Skip to content

Commit 878247f

Browse files
committed
Small modifications
1 parent f1d5d8f commit 878247f

File tree

1 file changed

+6
-15
lines changed

1 file changed

+6
-15
lines changed

modules/auxiliary/scanner/http/gitlab_user_enum.rb

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ def initialize(info = {})
2020
The Gitlab 'internal' API is exposed unauthenticated on Gitlab. This
2121
allows the username for each SSH Key ID number to be retrieved. Users
2222
who do not have an SSH Key cannot be enumerated in this fashion. LDAP
23-
users, e.g. Active Directory users will also be returned.
24-
This issue was fixed in Gitlab v7.5.0.
23+
users, e.g. Active Directory users will also be returned. This issue
24+
was fixed in Gitlab v7.5.0 and is present from Gitlab v5.0.0.
2525
",
2626
'Author' => 'Ben Campbell',
2727
'License' => MSF_LICENSE,
@@ -41,8 +41,7 @@ def initialize(info = {})
4141
end
4242

4343
def run_host(_ip)
44-
api = '/api/v3'
45-
internal_api = "#{api}/internal"
44+
internal_api = '/api/v3/internal'
4645
check = normalize_uri(target_uri.path, internal_api, 'check')
4746

4847
print_status('Sending gitlab version request...')
@@ -56,7 +55,7 @@ def run_host(_ip)
5655
git_revision = version['gitlab_rev']
5756
print_good("GitLab version: #{git_version} revision: #{git_revision}")
5857

59-
report_service(
58+
service = report_service(
6059
host: rhost,
6160
port: rport,
6261
name: (ssl ? 'https' : 'http'),
@@ -106,19 +105,11 @@ def run_host(_ip)
106105
end
107106

108107
unless users.nil? || users.to_s.empty?
109-
store_userlist(users)
108+
store_userlist(users, service)
110109
end
111110
end
112111

113-
def store_userlist(users)
114-
name = datastore['SSL'] ? 'https' : 'http'
115-
service = report_service(
116-
:host => rhost,
117-
:port => rport,
118-
:name => name,
119-
:proto => 'tcp'
120-
)
121-
112+
def store_userlist(users, service)
122113
loot = store_loot('gitlab.users', 'text/plain', rhost, users, nil, 'Gitlab Users', service)
123114
print_good("Userlist stored at #{loot}")
124115
end

0 commit comments

Comments
 (0)