Skip to content

Commit 226ded8

Browse files
pbarry-r7pbarry-r7
committed
Land rapid7#6921, Support basic and form auth at the same time
2 parents 53f209f + ae1ffa5 commit 226ded8

File tree

96 files changed

+332
-249
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

96 files changed

+332
-249
lines changed

‎lib/metasploit/framework/login_scanner/axis2.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ class Axis2 < HTTP
1717
# (see Base#attempt_login)
1818
def attempt_login(credential)
1919
http_client = Rex::Proto::Http::Client.new(
20-
host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies
20+
host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies, http_username, http_password
2121
)
2222

2323
configure_http_client(http_client)

‎lib/metasploit/framework/login_scanner/buffalo.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ def attempt_login(credential)
3434
result_opts[:service_name] = 'http'
3535
end
3636
begin
37-
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version)
37+
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, http_username, http_password)
3838
configure_http_client(cli)
3939
cli.connect
4040
req = cli.request_cgi({

‎lib/metasploit/framework/login_scanner/chef_webui.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ def check_setup
6969
# @param (see Rex::Proto::Http::Resquest#request_raw)
7070
# @return [Rex::Proto::Http::Response] The HTTP response
7171
def send_request(opts)
72-
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => self}, ssl, ssl_version, proxies)
72+
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => self}, ssl, ssl_version, proxies, http_username, http_password)
7373
configure_http_client(cli)
7474
cli.connect
7575
req = cli.request_raw(opts)

‎lib/metasploit/framework/login_scanner/gitlab.rb

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,9 @@ def attempt_login(credential)
3535
},
3636
ssl,
3737
ssl_version,
38-
proxies)
38+
proxies,
39+
http_username,
40+
http_password)
3941
configure_http_client(cli)
4042
cli.connect
4143

‎lib/metasploit/framework/login_scanner/glassfish.rb

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,13 @@ class Glassfish < HTTP
2020
# @return [String] Cookie session
2121
attr_accessor :jsession
2222

23+
# @!attribute http_username
24+
attr_accessor :http_username
25+
# @return [String] HTTP username
26+
27+
# @!attribute http_password
28+
attr_accessor :http_password
29+
2330
# (see Base#check_setup)
2431
def check_setup
2532
begin
@@ -61,7 +68,7 @@ def check_setup
6168
# @param (see Rex::Proto::Http::Resquest#request_raw)
6269
# @return [Rex::Proto::Http::Response] The HTTP response
6370
def send_request(opts)
64-
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies)
71+
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies, http_username, http_password)
6572
configure_http_client(cli)
6673
cli.connect
6774
req = cli.request_raw(opts)

‎lib/metasploit/framework/login_scanner/http.rb

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,14 @@ class HTTP
161161
# @return [Boolean] Whether to conform to IIS digest authentication mode.
162162
attr_accessor :digest_auth_iis
163163

164+
# @!attribute http_username
165+
# @return [String]
166+
attr_accessor :http_username
167+
168+
# @!attribute http_password
169+
# @return [String]
170+
attr_accessor :http_password
171+
164172

165173
validates :uri, presence: true, length: { minimum: 1 }
166174

@@ -171,7 +179,7 @@ class HTTP
171179
# (see Base#check_setup)
172180
def check_setup
173181
http_client = Rex::Proto::Http::Client.new(
174-
host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies
182+
host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies, http_username, http_password
175183
)
176184
request = http_client.request_cgi(
177185
'uri' => uri,
@@ -213,8 +221,8 @@ def send_request(opts)
213221
cli_ssl = opts['ssl'] || ssl
214222
cli_ssl_version = opts['ssl_version'] || ssl_version
215223
cli_proxies = opts['proxies'] || proxies
216-
username = opts['credential'] ? opts['credential'].public : ''
217-
password = opts['credential'] ? opts['credential'].private : ''
224+
username = opts['credential'] ? opts['credential'].public : http_username
225+
password = opts['credential'] ? opts['credential'].private : http_password
218226
realm = opts['credential'] ? opts['credential'].realm : nil
219227
context = opts['context'] || { 'Msf' => framework, 'MsfExploit' => framework_module}
220228

‎lib/metasploit/framework/login_scanner/ipboard.rb

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,18 @@ module LoginScanner
77
# IP Board login scanner
88
class IPBoard < HTTP
99

10+
# @!attribute http_username
11+
# @return [String]
12+
attr_accessor :http_username
13+
14+
# @!attribute http_password
15+
# @return [String]
16+
attr_accessor :http_password
17+
1018
# (see Base#attempt_login)
1119
def attempt_login(credential)
1220
http_client = Rex::Proto::Http::Client.new(
13-
host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies
21+
host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies, self.http_username, self.http_password
1422
)
1523
configure_http_client(http_client)
1624

‎lib/metasploit/framework/login_scanner/jenkins.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ def attempt_login(credential)
3737
result_opts[:service_name] = 'http'
3838
end
3939
begin
40-
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies)
40+
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies, http_username, http_password)
4141
configure_http_client(cli)
4242
cli.connect
4343
req = cli.request_cgi({

‎lib/metasploit/framework/login_scanner/mybook_live.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ def attempt_login(credential)
3535
begin
3636
cred = Rex::Text.uri_encode(credential.private)
3737
body = "data%5BLogin%5D%5Bowner_name%5D=admin&data%5BLogin%5D%5Bowner_passwd%5D=#{cred}"
38-
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version)
38+
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, http_username, http_password)
3939
configure_http_client(cli)
4040
cli.connect
4141
req = cli.request_cgi(

‎lib/metasploit/framework/login_scanner/smh.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ def attempt_login(credential)
3333
res = nil
3434

3535
begin
36-
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies)
36+
cli = Rex::Proto::Http::Client.new(host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies, http_username, http_password)
3737
configure_http_client(cli)
3838
cli.connect
3939
req = cli.request_cgi(req_opts)

0 commit comments

Comments
 (0)