escape($content);
+        if ($content !~ /forbidden/i)    # Good, it gave an error instead of forbidden
         {
             add_vulnerability(
@@ -55 +64 @@
                 );
         }
-    }
+        $apacheusers=1;
+    }
+    
+    # If we can't enumerate users then return
+    return unless ($apacheusers == 1);
+    # If we haven't been asked to enumerate users then return
+    return unless (defined $parameters->{'enumerate'} &&
+                   $parameters->{'enumerate'} == 1);
+    
+    # Now we can attempt to enumerate the users
+    my ($url, $dictfile, $size);
+    my @cgiwraps;
+    my @cfgcgi = split(/ /, $VARIABLES{"\@CGIDIRS"});
+
+    if (defined $parameters->{'dictionary'}) {
+        $dictfile = $parameters->{'dictionary'};
+    }
+    if (defined $parameters->{'size'}) {
+        $size = $parameters->{'size'};
+    }
+
+    # Set the URL according to the parameters
+    if (defined $parameters->{'cgiwrap'}) {
+
+        # Check for existence of cgiwrap
+        foreach my $cgidir (@CFGCGI) {
+            my $curl = "$cgidir" . "cgiwrap";
+            (my $result, $content) =
+                nfetch($mark, $curl, "GET", "", "", "", "user_enum_apache: cgiwrap");
+            if ($content =~ /check your URL/i) {
+                push(@cgiwraps, "$curl");
+            }
+        }
+
+        foreach my $cgiwrap (@cgiwraps) {
+            $url = "$cgiwrap/~";
+
+            # First check whether we use a dictionary attack of brute force it
+            if (defined $dictfile) {
+
+                # We have options - assume it is a dictionary attack
+                nikto_user_enum_apache_dictionary($url, $mark, $dictfile);
+            }
+            else {
+                nikto_user_enum_apache_brute($url, $mark, $size);
+            }
+        }
+    }
+    else {
+        # Assume we're using ~ if not told to use cgiwrap
+        $url = "/~";
+
+        # First check whether we use a dictionary attack of brute force it
+        if (defined $dictfile) {
+
+            # We have options - assume it is a dictionary attack
+            nikto_user_enum_apache_dictionary($url, $mark, $dictfile);
+        }
+        else {
+            nikto_user_enum_apache_brute($url, $mark, $size);
+        }
+    }
+}
+
+sub nikto_user_enum_apache_brute {
+
+    # Note1: This script only generates names with letters A-Z (no numbers)
+    #
+    # Note2: this script will generate SUM(26^n)(n=$min to $max)
+    # it's probably faster to write this to a file than to generate it
+    # on the fly BTW.
+    #
+    # Of course, it could be optimized to skip some "strange"
+    # combinations of usernames, but hey, then it wouldn't
+    # be 'brute force' would it? (jfs)
+
+    my ($url, $mark, $size) = @_;
+    $size = 5 if ($size eq "");
+    nprint("- Enumerating Apache users (1 to $size characters).", "v");
+
+    my $text    = "a";
+    my $ctr     = 0;
+    my $message = "Valid users found via Apache enumeration: ";
+    my ($result, $content);
+    my @foundusers = ();
+    while (length($text) <= $size) {
+        if (($ctr % 500) eq 0) { nprint("- User enumeration guess $ctr ($text)", "v"); }
+        ($result, $content) =
+          nfetch($mark, $url . $text, "HEAD", "", "", "", "user_enum_apache: enumeration");
+        my $user = nikto_user_enum_apache_check($result, $text);
+        if (defined $user && $user ne "") {
+            push(@foundusers, $user);
+        }
+        $text++;
+        $ctr++;
+    }
+    if (scalar(@foundusers)) {
+        add_vulnerability($mark, $message . join(', ', @foundusers), 999997, "637", "HEAD", "/");
+    }
+
+}
+
+sub nikto_user_enum_apache_dictionary {
+    my ($url, $mark, $filename) = @_;
+    my $message    = "Valid users found via Apache enumeration: ";
+    my @foundusers = ();
+    my ($result, $content);
+    my $ctr = 0;
+
+    nprint("- Enumerating Apache users (using dictionary $filename).", "v");
+    unless (open(IN, "<$filename")) {
+        nprint("+ ERROR: Unable to open dictionary file $filename: $!.");
+    }
+
+    # Now attempt on each entry
+    while (<IN>) {
+        chomp;
+        s/\#.*$//;
+
+        # remove preceding ~ just in case
+        s/^~//;
+        if ($_ eq "") { next }
+        if (($ctr % 500) == 0) { nprint("- User enumeration guess $ctr ($_)", "v"); }
+        ($result, $content) =
+          nfetch($mark, $url . $_, "HEAD", "", "", "", "user_enum_apache: dictionary");
+        my $user = nikto_user_enum_apache_check($result, $_);
+        if ($user) {
+            push(@foundusers, $user);
+        }
+        $ctr++;
+    }
+    close(IN);
+    if (scalar(@foundusers)) {
+        add_vulnerability($mark, $message . join(', ', @foundusers), 999997, "637", "HEAD", "/");
+    }
+}
+
+sub nikto_user_enum_apache_check {
+    (my $code, $user) = @_;
+    my $result = "";
+
+    foreach my $found (split(/ /, $VARIABLES{"\@HTTPFOUND"})) {
+        if ($code eq $found) {
+            $result = $user;
+            last;
+        }
+    }
+
+    return $result;
 }
 
 1;
+

trunk/plugins/nikto_core.plugin

@@ -2579 +2579 @@
         nprint(" $plugin->{'full_name'} - $plugin->{'description'}");
         nprint(" Written by $plugin->{'author'}, Copyright (C) $plugin->{'copyright'}");
+        if (defined $plugin->{'options'}) {
+            nprint(" Options:");
+            while (my ($option, $description) = each(%{$plugin->{'options'}})) {
+                nprint("  $option: $description");
+            }
+        }
         nprint("\n");
     }

trunk/plugins/nikto_tests.plugin

@@ -22 +22 @@
 ###############################################################################
 sub nikto_tests_init {
-    my $id = { name        => "Tests",
+    my $id = { name        => "tests",
                full_name   => "Nikto Tests",
                author      => "Sullo, Deity",
@@ -29 +29 @@
                scan_method => \&nikto_tests,
                scan_weight => 99,
+               options     =>   {   passfiles   => "Flag to indicate whether to check for common password files",  
+                                    all         => "Flag to indicate whether to check all files with all directories"
+                                }
                };
     return $id;