r00t-3xp10it

RC-EXPLOITER V1.1.0 -> heartbleed+poodle logfiles

Apr 26th, 2015
436
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
R 16.34 KB | None | 0 0
  1. # This paste its a simple display of 'ssl.rc' exploiter module (logfile)
  2. # and it will seach for heartbleed and poodle vulnerabilitys...
  3.  
  4. # -----------------------------------------------------
  5. # 1º set scan (searching in WAN for port 443 SSL-HTTPS)
  6. # -----------------------------------------------------
  7. Nmap scan report for h2161561.stratoserver.net (81.169.188.156)
  8. Host is up, received user-set (0.072s latency).
  9. PORT    STATE SERVICE REASON
  10. 443/tcp open  https   syn-ack
  11.  
  12. Nmap scan report for a104-74-162-14.deploy.static.akamaitechnologies.com (104.74.162.14)
  13. Host is up, received user-set (0.31s latency).
  14. PORT    STATE SERVICE REASON
  15. 443/tcp open  https   syn-ack
  16.  
  17. Nmap scan report for 12.68.90.116
  18. Host is up, received user-set (0.16s latency).
  19. PORT    STATE SERVICE REASON
  20. 443/tcp open  https   syn-ack
  21.  
  22. Nmap scan report for node-tst.pool-125-26.dynamic.totbb.net (125.26.150.221)
  23. Host is up, received user-set (0.33s latency).
  24. PORT    STATE SERVICE REASON
  25. 443/tcp open  https   syn-ack
  26.  
  27. Nmap scan report for www.NexQloud.com (207.192.165.180)
  28. Host is up, received user-set (0.060s latency).
  29. PORT    STATE SERVICE REASON
  30. 443/tcp open  https   syn-ack
  31.  
  32. Nmap scan report for 87.116.3.182
  33. Host is up, received user-set (0.071s latency).
  34. PORT    STATE SERVICE REASON
  35. 443/tcp open  https   syn-ack
  36.  
  37. Nmap scan report for 192-184-172-1.dsl.dynamic.sonic.net (192.184.172.1)
  38. Host is up, received user-set (0.21s latency).
  39. PORT    STATE SERVICE REASON
  40. 443/tcp open  https   syn-ack
  41.  
  42. Nmap scan report for 104.194.3.72
  43. Host is up, received user-set (0.19s latency).
  44. PORT    STATE SERVICE REASON
  45. 443/tcp open  https   syn-ack
  46.  
  47. Nmap scan report for server-54-192-195-33.iad53.r.cloudfront.net (54.192.195.33)
  48. Host is up, received user-set (0.22s latency).
  49. PORT    STATE SERVICE REASON
  50. 443/tcp open  https   syn-ack
  51.  
  52. Nmap scan report for 162-234-160-245.lightspeed.dybhfl.sbcglobal.net (162.234.160.245)
  53. Host is up, received user-set (0.18s latency).
  54. PORT    STATE SERVICE REASON
  55. 443/tcp open  https   syn-ack
  56.  
  57. Nmap scan report for 205.193.192.33
  58. Host is up, received user-set (0.13s latency).
  59. PORT    STATE SERVICE REASON
  60. 443/tcp open  https   syn-ack
  61.  
  62. Nmap scan report for dhe-118-91-130-54.static.dhecyber.net.id (118.91.130.54)
  63. Host is up, received user-set (0.49s latency).
  64. PORT    STATE SERVICE REASON
  65. 443/tcp open  https   syn-ack
  66.  
  67. Nmap scan report for 63.237.180.19
  68. Host is up, received user-set (0.20s latency).
  69. PORT    STATE SERVICE REASON
  70. 443/tcp open  https   syn-ack
  71.  
  72. Nmap scan report for mail.ken.dk (77.243.39.210)
  73. Host is up, received user-set (0.077s latency).
  74. PORT    STATE SERVICE REASON
  75. 443/tcp open  https   syn-ack
  76.  
  77. Nmap scan report for bus219-062.gsb.columbia.edu (128.59.219.62)
  78. Host is up, received user-set (0.12s latency).
  79. PORT    STATE SERVICE REASON
  80. 443/tcp open  https   syn-ack
  81.  
  82.  
  83. # -----------------------------------------------------
  84. # 2º step scans (scan for heartbleed)
  85. # -----------------------------------------------------
  86. # Nmap 6.46 scan initiated Sat May  2 04:24:55 2015 as: nmap -n -sS -Pn -oN /home/pedr0/RC-exploiter/logs/heartbleed.log --script ssl-ccs-injection.nse,ssl-heartbleed.nse --script-args vulns.showall -p 443 94.199.178.215 191.241.91.21 192.116.71.163 90.176.170.46
  87. Nmap scan report for 94.199.178.215
  88. Host is up (0.078s latency).
  89. PORT    STATE SERVICE
  90. 443/tcp open  https
  91. |_ssl-ccs-injection: ERROR: Script execution failed (use -d to debug)
  92. | ssl-heartbleed:
  93. |   NOT VULNERABLE:
  94. |   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
  95. |     State: NOT VULNERABLE
  96. |     References:
  97. |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
  98. |       http://www.openssl.org/news/secadv_20140407.txt
  99. |_      http://cvedetails.com/cve/2014-0160/
  100.  
  101. Nmap scan report for 191.241.91.21
  102. Host is up (0.35s latency).
  103. PORT    STATE SERVICE
  104. 443/tcp open  https
  105. |_ssl-ccs-injection: ERROR: Script execution failed (use -d to debug)
  106. | ssl-heartbleed:
  107. |   NOT VULNERABLE:
  108. |   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
  109. |     State: NOT VULNERABLE
  110. |     References:
  111. |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
  112. |       http://www.openssl.org/news/secadv_20140407.txt
  113. |_      http://cvedetails.com/cve/2014-0160/
  114.  
  115. Nmap scan report for 192.116.71.163
  116. Host is up (0.12s latency).
  117. PORT    STATE SERVICE
  118. 443/tcp open  https
  119. |_ssl-ccs-injection: ERROR: Script execution failed (use -d to debug)
  120. | ssl-heartbleed:
  121. |   NOT VULNERABLE:
  122. |   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
  123. |     State: NOT VULNERABLE
  124. |     References:
  125. |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
  126. |       http://www.openssl.org/news/secadv_20140407.txt
  127. |_      http://cvedetails.com/cve/2014-0160/
  128.  
  129. Nmap scan report for 90.176.170.46
  130. Host is up (0.088s latency).
  131. PORT    STATE SERVICE
  132. 443/tcp open  https
  133. |_ssl-ccs-injection: ERROR: Script execution failed (use -d to debug)
  134. | ssl-heartbleed:
  135. |   NOT VULNERABLE:
  136. |   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
  137. |     State: NOT VULNERABLE
  138. |     References:
  139. |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
  140. |       http://www.openssl.org/news/secadv_20140407.txt
  141. |_      http://cvedetails.com/cve/2014-0160/
  142.  
  143. # Nmap done at Sat May  2 04:24:59 2015 -- 4 IP addresses (4 hosts up) scanned in 4.35 seconds
  144.  
  145.  
  146. # -----------------------------------------------------
  147. # 3º step scans (scan ssl related)
  148. # -----------------------------------------------------
  149. # Nmap 6.46 scan initiated Sat May  2 04:25:00 2015 as: nmap -T4 -sS -Pn -oN /home/pedr0/RC-exploiter/logs/[ssl]report.log --script ssl-poodle.nse,ssl-cert.nse,ssl-enum-ciphers.nse,dns-brute.nse,ip-geolocation-geoplugin.nse -p 443 94.199.178.215 191.241.91.21 192.116.71.163 90.176.170.46
  150. Nmap scan report for sinope.laxius.hu (94.199.178.215)
  151. Host is up (0.076s latency).
  152. PORT    STATE SERVICE
  153. 443/tcp open  https
  154. | ssl-cert: Subject: commonName=sinope.laxius.hu/organizationName=Bluecast Kft/stateOrProvinceName=Budapest/countryName=HU
  155. | Issuer: commonName=sinope.laxius.hu/organizationName=Bluecast Kft/stateOrProvinceName=Budapest/countryName=HU
  156. | Public Key type: rsa
  157. | Public Key bits: 2048
  158. | Not valid before: 2011-02-10T02:26:47+00:00
  159. | Not valid after:  2012-02-10T02:26:47+00:00
  160. | MD5:   1e66 4701 d51d 1246 13dc 7369 a558 e029
  161. |_SHA-1: 9614 7082 0b33 ebb5 8b45 9495 fe37 68ba ce5f 8fa9
  162. | ssl-enum-ciphers:
  163. |   SSLv3:
  164. |     ciphers:
  165. |       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
  166. |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
  167. |       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
  168. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
  169. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
  170. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
  171. |       TLS_RSA_WITH_RC4_128_MD5 - strong
  172. |       TLS_RSA_WITH_RC4_128_SHA - strong
  173. |     compressors:
  174. |       DEFLATE
  175. |       NULL
  176. |   TLSv1.0:
  177. |     ciphers:
  178. |       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
  179. |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
  180. |       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
  181. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
  182. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
  183. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
  184. |       TLS_RSA_WITH_RC4_128_MD5 - strong
  185. |       TLS_RSA_WITH_RC4_128_SHA - strong
  186. |     compressors:
  187. |       DEFLATE
  188. |       NULL
  189. |_  least strength: strong
  190. | ssl-poodle:
  191. |   VULNERABLE:
  192. |   SSL POODLE information leak
  193. |     State: VULNERABLE
  194. |     IDs:  CVE:CVE-2014-3566  OSVDB:113251
  195. |     Description:
  196. |           The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and
  197. |           other products, uses nondeterministic CBC padding, which makes it easier
  198. |           for man-in-the-middle attackers to obtain cleartext data via a
  199. |           padding-oracle attack, aka the "POODLE" issue.
  200. |     Disclosure date: 2014-10-14
  201. |     Check results:
  202. |       TLS_RSA_WITH_AES_128_CBC_SHA
  203. |     References:
  204. |       https://www.imperialviolet.org/2014/10/14/poodle.html
  205. |       http://osvdb.org/113251
  206. |       https://www.openssl.org/~bodo/ssl-poodle.pdf
  207. |_      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
  208.  
  209. Host script results:
  210. | dns-brute:
  211. |   DNS Brute-force hostnames:
  212. |     ns1.laxius.hu - 94.199.178.213
  213. |     ns2.laxius.hu - 79.172.201.40
  214. |     www.laxius.hu - 94.199.178.214
  215. |     stage.laxius.hu - 94.199.178.214
  216. |     admin.laxius.hu - 94.199.178.214
  217. |     mail.laxius.hu - 94.199.178.183
  218. |     backup.laxius.hu - 86.101.164.79
  219. |_    ftp.laxius.hu - 94.199.178.214
  220. | ip-geolocation-geoplugin:
  221. | 94.199.178.215
  222. |   coordinates (lat,lon): 47,20
  223. |_  state: Unknown, Hungary
  224.  
  225. Nmap scan report for 191-241-91-21.pequinet.net.br (191.241.91.21)
  226. Host is up (0.40s latency).
  227. PORT    STATE SERVICE
  228. 443/tcp open  https
  229. | ssl-cert: Subject: commonName=UBNT/organizationName=Ubiquiti Networks Inc./stateOrProvinceName=CA/countryName=US
  230. | Issuer: commonName=UBNT/organizationName=Ubiquiti Networks Inc./stateOrProvinceName=CA/countryName=US
  231. | Public Key type: rsa
  232. | Public Key bits: 1024
  233. | Not valid before: 2011-06-02T07:35:02+00:00
  234. | Not valid after:  2020-01-01T08:35:02+00:00
  235. | MD5:   6863 bbff 0501 4b31 193a c2d5 f0c7 5dc6
  236. |_SHA-1: eb54 c44a 32a6 4497 d892 6ff8 7ba7 08f9 6fb0 bff3
  237. | ssl-enum-ciphers:
  238. |   SSLv3:
  239. |     ciphers:
  240. |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
  241. |       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
  242. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
  243. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
  244. |       TLS_RSA_WITH_RC4_128_MD5 - strong
  245. |       TLS_RSA_WITH_RC4_128_SHA - strong
  246. |     compressors:
  247. |       NULL
  248. |   TLSv1.0:
  249. |     ciphers:
  250. |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
  251. |       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
  252. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
  253. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
  254. |       TLS_RSA_WITH_RC4_128_MD5 - strong
  255. |       TLS_RSA_WITH_RC4_128_SHA - strong
  256. |     compressors:
  257. |       NULL
  258. |_  least strength: strong
  259. |_ssl-poodle: ERROR: Script execution failed (use -d to debug)
  260.  
  261. Host script results:
  262. | dns-brute:
  263. |   DNS Brute-force hostnames:
  264. |     ns1.pequinet.net.br - 191.241.88.69
  265. |_    ns2.pequinet.net.br - 191.241.88.70
  266. | ip-geolocation-geoplugin:
  267. | 191.241.91.21
  268. |   coordinates (lat,lon): -10,-55
  269. |_  state: Unknown, Brazil
  270.  
  271. Nmap scan report for fish.spd.co.il (192.116.71.163)
  272. Host is up (0.12s latency).
  273. PORT    STATE SERVICE
  274. 443/tcp open  https
  275.  
  276. Host script results:
  277. | dns-brute:
  278. |   DNS Brute-force hostnames:
  279. |     devel.spd.co.il - 80.179.148.11
  280. |     ads.spd.co.il - 80.178.250.110
  281. |     alerts.spd.co.il - 80.179.148.241
  282. |     dns.spd.co.il - 212.199.164.176
  283. |     mysql.spd.co.il - 212.199.163.164
  284. |     apache.spd.co.il - 212.199.163.165
  285. |     test.spd.co.il - 62.128.51.141
  286. |     id.spd.co.il - 212.199.125.110
  287. |     images.spd.co.il - 192.116.109.20
  288. |     ns.spd.co.il - 212.199.164.175
  289. |     mail.spd.co.il - 62.128.51.251
  290. |     mirror.spd.co.il - 212.199.164.166
  291. |     monitor.spd.co.il - 80.179.148.11
  292. |     ns1.spd.co.il - 212.199.164.175
  293. |     ns2.spd.co.il - 80.179.148.8
  294. |     ns3.spd.co.il - 37.58.74.30
  295. |     pbx.spd.co.il - 62.128.59.129
  296. |     secure.spd.co.il - 192.116.109.192
  297. |     smtp.spd.co.il - 80.179.55.190
  298. |     squid.spd.co.il - 212.199.163.170
  299. |     vpn.spd.co.il - 62.128.59.133
  300. |     ssl.spd.co.il - 192.116.109.20
  301. |     whois.spd.co.il - 192.116.109.20
  302. |     wiki.spd.co.il - 80.178.250.103
  303. |_    www.spd.co.il - 192.230.82.105
  304. | ip-geolocation-geoplugin:
  305. | 192.116.71.163
  306. |   coordinates (lat,lon): 31.5,34.75
  307. |_  state: Unknown, Israel
  308.  
  309. Nmap scan report for 46-170-176-90.vybezek.net (90.176.170.46)
  310. Host is up (0.078s latency).
  311. PORT    STATE SERVICE
  312. 443/tcp open  https
  313. | ssl-cert: Subject: commonName=Spravce/organizationName=ZSSluknov/stateOrProvinceName=Some-State/countryName=CZ
  314. | Issuer: commonName=Spravce/organizationName=ZSSluknov/stateOrProvinceName=Some-State/countryName=CZ
  315. | Public Key type: rsa
  316. | Public Key bits: 1024
  317. | Not valid before: 2011-02-04T09:47:50+00:00
  318. | Not valid after:  2013-01-24T09:47:50+00:00
  319. | MD5:   bb3f 65a4 d18d 4875 6219 4fe6 e914 e9e1
  320. |_SHA-1: 025b 70e3 90c4 f202 f7ac e95a dc7b 943d 72de 2684
  321. | ssl-enum-ciphers:
  322. |   SSLv3:
  323. |     ciphers:
  324. |       TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA - weak
  325. |       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
  326. |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
  327. |       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
  328. |       TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
  329. |       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
  330. |       TLS_DHE_RSA_WITH_DES_CBC_SHA - weak
  331. |       TLS_RSA_EXPORT_WITH_DES40_CBC_SHA - weak
  332. |       TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - weak
  333. |       TLS_RSA_EXPORT_WITH_RC4_40_MD5 - weak
  334. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
  335. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
  336. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
  337. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
  338. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
  339. |       TLS_RSA_WITH_DES_CBC_SHA - weak
  340. |       TLS_RSA_WITH_RC4_128_MD5 - strong
  341. |       TLS_RSA_WITH_RC4_128_SHA - strong
  342. |     compressors:
  343. |       NULL
  344. |   TLSv1.0:
  345. |     ciphers:
  346. |       TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA - weak
  347. |       TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
  348. |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
  349. |       TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
  350. |       TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
  351. |       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
  352. |       TLS_DHE_RSA_WITH_DES_CBC_SHA - weak
  353. |       TLS_RSA_EXPORT_WITH_DES40_CBC_SHA - weak
  354. |       TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - weak
  355. |       TLS_RSA_EXPORT_WITH_RC4_40_MD5 - weak
  356. |       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
  357. |       TLS_RSA_WITH_AES_128_CBC_SHA - strong
  358. |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
  359. |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
  360. |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
  361. |       TLS_RSA_WITH_DES_CBC_SHA - weak
  362. |       TLS_RSA_WITH_RC4_128_MD5 - strong
  363. |       TLS_RSA_WITH_RC4_128_SHA - strong
  364. |     compressors:
  365. |       NULL
  366. |_  least strength: weak
  367. | ssl-poodle:
  368. |   VULNERABLE:
  369. |   SSL POODLE information leak
  370. |     State: VULNERABLE
  371. |     IDs:  CVE:CVE-2014-3566  OSVDB:113251
  372. |     Description:
  373. |           The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and
  374. |           other products, uses nondeterministic CBC padding, which makes it easier
  375. |           for man-in-the-middle attackers to obtain cleartext data via a
  376. |           padding-oracle attack, aka the "POODLE" issue.
  377. |     Disclosure date: 2014-10-14
  378. |     Check results:
  379. |       TLS_RSA_WITH_AES_128_CBC_SHA
  380. |     References:
  381. |       https://www.imperialviolet.org/2014/10/14/poodle.html
  382. |       http://osvdb.org/113251
  383. |       https://www.openssl.org/~bodo/ssl-poodle.pdf
  384. |_      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
  385.  
  386. Host script results:
  387. | dns-brute:
  388. |   DNS Brute-force hostnames:
  389. |     mx.vybezek.net - 86.63.210.53
  390. |     ns.vybezek.net - 86.63.210.2
  391. |     ns1.vybezek.net - 86.63.210.2
  392. |     test.vybezek.net - 86.63.210.3
  393. |     ns2.vybezek.net - 86.63.210.4
  394. |     intranet.vybezek.net - 86.63.210.6
  395. |     mail.vybezek.net - 86.63.210.52
  396. |     mail.vybezek.net - 86.63.210.4
  397. |     mail2.vybezek.net - 86.63.210.40
  398. |     www.vybezek.net - 86.63.210.3
  399. |     mail3.vybezek.net - 86.63.210.40
  400. |     sip.vybezek.net - 213.168.162.150
  401. |     smtp.vybezek.net - 86.63.210.40
  402. |     ftp.vybezek.net - 86.63.210.3
  403. |     gw.vybezek.net - 86.63.210.1
  404. |_    db.vybezek.net - 86.63.210.7
  405. | ip-geolocation-geoplugin:
  406. | 90.176.170.46
  407. |   coordinates (lat,lon): 49.75,15.5
  408. |_  state: Unknown, Czech Republic
  409.  
  410. # Nmap done at Sat May  2 04:25:35 2015 -- 4 IP addresses (4 hosts up) scanned in 35.00 seconds
  411.  
  412.  
  413. # -----------------------------------------------------
  414. # 4º step scans (scan/brute-force-exploit) using
  415. # metasploit auxiliary modules
  416. # -----------------------------------------------------
  417.  
  418. soon will be printed ...
Advertisement
Add Comment
Please, Sign In to add comment