Skip to content

Commit 704a121

Browse files
committed
Land rapid7#8498, store more specific credential wordpress_directory_traversal_dos
2 parents 0515980 + 80e91e9 commit 704a121

File tree

1 file changed

+2
-34
lines changed

1 file changed

+2
-34
lines changed

modules/auxiliary/dos/http/wordpress_directory_traversal_dos.rb

Lines changed: 2 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -66,43 +66,10 @@ def depth
6666
datastore['DEPTH']
6767
end
6868

69-
def report_cred(opts)
70-
service_data = {
71-
address: opts[:ip],
72-
port: opts[:port],
73-
service_name: opts[:service_name],
74-
protocol: 'tcp',
75-
workspace_id: myworkspace_id
76-
}
77-
78-
credential_data = {
79-
origin_type: :service,
80-
module_fullname: fullname,
81-
username: opts[:user]
82-
}.merge(service_data)
83-
84-
login_data = {
85-
last_attempted_at: DateTime.now,
86-
core: create_credential(credential_data),
87-
status: Metasploit::Model::Login::Status::SUCCESSFUL,
88-
proof: opts[:proof]
89-
}.merge(service_data)
90-
91-
create_credential_login(login_data)
92-
end
93-
9469
def user_exists(user)
9570
exists = wordpress_user_exists?(user)
9671
if exists
97-
print_good("Username \"#{username}\" is valid")
98-
report_cred(
99-
ip: rhost,
100-
port: rport,
101-
user: user,
102-
service_name: (ssl ? 'https' : 'http'),
103-
proof: "WEBAPP=\"Wordpress\", VHOST=#{vhost}"
104-
)
105-
72+
print_good("Username \"#{user}\" is valid")
10673
return true
10774
else
10875
print_error("\"#{user}\" is not a valid username")
@@ -121,6 +88,7 @@ def run
12188
starting_thread = 1
12289

12390
cookie = wordpress_login(username, password)
91+
store_valid_credential(user: username, private: password, proof: cookie)
12492
if cookie.nil?
12593
print_error('Aborting operation - failed to authenticate')
12694
return

0 commit comments

Comments
 (0)