Description
This module collects credentials and setup information from Tenable Security Center. root or TNS user permissions are required. We don't utilize SC's builtin backup functionality as that requires SC to be shut down. The module works in 2 phases:
Phase 1: gather all passwords which can be decrypted. These are non-user ones such as credentials used for scans, creds for the Nessus servers, SMTP, etc.
Phase 2: handle hashed passwords processing. SC uses SHA-512 and PBKDF2 according to the documentation, but the implementation (salt+hash vs hash+salt) is unknown due to the source code being protected by SourceGuardian. To get around this, we use a php script on server to brute force the passwords. Note this will use SC's resources. The crack attempt rate is ~6/sec on a test instance, so you'll want a small password list.
Tested against SC 6.7.2 on RHEL9
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use post/linux/gather/tenable/security_centermsf undefined(security_center) > show actions ...actions...msf undefined(security_center) > set ACTION < action-name >msf undefined(security_center) > show options ...show and set options...msf undefined(security_center) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub