Identifying Customized Port about changeme

[ztgrace]

Thanks for the issue. I agree changeme should have the ability to detect default credentials on alternate ports, but I think we need to be careful. For example, I'm using this tool to scan more than 10k web services and this would add 100k extra requests just for this service.

I originally opened issue #3 with this in mind. My feeling is that when we start to get out to uncommon ports, I'd rather have the tool feed off of nmap input. For example, say we scan a system and the Server header on 8000 contains Apache Tomcat, with a fuzzier fingerprinting mechanism, we would swap out the default port for 8000.

Would functionality like that meet your needs?

[ranjithprethan]

Hi Ztgrace, Thanks.

For example : If Apache Tomcat runs on 8000, changeme should first check for default port 8080, if the web service is not running in a default port then it should check for other ports as well before loading all the default credentials.

Feeding nmap result is an alternate solution, If we want to scan 10-15 IP addresses at one time, It would be useful if changeme has the capability to detect the web service in alternate ports.

Thanks.

[iamtutu]

what if a provided list file which contains IP:PORT is parsed as input to be scanned ?

[ranjithprethan]

Far-loop or list file are the way forward. Otherwise we need to do a port scan which is not a ideal solution. If anyone is written the code, please share. Thanks

[ztgrace]

@iamtutu @ranjithprethan I'm trying to understand the request here. Are you looking for an option that would try all credentials on all ports? The process is broken down into two phases, fingerprint and auth attempts. I can see adding an option to force fingerprinting on all ports specified in the targets and if the fingerprint matches, scan it for default creds. Does that cover what you're looking for?

@ranjithprethan for any large scans nmap will be a way more efficient port scanner than changeme.

[ranjithprethan]

@ztgrace that's exactly the same I am looking for. Because In most of the web server environment the http/https service runs on custom or non standard port. can you please share the new code? Thanks

[ztgrace]

I'll include this feature in the 1.0 release which is scheduled for the end of September. Until then, you can make multiple copies of the credential files each with a different port.

[ztgrace]

The changeme version in the development branch (https://github.com/ztgrace/changeme/tree/development) now features a --portoverride option that forces changeme to use the supplied port for all protocols.

Here's what the new option looks like:

./changeme.py -d --protocols http,snmp --portoverride --dryrun 127.0.0.1:11111
...snip...
[07:43:31][scan_engine][_build_targets] Configured protocols: ['http', 'snmp']
[07:43:32][scan_engine][dry_run] Dry run URLs:
http://127.0.0.1:11111/admin-console/login.seam
https://127.0.0.1:11111/
http://127.0.0.1:11111/tomcat/manager/html
http://127.0.0.1:11111/nexus/
snmp://127.0.0.1:11111
http://127.0.0.1:11111/opscenter/login.html
http://127.0.0.1:11111/zabbix/index.php
http://127.0.0.1:11111/rest/html/management/dashboards
http://127.0.0.1:11111/logon.htm
http://127.0.0.1:11111/manager/html
http://127.0.0.1:11111/
http://127.0.0.1:11111/jasperserver/login.html
http://127.0.0.1:11111/login.htm
http://127.0.0.1:11111/SingleSignOn/SignIn.aspx?SsoProductCode=npc&SsoRedirectUrl=%2fnpc%2fdefault.aspx
http://127.0.0.1:11111/web/guest/en/websys/webArch/authForm.cgi
https://127.0.0.1:11111/com.netezza.portal.Portal/index.html
http://127.0.0.1:11111/admin/password.html
http://127.0.0.1:11111/prop.htm
https://127.0.0.1:11111/opscenter/
http://127.0.0.1:11111/TeleoptiWFM/Administration/
https://127.0.0.1:11111/hp/device/this.LCDispatcher?dispatch=html&cat=1&pos=3
http://127.0.0.1:11111/
snmp://127.0.0.1:11111
http://127.0.0.1:11111/eng/liveView.cgi
http://127.0.0.1:11111/login.html
http://127.0.0.1:11111/console/login/LoginForm.jsp
http://127.0.0.1:11111/rps/
https://127.0.0.1:11111/hp/device/this.LCDispatcher?nav=hp.Security
https://127.0.0.1:11111/hp/device/GeneralSecurity/Index
https://127.0.0.1:11111/login.html
http://127.0.0.1:11111/header.php?tab=status
http://127.0.0.1:11111/
https://127.0.0.1:11111/login
http://127.0.0.1:11111/console/portal/Server/Web%20Server
https://127.0.0.1:11111/hp/device/this.LCDispatcher?dispatch=html&cat=1&pos=4

This version will be merged into master sometime next week.

Cheers,
Zach