Skip to content

Commit 3e30453

Browse files
author
Tod Beardsley
committed
Land rapid7#3554, Typo3 mixin specs
2 parents a0a2fdd + ef12a63 commit 3e30453

File tree

2 files changed

+153
-2
lines changed

2 files changed

+153
-2
lines changed

‎lib/msf/http/typo3/login.rb

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,20 @@ def typo3_backend_login(user, pass)
1818
return nil
1919
end
2020

21-
e = res_main.body.match(/<input type="hidden" id="rsa_e" name="e" value="(\d+)" \/>/)[1]
22-
n = res_main.body.match(/<input type="hidden" id="rsa_n" name="n" value="(\w+)" \/>/)[1]
21+
e_match = res_main.body.match(/<input type="hidden" id="rsa_e" name="e" value="(\d+)" \/>/)
22+
if e_match.nil?
23+
vprint_error('Can not find rsa_e value')
24+
return nil
25+
end
26+
e = e_match[1]
27+
28+
n_match = res_main.body.match(/<input type="hidden" id="rsa_n" name="n" value="(\w+)" \/>/)
29+
if n_match.nil?
30+
vprint_error('Can not find rsa_n value')
31+
return nil
32+
end
33+
n = n_match[1]
34+
2335
vprint_debug("e: #{e}")
2436
vprint_debug("n: #{n}")
2537
rsa_enc = typo3_helper_login_rsa(e, n, pass)

‎spec/lib/msf/http/typo3_spec.rb

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
# -*- coding:binary -*-
2+
require 'spec_helper'
3+
4+
require 'msf/core'
5+
require 'rex/proto/http/response'
6+
require 'msf/http/typo3'
7+
8+
describe Msf::HTTP::Typo3 do
9+
subject do
10+
mod = ::Msf::Module.new
11+
mod.extend described_class
12+
mod
13+
end
14+
15+
let(:invalid_user) do
16+
"invalid"
17+
end
18+
19+
let(:invalid_password) do
20+
"invalid"
21+
end
22+
23+
let(:valid_user) do
24+
"admin"
25+
end
26+
27+
let(:valid_password) do
28+
"password"
29+
end
30+
31+
let(:valid_cookie) do
32+
"be_typo_user=e31843639e5e17b9600602f9378b6ff0"
33+
end
34+
35+
describe '#target_uri' do
36+
it 'returns an URI' do
37+
expect(subject.target_uri).to be_kind_of URI
38+
end
39+
end
40+
41+
describe '#typo3_url_login' do
42+
it 'ends with /typo3/index.php' do
43+
expect(subject.typo3_url_login).to end_with('/typo3/index.php')
44+
end
45+
end
46+
47+
describe '#typo3_url_backend' do
48+
it 'ends with /typo3/backend.php' do
49+
expect(subject.typo3_url_backend).to end_with('/typo3/backend.php')
50+
end
51+
end
52+
53+
describe '#typo3_admin_cookie_valid?' do
54+
it 'returns true when valid admin cookie' do
55+
allow(subject).to receive(:send_request_cgi) do
56+
res = Rex::Proto::Http::Response.new
57+
res.body = '<body class="test" id="typo3-backend-php">'
58+
res
59+
end
60+
61+
expect(subject.typo3_admin_cookie_valid?("#{valid_cookie};")).to eq(true)
62+
end
63+
64+
it 'returns false when invalid admin cookie' do
65+
allow(subject).to receive(:send_request_cgi) do
66+
res = Rex::Proto::Http::Response.new
67+
res
68+
end
69+
70+
expect(subject.typo3_admin_cookie_valid?("invalid")).to eq(false)
71+
end
72+
end
73+
74+
describe '#typo3_backend_login' do
75+
76+
it 'returns nil login page can not be reached' do
77+
allow(subject).to receive(:send_request_cgi) do
78+
res = Rex::Proto::Http::Response::E404.new
79+
res
80+
end
81+
82+
expect(subject.typo3_backend_login(valid_user, valid_password)).to be_nil
83+
end
84+
85+
it 'returns nil when login page can be reached but isn\'t a TYPO3' do
86+
allow(subject).to receive(:send_request_cgi) do
87+
res = Rex::Proto::Http::Response.new
88+
res.body = 'Hello World'
89+
res
90+
end
91+
92+
expect(subject.typo3_backend_login(valid_user, valid_password)).to be_nil
93+
end
94+
95+
it 'returns nil when TYPO3 credentials are invalid' do
96+
97+
allow(subject).to receive(:send_request_cgi) do |opts|
98+
if opts['uri'] == "/typo3/index.php" && opts['method'] == 'GET'
99+
res = Rex::Proto::Http::Response.new
100+
res.body = '<input type="hidden" id="rsa_e" name="e" value="10001" />'
101+
res.body << '<input type="hidden" id="rsa_n" name="n" value="B8C58D75B5F9DBCEBBF6FB96BDB9531C64C45DDED56D93B310FA9C79B9787E62C91157DD5842B2BC1D90C10251300571BEEF892776F25EAC80C2672A993B00DA2F1C966C3F70418274E1AC9C432F48F8CBD9D083F990905F7EC5BDFC1B5C93672E7ACBB3D935D0597864A1F732DD44B5C6E02344917543E33A36D68915B26DC9" />'
102+
elsif opts['uri'] == "/typo3/index.php" && opts['method'] == 'POST'
103+
res = Rex::Proto::Http::Response.new
104+
res.body = '<!-- ###LOGIN_ERROR### begin -->Login Failed<!-- ###LOGIN_ERROR### end -->'
105+
else
106+
res = Rex::Proto::Http::Response::E404.new
107+
end
108+
109+
res
110+
end
111+
112+
expect(subject.typo3_backend_login(invalid_user, invalid_password)).to be_nil
113+
end
114+
115+
it 'returns a cookie string when TYPO3 credentials are valid' do
116+
allow(subject).to receive(:send_request_cgi) do |opts|
117+
if opts['uri'] == "/typo3/index.php" && opts['method'] == 'GET'
118+
res = Rex::Proto::Http::Response.new
119+
res.body = '<input type="hidden" id="rsa_e" name="e" value="10001" />'
120+
res.body << '<input type="hidden" id="rsa_n" name="n" value="B8C58D75B5F9DBCEBBF6FB96BDB9531C64C45DDED56D93B310FA9C79B9787E62C91157DD5842B2BC1D90C10251300571BEEF892776F25EAC80C2672A993B00DA2F1C966C3F70418274E1AC9C432F48F8CBD9D083F990905F7EC5BDFC1B5C93672E7ACBB3D935D0597864A1F732DD44B5C6E02344917543E33A36D68915B26DC9" />'
121+
elsif opts['uri'] == "/typo3/index.php" && opts['method'] == 'POST'
122+
res = Rex::Proto::Http::Response.new
123+
res.headers['Set-Cookie'] = "#{valid_cookie};"
124+
elsif opts['uri'] == "/typo3/backend.php" && opts['method'] == 'GET'
125+
res = Rex::Proto::Http::Response.new
126+
res.body = '<body class="test" id="typo3-backend-php">'
127+
res
128+
else
129+
res = Rex::Proto::Http::Response::E404.new
130+
end
131+
132+
res
133+
end
134+
135+
expect(subject.typo3_backend_login(valid_user, valid_password)).to include(valid_cookie)
136+
end
137+
end
138+
139+
end

0 commit comments

Comments
 (0)