3
3
module Metasploit
4
4
module Framework
5
5
module LoginScanner
6
-
7
6
# Gitlab login scanner
8
7
class Gitlab < HTTP
9
-
10
8
# Inherit LIKELY_PORTS,LIKELY_SERVICE_NAMES, and REALM_KEY from HTTP
11
9
CAN_GET_SESSION = false
12
10
DEFAULT_PORT = 80
13
11
PRIVATE_TYPES = [ :password ]
14
12
15
13
# (see Base#set_sane_defaults)
16
14
def set_sane_defaults
17
- self . uri = '/users/sign_in' if self . uri . nil?
18
- self . method = 'POST' if self . method . nil
15
+ self . uri = '/users/sign_in' if uri . nil?
16
+ self . method = 'POST' if method . nil
19
17
20
18
super
21
19
end
22
20
23
21
def attempt_login ( credential )
24
22
result_opts = {
25
- credential : credential ,
26
- host : host ,
27
- port : port ,
28
- protocol : 'tcp' ,
29
- service_name : ssl ? 'https' : 'http'
23
+ credential : credential ,
24
+ host : host ,
25
+ port : port ,
26
+ protocol : 'tcp' ,
27
+ service_name : ssl ? 'https' : 'http'
30
28
}
31
29
begin
32
30
cli = Rex ::Proto ::Http ::Client . new ( host ,
@@ -42,11 +40,11 @@ def attempt_login(credential)
42
40
cli . connect
43
41
44
42
# Get a valid session cookie and authenticity_token for the next step
45
- req = cli . request_cgi ( {
43
+ req = cli . request_cgi (
46
44
'method' => 'GET' ,
47
45
'cookie' => 'request_method=GET' ,
48
- 'uri' => self . uri
49
- } )
46
+ 'uri' => uri
47
+ )
50
48
51
49
res = cli . send_recv ( req )
52
50
@@ -55,20 +53,20 @@ def attempt_login(credential)
55
53
elsif res . body . include? 'user[login]'
56
54
user_field = 'user[login]'
57
55
else
58
- raise RuntimeError , 'Not a valid Gitlab login page'
56
+ fail RuntimeError , 'Not a valid Gitlab login page'
59
57
end
60
58
61
59
local_session_cookie = res . get_cookies . scan ( /(_gitlab_session=[A-Za-z0-9%-]+)/ ) . flatten [ 0 ]
62
60
auth_token = res . body . scan ( /<input name="authenticity_token" type="hidden" value="(.*?)"/ ) . flatten [ 0 ]
63
61
64
- raise RuntimeError , 'Unable to get Session Cookie' unless local_session_cookie
65
- raise RuntimeError , 'Unable to get Authentication Token' unless auth_token
62
+ fail RuntimeError , 'Unable to get Session Cookie' unless local_session_cookie
63
+ fail RuntimeError , 'Unable to get Authentication Token' unless auth_token
66
64
67
65
# Perform the actual login
68
- req = cli . request_cgi ( {
66
+ req = cli . request_cgi (
69
67
'method' => 'POST' ,
70
68
'cookie' => local_session_cookie ,
71
- 'uri' => self . uri ,
69
+ 'uri' => uri ,
72
70
'vars_post' =>
73
71
{
74
72
'utf8' => "\xE2 \x9C \x93 " ,
@@ -77,7 +75,7 @@ def attempt_login(credential)
77
75
'user[password]' => credential . private ,
78
76
'user[remember_me]' => 0
79
77
}
80
- } )
78
+ )
81
79
82
80
res = cli . send_recv ( req )
83
81
if res && res . code == 302
0 commit comments