treat MUST_CHANGE + PASSWORD_EXPIRED as valid

Author: busterb

lib/metasploit/framework/login_scanner/smb.rb

@@ -118,14 +118,14 @@ def attempt_login(credential)
             end
 
             case status_code.name
-              when *StatusCodes::CORRECT_CREDENTIAL_STATUS_CODES
-                status = Metasploit::Model::Login::Status::DENIED_ACCESS
-              when 'STATUS_SUCCESS', 'STATUS_PASSWORD_MUST_CHANGE'
+              when 'STATUS_SUCCESS', 'STATUS_PASSWORD_MUST_CHANGE', 'STATUS_PASSWORD_EXPIRED'
                 status = Metasploit::Model::Login::Status::SUCCESSFUL
               when 'STATUS_ACCOUNT_LOCKED_OUT'
                 status = Metasploit::Model::Login::Status::LOCKED_OUT
               when 'STATUS_LOGON_FAILURE', 'STATUS_ACCESS_DENIED'
                 status = Metasploit::Model::Login::Status::INCORRECT
+              when *StatusCodes::CORRECT_CREDENTIAL_STATUS_CODES
+                status = Metasploit::Model::Login::Status::DENIED_ACCESS
               else
                 status = Metasploit::Model::Login::Status::INCORRECT
             end